Social-engineering attacks are increasingly becoming one of cryptocurrency’s most effective theft methods, with criminals taking over familiar accounts, phone numbers, or business conversations to persuade victims to authorize transactions themselves. The approach avoids the technical challenge of breaking wallet encryption or exploiting smart contracts: attackers instead gain control of the person or channel trusted to give instructions.
A federal court filing in Cheng v. T-Mobile illustrates how quickly a telecom breach can become a crypto loss. The complaint described a SIM-swap attack that gave an intruder control over the victim’s Telegram account. Using that access, the attacker induced the victim to send 15 BTC. The case shows why a familiar chat history or established account is not sufficient proof that the person sending a request remains in control of it.
The same risk has spread into professional settings. The “GrassCall” campaign disclosed in 2025 posed as a Web3 job-interview process and delivered malware designed to steal credentials. Recruiting pitches, video-call invitations, software updates and technical tasks have become useful delivery mechanisms because they can appear routine to developers, founders and employees accustomed to installing tools and communicating with unfamiliar contacts.
The Federal Bureau of Investigation reported that internet scams caused $11.3 billion in direct financial losses during 2025. Cryptocurrency theft is only one component of that wider fraud economy, but account takeover and impersonation give criminals a route into wallets and trading accounts that traditional cybersecurity defenses may not stop once a legitimate user has approved a transfer.
Trusted accounts can become fraudulent channels
Five patterns recur across account-based crypto fraud: takeover of established social-media or messaging accounts; targeted scams following a SIM swap or other telecom compromise; long-running relationship fraud that eventually directs victims to fake investment platforms; recruitment and business lures carrying malware; and fake customer-support interactions.
Each pattern exploits a gap between account authenticity and message authenticity. A Telegram, X, email or WhatsApp account may be real, have years of conversation history and belong to a known contact. That does not establish that a new payment request, wallet address or software link came from the original account holder.
Criminals often use that credibility to avoid raising alarms. Rather than sending an obviously fraudulent message from a new profile, an attacker can contact friends, colleagues or clients from a compromised account and cite previous conversations. A request to “use a new address,” “move funds urgently” or “install this meeting application” can then appear consistent with a real relationship.
The loss patterns can also differ depending on who carries out the theft. External attackers commonly move assets rapidly through several addresses after gaining access. Acquaintance-driven or insider theft may produce more ordinary-looking activity, including transactions from a victim’s usual device or home IP address. Funds can disappear in smaller transfers over weeks or months, making the activity easier to confuse with legitimate account use.
BlockSec, a blockchain security firm founded in 2021, says it has served more than 1,000 clients and protected more than $50 billion in on-chain assets. The company says its illicit-address database contains more than 600 million labels, while its largest fully reconstructed case involved $1.6 billion in funds. Such tracing can help identify where assets moved, but it does not guarantee recovery. Freezes and clawbacks typically require cooperation among platforms, stablecoin issuers, security companies and law-enforcement agencies.
Friction can limit damage after a takeover
The most practical defenses focus on preventing an account compromise from immediately becoming an irreversible withdrawal. Security controls should cover login activity, withdrawals, changes to outbound-transfer methods and changes to account protections.
A separate funds password, distinct from the password used for ordinary account access, can add a barrier before assets leave an account. Monitoring unusual IP locations and reviewing security logs can also reveal a takeover before funds are transferred.
Cooldown periods are particularly valuable after sensitive changes. A newly added withdrawal address can be subject to a mandatory waiting period of 24 to 48 hours, creating time for the legitimate user to spot an unauthorized change. Platforms can also place an account-wide withdrawal lock after changes to two-factor authentication, a funds password or a bound phone number. These controls do not eliminate fraud, but they reduce the chance that a single compromised session leads directly to an immediate payout.
Users can create similar friction in their own setup by lowering daily withdrawal limits, disabling unused payout methods and separating high-value assets from everyday trading or decentralized-finance activity. Broad token allowances granted to older decentralized applications should also be reviewed and revoked where no longer needed. An approval can allow a smart contract to move specified tokens without a new approval for each transfer, so unused unlimited permissions can enlarge the damage from a compromised wallet session.
For larger holdings, time-locked vaults and multi-signature arrangements can distribute approval power among separate people or devices. A time lock delays execution after a transfer is proposed, while multi-signature controls require several authorized approvals. Together, those mechanisms can prevent one deceived person from moving all funds instantly.
Confirm payment changes outside the original chat
When payment details change, verification should happen through an independent channel. A call to a known phone number, rather than the number supplied in a new chat message, can expose an impersonation attempt. Large transfers also warrant a fresh address check and, where practical, a small test transaction before the main payment.
Authentication methods that resist phishing can further reduce exposure. Passkeys tie authentication to a legitimate website and a user’s device, generally requiring biometric verification or device access. Physical security keys require possession of a hardware token. Both methods make stolen passwords and personal information less useful to an attacker attempting to log in remotely.
If compromise is suspected, the immediate priority is to remove access. Users should work from a trusted device to change passwords, force other sessions to log out, revoke suspicious OAuth and third-party application permissions, and reconfigure multi-factor authentication. Email accounts, phone numbers, password managers and wallet credentials should then be assessed as potential upstream entry points.
Login alerts, emails, text messages, chat logs, malicious links, installers, device logs, transaction hashes and destination addresses should be retained. Those records can support tracing and requests for assistance before funds are moved further.
The strongest protection against social engineering remains procedural: no single chat message, account login or familiar voice should be enough to authorize a major crypto transfer.
For more ways to recognize and block scams, read is social engineering crypto’s biggest threat and strengthen your defenses.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
