Do Not Click Unknown Links: Once Crypto Is Stolen, There Is No Simple Undo Button
This is not a routine scam warning. Public news cases show exchanges losing hundreds of millions of dollars, while individual users can lose everything after one fake support message, one malicious link, or one wallet approval.
Do not assume a large exchange means absolute safety: Bybit, DMM Bitcoin, and WazirX all suffered major thefts
The FBI stated that North Korea-linked TraderTraitor actors were responsible for the February 2025 theft of approximately $1.5 billion in virtual assets from Bybit. In 2024, Japan-based DMM Bitcoin disclosed the loss of 4,502.9 bitcoin, worth about $308 million at the time. India-linked platform WazirX also confirmed a breach involving roughly $230 million in crypto assets.
These incidents show that attackers do not only target individual investors. They target exchanges, custodians, employees, signing workflows, wallet infrastructure, and third-party systems. If large platforms can be attacked, an unknown link in a text message, direct message, email, or fake support chat should be treated as dangerous by default.
- Bybit: the FBI attributed the approximately $1.5 billion theft to North Korea-linked TraderTraitor activity.
- DMM Bitcoin: Reuters reported the leak of 4,502.9 BTC, worth about 48.2 billion yen, or roughly $308 million.
- WazirX: The Record reported that at least about $230 million was stolen, and the platform paused withdrawals.
- User warning: do not keep all assets in one hot wallet, one exchange account, or one browser environment.
If someone knows your name, email, or account details, that still does not prove they are real support
In 2025, Coinbase said criminals had bribed and recruited a group of overseas support agents to steal a limited amount of customer data for social engineering attacks. Coinbase said passwords, private keys, and funds were not directly exposed, but the data could still be used to impersonate support and trick users into moving funds.
In another case reported by AP, a 19-year-old was involved in an online scheme connected to the theft of 4,100 bitcoin from a victim. The U.S. Department of Justice also announced charges in a separate alleged crypto scam involving more than $230 million. The pattern is clear: attackers create fear, sound professional, and push users to act before they think.
- Fake support creates pressure: “your account is at risk,” “your assets are frozen,” “verify immediately.”
- Fake support sends links: “security center,” “support ticket,” “asset protection page,” or “wallet migration page.”
- Fake support asks for access: screen sharing, verification codes, wallet connection, or transfers to a “safe address.”
- Remember this: real support will not ask for your seed phrase, private key, or remote control of your device.
Connecting a wallet is not “just logging in.” One approval can give attackers permission to drain assets
Chainalysis reported that targeted approval phishing was responsible for at least $374 million in suspected stolen crypto in 2023. Later reporting around Operation Atlantic focused on the same core threat: victims are tricked into approving transactions that let criminals drain wallets.
Many phishing pages pretend to be airdrops, staking offers, mining portals, NFT claims, wallet upgrades, or account verification pages. The victim thinks they are only clicking, connecting, or signing once. In reality, the request may authorize a malicious contract to move tokens or NFTs.
- If you see an airdrop link: treat it as a scam until proven otherwise. Do not rush to connect your wallet.
- If you see “Approve all”: stop. Do not sign unknown contracts from unknown sites.
- If you see “Set approval for all”: treat it as high risk. It may authorize transfers of NFTs or tokens.
- If a website asks for your seed phrase: close it immediately. Legitimate websites do not need your seed phrase.
Do not believe “guaranteed recovery.” Crypto can be traceable, but that does not mean your money comes back fast
In the Bybit notice, the FBI said stolen assets were converted and dispersed, and could be further laundered. FBI victim guidance also advises users to report quickly and provide transaction IDs, wallet addresses, amounts, dates, times, and related communication.
The U.S. Department of Justice has recovered large amounts in major cases such as Bitfinex, but those results required years of investigation, blockchain tracing, legal process, and international coordination. For ordinary users, there is no customer-service button that instantly reverses an on-chain transfer. Prevention is far more realistic than recovery.
- ×Do not send a second payment. “Unlock fees,” “verification deposits,” “recovery fees,” and “guarantee payments” are often second-stage scams.
- ×Do not delete evidence. Keep links, domains, wallet addresses, transaction hashes, screenshots, emails, and chat records.
- ✓Contact the platform immediately. Ask exchanges, wallets, or custodians to flag risky addresses and freeze funds if they reach a hosted account.
- ✓Report quickly. Provide transaction hashes, wallet addresses, amounts, timestamps, chat records, and website links.