Three Common Ways Crypto Is Stolen — and How to Prevent Them

Why crypto needs active protection

Blockchain transfers usually cannot be reversed, and control sits with private keys, seed phrases, and wallet approvals. Once those credentials leak, or a user signs a malicious approval without understanding it, recovery is far harder than with traditional payments. The effective strategy is not “get it back later,” but reducing exposure first.

Entry

Strange links, fake support, group DMs, or search ads pull the user into a scam.

Trust

Official logos, fake screenshots, promised returns, or urgent notices lower caution.

Access

The victim is pushed to hand over credentials, install software, or approve unexpected on-chain permissions.

Transfer

Funds are split and moved quickly, making tracing and freezes harder.

Remember the core rule: whoever holds the private key holds the assets. Seed phrases, keys, and verification codes should never go to anyone, including so-called official support.

The three most common theft methods

These cases are told from the victim’s side. Real incidents often combine methods: a phishing page may sit next to malware, and fake support may also push a dangerous approval.

Phishing sites, fake wallets, and malicious approvals

This is one of the most common paths. Scammers copy exchange logins, wallet download pages, project sites, or airdrop pages until they look almost identical to the real thing. The target is not always a password. On-chain, the more dangerous ask is a seed phrase, a private key, or a wallet signature the user did not actually understand.

Real case 01 · 2022 OpenSea NFT theft

From a “migration notice” to NFTs leaving the wallet

The images below come from CertiK’s investigation of the same incident. The report said NFTs from 28 wallets were stolen, worth about $2 million.

A fake migration email arrives

OpenSea was changing contracts and listings at the time. Scammers used that real backdrop to send mail urging users to click “Get Started.”

The fake migration email used the look of a real announcement. Source: CertiK.
An unexpected approval is signed on a phishing page

The report said the email led users to a phishing page. They thought they were migrating listings, but signed permission to move NFTs. There is no reliable live screenshot of this step; the write-up follows the investigation record.
On-chain records show the NFTs leaving

The report linked the victim wallet, the phishing wallet, and a zero-price transfer. Users then found the NFTs gone.

On-chain transfer record from the investigation. Source: CertiK.

Warning: “The project is upgrading” can be a real headline, but email links and wallet signatures still need independent checks. Do not approve based on look-alike pages or urgent wording.

Common variants

Fake support tickets, fake staking pages, fake NFT mints, fake browser extensions, and “migration” notices that pretend to come from the project.

Why people fall for it

The page looks right. The domain is one character off. The wallet popup is hard to read. A countdown pushes the user to skip checks.

Key defenses

Open official sites from bookmarks. Never type a seed phrase into a webpage. Reject signatures you do not understand. Keep long-term wallets away from unknown apps. Revoke idle approvals regularly.

Malware, clipboard swap, and a compromised device

This risk lives on the device. Malware can look like an investment tool, cracked software, an office attachment, a wallet installer, or a browser add-on. After the device is compromised, attackers may read saved browser data, capture input, watch the screen, or replace a copied deposit address with another one.

Real case 02 · 2024 DMM Bitcoin theft

4,502.9 BTC stolen from DMM Bitcoin

The sequence follows the joint FBI and Japanese police notice. The fund-flow image is from Elliptic’s investigation.

A recruiter pose reaches an employee

Attackers contacted staff with wallet-management access and hid malicious code inside a recruiting test. Public notices did not publish a photo of that conversation.
Session data leaked and a normal request was altered

The notice said attackers used the compromised employee’s session to enter business communications and may have changed a transfer that started as legitimate.
4,502.9 BTC left and was split up

DMM Bitcoin lost 4,502.9 BTC, then worth about $308 million. The image below is Elliptic’s live tracing view of the stolen funds being spread across wallets.

DMM Bitcoin stolen-fund flow. Source: Elliptic, May 2024.

Warning: Check the source of recruiting tests, partner files, and outside code. Companies also need to protect session credentials and independently review large transfers. This case is not a clipboard-swap example.

Common variants

Fake wallet updates, malicious extensions, remote-control tools, attachments dressed as spreadsheets or contracts, and installers that sit at the top of search results.

Warning signs

The pasted address no longer matches. Unknown extensions or high-privilege programs appear. Security software is turned off. Login location, sessions, or system settings change without reason.

Key defenses

Install only from official sources. Keep systems updated. Refuse unnecessary accessibility or remote-control rights. Recheck addresses on a hardware-wallet screen. Test large transfers with a small amount first.

Social engineering, account takeover, and impersonation

Social engineering uses trust and emotion. Scammers may pose as platform support, project admins, investment coaches, recruiters, or friends. They study public details, then use urgent notices, refunds, prizes, or freeze warnings to harvest codes, share a screen, or push a transfer to a given address.

Real case 03 · 2020 social-account takeover

The 2020 “bitcoin double” scam

The timeline is in a U.S. Justice Department notice. The screenshot was collected by Chainalysis.

Trusted accounts are taken over

Verified accounts of public figures and institutions were affected. Followers still saw familiar names, photos, and checkmarks.
The accounts post a “send bitcoin, get double” message

The scam post asked readers to send bitcoin first and promised a double return shortly after. That is the transfer trap.

A real scam post from a taken-over account. Source: Chainalysis. The address in the image is case evidence — do not send funds to it.
Victims send funds and nothing comes back

The Justice Department said the scam address received more than 400 transfers worth over $100,000. A verification badge did not prove the account owner wrote the post.

Warning: “Send coins now, get more later” is a stop sign. Even if the message comes from a verified account or a friend, confirm through a second channel.

Common variants

Official-looking support DMs, hijacked friend accounts asking for a loan, fake trading groups, fake hiring tests, and “refund help” that demands screen sharing.

The language

It must be handled now. Returns are guaranteed. Keep it secret. Do not hang up or tell family. The code is “just a confirmation.”

Key defenses

Support will not ask for a seed phrase or private key. Confirm any money request on a second channel. Use an authenticator or hardware key. Use different passwords for email, exchanges, and social accounts.

The common thread is handing over control while information is incomplete or emotions are high. If you hear “limited time, keep it secret, guaranteed profit, verify now, support messaged first,” pause.

Phishing sites and fake apps

Scammers copy exchanges, wallets, or popular project pages to collect passwords, seed phrases, or dangerous approvals.

Common signals

A domain with a tiny spelling change
Urgency built around an “airdrop” or “account freeze”
Requests for a seed phrase, private key, or screen share

How to prevent it

Bookmark official URLs and skip unknown links
Install only from official stores or the official site
Check the target, amount, and permission range before signing

Malware and clipboard hijacking

Unknown software, extensions, or attachments can steal local credentials or silently replace a deposit address.

Common signals

The send address no longer matches what you copied
Unknown extensions appear in the wallet or browser
Sudden lag, pop-ups, or disabled security settings

How to prevent it

Keep the system, browser, and security software updated
Do not install cracked software or unknown extensions
Keep large holdings on a hardware wallet and check the address character by character

Social engineering and account takeover

Attackers pose as support, friends, or project teams to collect codes, reset accounts, or take over email and phone numbers.

Common signals

“Support” messages first and asks for a code
A friend’s account suddenly needs an urgent transfer
Email, phone, or exchange logins from a new location

How to prevent it

Confirm identity through official channels
Use an authenticator or hardware key instead of SMS alone
Set different strong passwords for email, exchanges, and wallets

Four high-frequency scam scenes

Many scams do not need advanced tools. They use greed, fear, trust, and time pressure. Stop and verify when you see these.

“Limited airdrop, claim now”

The page asks you to connect a wallet and sign repeatedly, without a clear contract, permission range, or fee.

Do this: Cross-check official project channels. Reject unfamiliar signatures. Use a small isolated wallet for campaigns.

“Your account is at risk, unfreeze now”

Someone posing as support creates panic and asks for a code, a screen share, or remote-control software.

Do this: End the chat. Open the official app yourself or type the official URL, then contact support from that official entry.

“The coach never loses”

A group shows fake profit screenshots, returns a small amount first, then pushes a large deposit to an unknown platform.

Do this: Treat guaranteed high returns as a warning. Check the platform. Do not send funds to a personal address.

“A friend needs money now”

A friend’s social account may already be taken over. The scammer copies their tone and uses an emergency to rush a transfer.

Do this: Confirm identity by phone or another independent channel, and ask something only the two of you would know.

What to check before connecting a wallet or signing

Connecting a wallet does not always move funds immediately, but later signatures can create real permissions. If you cannot read it, do not sign.

Check	Confirm	Danger signs
Website source	The domain matches official notices, the certificate looks normal, and you arrived from a saved bookmark	Look-alike domains, short links, ads sitting at the top of search
Signature content	Purpose, network, token, amount, and expiry match the action you meant to take	Unreadable text, unlimited allowance, mismatch with the page
Contract and counterparty	The target can be checked through official channels or a trusted explorer	Newly deployed with no history, or an address sent in a private message
Wallet setup	Everyday wallets stay separate from long-term savings	Using the wallet that holds everything to try a new project
Transfer address	The first and last characters match the original address, and a small test succeeds	The address changes after paste, or the other party suddenly switches addresses

Split wallets to limit a single loss

Long-term savings wallet

Holds the main balance. Prefer a hardware wallet or reliable offline storage, and keep it away from unknown contracts.

Use it rarely
Keep multiple offline backups
Recheck before large transfers

Everyday wallet

Holds only what you can afford to lose for DeFi, NFTs, or other on-chain use, and gets unused approvals cleaned out.

Cap the balance
One wallet per use is clearer
Stop using it as soon as something looks wrong

Splitting wallets does not remove risk, but it can keep one bad signature or leak from taking everything.

Asset security checklist

Ten minutes on these settings often beats trying to recover funds later.

Keep the seed phrase offline. Do not photograph it or upload it to cloud storage
Turn on two-factor authentication and store recovery codes safely
Set withdrawal allowlists and risk alerts on trading accounts
Keep only small everyday amounts in hot wallets
Review and revoke unused on-chain approvals
Test with a small amount before any large transfer

Six common security myths

Myth 1: HTTPS means the site is safe

HTTPS only encrypts the connection. It does not prove the operator is trustworthy. Phishing sites can get certificates too.

Myth 2: Small wallets do not need protection

A small wallet may still hold email, identity details, or old approvals, and can become an entry point for the next scam.

Myth 3: Hardware wallets cannot be stolen from

A hardware wallet isolates the key, but you can still confirm the wrong address or a dangerous transaction on the device.

Myth 4: An official avatar means an official person

Avatars, names, and verification screenshots can be faked. Identity checks have to go back to channels published on the official site.

Myth 5: Photos are the easiest way to store a seed phrase

Photos can sync to the cloud or leak through malware and shared albums. Use a durable, offline, private backup.

Myth 6: Changing the password is enough after a hit

If the seed phrase leaked, the old wallet is no longer safe. If an approval looks wrong, revoke it and move the remaining assets.

What to do if something looks wrong

Stop signing, transferring, or talking to the suspicious contact.
Change email and exchange passwords on a trusted device, and revoke suspicious sessions.
If a private key or seed phrase may have leaked, move remaining assets to a new safe wallet.
Check recent on-chain approvals and revoke anything unnecessary. Do not keep working on a device that may be infected.
Save chats, transaction hashes, wallet addresses, domains, a timeline, and screenshots. Do not destroy evidence.
Contact official platform support and local law enforcement. Watch for a second scam that asks you to pay first to “recover” funds.