1. Exchange-level theft: even large platforms have lost hundreds of millions

In February 2025, Bybit suffered one of the largest cryptocurrency thefts ever reported, with approximately $1.5 billion in crypto assets stolen. U.S. authorities attributed the attack to North Korea-linked activity known as TraderTraitor. The case shocked the market because it showed that even mature platforms with professional security teams can be exposed to high-value, highly coordinated attacks.

Other major cases have also affected centralized platforms. Japan-based DMM Bitcoin disclosed that 4,502.9 BTC had been lost in an unauthorized outflow in 2024. Indian crypto platform WazirX also confirmed a major breach involving more than $200 million in crypto assets.

Sources referenced in this article include public reports from the FBI, Reuters, Chainalysis, TRM Labs, Elliptic, and major news outlets.

2. Fake support and social engineering: the victim may hand over access without realizing it

Some thefts do not begin with a technical exploit. They begin with trust. Attackers may pretend to be exchange support staff, wallet security teams, Google support, law enforcement, or recovery specialists. They create urgency, tell victims their account is at risk, and push them to click a link, share a screen, install remote-control software, or move funds.

In one widely reported U.S. case, a victim lost thousands of bitcoins after being deceived through a sophisticated social-engineering scheme. The lesson is clear: attackers often do not need to break the blockchain. They only need to trick the owner.

3. Wallet approval phishing: clicking “approve” can give attackers permission

Many crypto users believe funds are only lost when they deliberately send a transaction. That is not always true. In approval phishing, a fake airdrop, fake staking page, fake NFT mint, or fake exchange verification page asks the user to connect a wallet and approve a transaction. The page may look harmless, but the approval can grant a malicious contract permission to move tokens.

Once a dangerous approval is signed, the attacker may drain assets quickly. The victim may not understand what happened until the wallet balance disappears.

4. After theft: recovery is difficult, and “guaranteed recovery” is usually another scam

Blockchain transactions are traceable, but they are usually not reversible. Investigators may track funds, exchanges may freeze assets if they arrive at identifiable accounts, and law enforcement may recover funds in some cases. However, ordinary users should not rely on instant recovery.

Victims should preserve transaction hashes, wallet addresses, screenshots, website URLs, chat records, email headers, and timing information. They should report the incident to the relevant platform and local authorities as quickly as possible. They should also be extremely careful of anyone claiming they can “recover everything” for an upfront fee.

Immediate safety checklist

• Type exchange and wallet websites manually, or use trusted bookmarks.
• Never enter a seed phrase or private key into a website.
• Review every wallet approval before signing.
• Use hardware wallets for long-term holdings.
• Enable strong two-factor authentication that is not SMS-only.
• Be suspicious of urgent messages, fake support, fake airdrops, and recovery promises.