Phishing / Social Engineering attacks on Bitcoin

Attackers compromised BigONE's backend and rewrote risk-control logic to auto-approve any withdrawal, draining $27M from the hot wallet without exposing keys.

DPRK operatives compromised a developer at wallet vendor Ginco via a fake LinkedIn job offer, draining 4,502.9 BTC ($305M) from Japanese exchange DMM Bitcoin.

A breach of LastPass encrypted vault backups led to a multi-year drain of victims storing seed phrases there; losses grew from $35M to over $400M.

2FA-bypass exploit drained $34M from 483 Crypto.com accounts; attackers authorised transactions without the second factor ever prompting the user.