Key Takeaways
- • The FBI's Internet Crime Complaint Center recorded about $11.4 billion in cryptocurrency-related losses in 2025 out of $20.9 billion in total reported losses, according to The Block's summary of the 2025 IC3 report.
- • Chainalysis estimated scams took in at least $14 billion on-chain during 2025, with impersonation tactics up 1,400% year over year and the average scam payment rising 253% to $2,764.
- • A recovery phrase is the master key to a self-custody wallet and should never be entered on any website, app or form; legitimate vendors, exchanges and support agents never request it.
- • Replacing SMS-based multi-factor authentication with FIDO2 security keys or passkeys defends against SIM swap attacks, which CISA guidance ranks above app codes and SMS.
- • Hardware wallet users should verify addresses and transaction details on the device screen, avoid blind signing, and keep exchange balances small with withdrawal allowlists and time delays.
Summary
Crypto scams now account for more reported fraud losses than any other category tracked by the FBI, according to the source article, which attributes this to the structural features of blockchain transfers: they settle in minutes, cannot be charged back, and depend entirely on control of a private key or account. The article cites The Block's summary of the 2025 IC3 report, which put cryptocurrency-related losses at about $11.4 billion out of $20.9 billion in total reported losses. Crypto investment fraud alone accounted for $7.2 billion across 61,559 complaints, and people aged 60 and over reported $4.4 billion in crypto losses. Chainalysis, as reported by Infosecurity Magazine, estimated at least $14 billion was taken in by scams on-chain in 2025.
The article identifies seed phrase phishing as the most damaging attack pattern, since a recovery phrase lets anyone rebuild the wallet on any device. It describes phishing pages that replicate wallet onboarding flows and malicious search ads that push wallet drainers. An illustrative attack chain shows a victim clicking a sponsored result, being prompted to re-enter a recovery phrase under a fake "wallet sync error," and funds being swept and bridged across chains within minutes.
SIM swapping, mapped to MITRE ATT&CK T1451, is presented as a route to compromising SMS-dependent accounts. The article references an 18-year-old charged with stealing over $50 million in cryptocurrency through SIM swapping. Recommended defenses include carrier account PINs, removing phone numbers as recovery options once a security key is enrolled, and migrating high-value accounts off SMS entirely.
For hardware wallets, the article stresses that the device protects keys from malware but does not prevent users from approving malicious transactions. Recommended practices include buying directly from manufacturers, verifying addresses on the device display, using a BIP-39 passphrase, backing up phrases offline, and reviewing token approvals periodically. For exchange balances, it advises keeping only actively traded funds on platforms and enabling hardware keys, withdrawal allowlists, and API key restrictions.
If funds have already been sent, the article advises stopping payments, moving remaining assets to a new wallet, securing linked accounts, collecting evidence, and reporting to ic3.gov in the US or the national cybercrime service elsewhere. It warns that unsolicited recovery services charging upfront fees are a common follow-on scam.
The article identifies seed phrase phishing as the most damaging attack pattern, since a recovery phrase lets anyone rebuild the wallet on any device. It describes phishing pages that replicate wallet onboarding flows and malicious search ads that push wallet drainers. An illustrative attack chain shows a victim clicking a sponsored result, being prompted to re-enter a recovery phrase under a fake "wallet sync error," and funds being swept and bridged across chains within minutes.
SIM swapping, mapped to MITRE ATT&CK T1451, is presented as a route to compromising SMS-dependent accounts. The article references an 18-year-old charged with stealing over $50 million in cryptocurrency through SIM swapping. Recommended defenses include carrier account PINs, removing phone numbers as recovery options once a security key is enrolled, and migrating high-value accounts off SMS entirely.
For hardware wallets, the article stresses that the device protects keys from malware but does not prevent users from approving malicious transactions. Recommended practices include buying directly from manufacturers, verifying addresses on the device display, using a BIP-39 passphrase, backing up phrases offline, and reviewing token approvals periodically. For exchange balances, it advises keeping only actively traded funds on platforms and enabling hardware keys, withdrawal allowlists, and API key restrictions.
If funds have already been sent, the article advises stopping payments, moving remaining assets to a new wallet, securing linked accounts, collecting evidence, and reporting to ic3.gov in the US or the national cybercrime service elsewhere. It warns that unsolicited recovery services charging upfront fees are a common follow-on scam.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.