Cryptocurrency scams cost victims $11.366 billion in 2025—a 22% jump from the prior year—across 181,565 reported complaints, with the average victim now losing $2,764, triple the 2024 figure. Attackers bypass traditional security through phishing, physical counterfeit mail, deepfake impersonation, and malware that targets how people actually use wallets, not just the wallets themselves. Older adults are the primary target: individuals 60 and over reported $2.8 billion in losses alone. The entry points range from requesting seed phrases (the master key to a crypto wallet) via impersonated customer support, to malicious token approvals that drain holdings silently, to clipboard-hijacking malware that swaps wallet addresses mid-transaction.
Table of Contents
- The Scale and Shape of the Problem
- The Attack Vectors
- How Trust Gets Exploited
- Why Hardware Wallets Aren't Enough
- Practical Protections
The Scale and Shape of the Problem
The FBI data shows investment scams comprised $7.23 billion of the $11.366 billion total in cryptocurrency fraud losses during 2025, making it the single largest category. What's notable is not just the total, but how it's distributed: per-victim losses surged 253% in one year to $2,764, compared to $782 in 2024.
This shift suggests attackers are abandoning high-volume, low-value schemes in favor of targeting fewer, wealthier individuals. Older adults aged 60 and over sustained the heaviest losses at $2.8 billion, making them the demographic most frequently exploited. This is not incidental; attackers actively target this group through relationship-building, fake investment platforms, and impersonation of trusted financial figures.
The Attack Vectors
entry points are more varied than most readers expect. Phishing for seed phrases, malicious token approvals that drain holdings via compromised wallet permissions, and device-level malware operating below the wallet application itself represent the primary digital vectors. Seed phrases—the 12 or 24-word master keys that unlock a wallet—are the most coveted target because they grant full control regardless of any other security.
In February 2026, Ledger and Trezor customers received physical counterfeit letters with fake holographic seals and phishing QR codes, blurring the line between digital and physical social engineering. Wallet compromise emerged as the costliest attack vector in the first half of 2026, with attackers targeting key management and governance infrastructure rather than exploiting code flaws. Clipboard-hijacking malware like Torg Grabber silently replaced copied wallet addresses with attacker addresses, affecting 728 wallets in March 2026, preventing detection until settlement time.
How Trust Gets Exploited
A January 2026 Trezor impersonation scam convinced one victim to surrender their hardware wallet recovery seed, resulting in theft of 1,459 BTC and 2.05 million LTC worth $284.78 million. The victim had a hardware wallet—one of the most secure devices available—but the attacker contacted them impersonating legitimate support and requested the recovery seed directly. No code vulnerability was needed; the victim simply trusted what appeared to be official support.
Deepfakes drove $4.6 billion in crypto scams in 2025, enabling convincing impersonation of customer support, crypto influencers, and financial figures. Combined with deepfake audio and video, an attacker can pose as a well-known personality or support team member with apparent proof. Investment Ponzi schemes drained $6.8 billion in 2025, typically starting on social or dating platforms where attackers build prolonged trust before directing victims to fake trading platforms. The weeks or months of relationship-building lower the victim's skepticism when the "opportunity" finally arrives.
Why Hardware Wallets Aren't Enough
A hardware wallet—a physical device that stores keys offline—prevents remote hacking of the keys themselves. It does not prevent someone from asking you to surrender the seed phrase, nor does it stop you from approving a malicious token transaction on your screen. The Trezor victim had the best security device available and still lost $284 million because the attack was social, not technical.
This matters because many readers purchase hardware wallets believing they've solved the security problem. They've reduced the attack surface significantly, but only against technical attacks. Against phishing, impersonation, deepfakes, and coercion, a hardware wallet offers no defense. The vulnerability moved upstream to human judgment.
Practical Protections
.
- **Never share your seed phrase with anyone, including support staff.** Legitimate wallet companies will never ask for it. If someone contacts you claiming to be support, verify independently through the official website or phone number before responding.
- **Verify addresses before sending.** Use separate communication channels to confirm wallet addresses. Do not rely solely on copy-paste; manually check the first and last characters at minimum.
- **Be skeptical of unsolicited investment opportunities,** particularly those built through relationship-building on social or dating platforms. If someone wants you to move assets to a "trading platform" they recommend, that is a strong warning signal.
- **Assume deepfakes exist.** If a crypto influencer or support representative initiates contact with a time-sensitive request, treat it as unverified until you confirm it through official channels independently.
- **Use additional verification for sensitive approvals.** When a wallet asks you to approve a token, confirm what you're actually approving. Malicious approvals can grant permission to drain your holdings without further prompts.
You Might Also Like
- Cybersecurity — Patient Data Exposed Security Review: Entry Point, Impact, and Lessons
- Cybersecurity — HIPAA Breach Security Review: Entry Point, Impact, and Lessons
- What Is New With Financial Sector Data Breach News in August 2026? Latest breach notices and security advisories and Key Takeaways