A Single Phone Call Wipes Out $243 Million

I want to walk you through one of the most brutal crypto thefts I have seen. A whale lost $243 million, and the attack did not rely on a hacked exchange or a compromised private key. It started with a small phone call.

The caller claimed to be from Google customer service. Within about 15 minutes, the victim watched his screen balance drop to zero. He could not move the mouse because the attacker had framed the whole thing as a security check with the Google team.

Many people laugh at this point and say, "What a fool, I would never fall for that." I invite you to be less cocky. When the person on the line knows your full name, your home address, and the amount sitting in your account, your defenses crumble faster than you think.

Why Hackers Now Target Humans Instead of Code

ZachXBT, the onchain analyst known for his onchain intelligence work, calls this a shift from code exploits to human exploits. Hackers have realized that breaking a person is often cheaper and faster than breaking a protocol.

In this case, the attackers started with a very specific data set: the Genesis bankruptcy creditor list. That data leaked on the dark web and included real names, phone numbers, and claim amounts. The victim was a Genesis creditor. The hackers knew exactly how much money he had.

They did not pretend to be Binance or Coinbase support. They posed as Google support. That choice was sneaky because crypto users are already wary of exchange calls, but most of us do not apply the same suspicion to Google. Google feels like the foundation of our digital life, so when someone says your account is about to be locked, the instinct is to fix it fast.

The Attack Path: From Data Leak to Remote Control

The attack unfolded in three clear steps.

  • First, they gathered intelligence. They combined the Genesis creditor list with other data to link the victim's onchain identity to his real world identity.
  • Second, they built trust by posing as Google support, a brand most people do not associate with crypto risk.
  • Third, they triggered panic and pushed the victim to install AnyDesk, a remote desktop software.

Industrialized Harvesting: Scam as a Service

The people behind these attacks are not isolated thieves. They belong to a highly organized crime group. They even sell their scam tools as SaaS services. That means the same kind of software and scripts used in the $243 million heist are being packaged and sold to other criminals.

This industrialization makes the threat worse. You are no longer facing one clever hacker. You are facing a business that optimizes its attack funnel, iterates on scripts, and scales across many victims at once.

The $5 Wrench Attack and Physical Threats

If the phone call scam was outsmarting the victim, the next threat is straightforward strong armed robbery. You may have heard of the $5 wrench attack. Hackers have crunched the numbers: cracking a military grade encrypted cold wallet costs a fortune, but a wrench from the hardware store costs just $5. They can tie you up, beat you, and force out the password. Low cost, high success rate.

This is not hypothetical. In early 2025, the co founder of Ledger, the cold wallet company, was kidnapped in France and had a finger cut off for ransom. Ripple co founder Chris Larsen had over $100 million stolen from his personal wallet.

How do hackers know where these people live? Data breaches, again and again. If you bought a Ledger wallet with your email, that database leaked, including your shipping address. If you show off your Bored Ape on Twitter, hackers can piece together your onchain whale address, your home address, and your social media flexing. In their eyes, you are a fat sheep ready for slaughter. They even use open source intelligence to map out how many cameras are at your front door.

Every victim once believed they were the exception. Do not let that be you.

Three Survival Rules for the Human Targeted World

Traditional antivirus and opsec are useless against these human targeted attacks. To survive in this dark forest, I recommend edging three points into your bones.

  • Become a physically invisible gray man. Never ship hardware wallets to your home. Rent a PO Box or use a pickup point. Sever the physical link between your money and your home. Do not leave breadcrumbs for robbers.
  • Set a secret code with your family. AI can clone voices perfectly now. If you get a call from a family member crying for help and asking you to unlock the multisig wallet, check the code first. No match, no matter how real it seems, it is an AI scam. Hang up.
  • Big funds must use multisig. With a knife to your throat, a single signature wallet puts you in a hand over cash or die trap. A multisig wallet lets you honestly say the keys are split in three places and you cannot get them now. That is an unchangeable physical fact. It breaks the robber's plan and could save your life because you really cannot do anything.

Your Keys, Your Life

Web3 freedom has a price. Your keys, your life. Do not let a fake support call start a nightmare. Prepare for what may happen one day.

The $243 million heist was the result of a patient social engineering operation that exploited one person's panic. The best defense is to reduce what attackers can know about you, verify every urgent request, and structure your holdings so that you cannot be forced to hand over everything.

Stay safe out there.