Massive Phishing Campaign Targets 885,000 Phone Numbers to Empty Cryptocurrency Wallets

Cybersecurity firm Rapid7 discovered a large-scale phishing campaign targeting 885,000 phone numbers designed to steal cryptocurrency funds. Attackers use SMS messages and voice calls to redirect users to fake wallet pages, then trick victims into revealing their recovery phrases and credentials.

How the Scam Works

This campaign combines two social engineering techniques: phishing (fake messages and websites impersonating legitimate services) and vishing (voice-based phishing using phone calls). Attackers send SMS messages and make calls pretending to be from real wallet providers, directing victims to cloned websites that look nearly identical to the genuine ones.

The ultimate goal is to steal the recovery phrase—a 12 to 24-word sequence that controls a cryptocurrency wallet. Anyone who possesses this phrase can access all funds in the wallet from any device, locking out the legitimate owner.

Industrial-Scale Operation

The sheer number of 885,000 phone numbers targeted reveals a calculated strategy. The attackers don't need to fool everyone; if even a small percentage of victims fall for the scheme, the financial gain is substantial. This is not a targeted attack but a mass-scale operation playing the odds.

Unlike traditional fraud, cryptocurrency theft is nearly irreversible. Once funds leave a wallet on the blockchain, recovery is almost impossible and tracing perpetrators is extremely difficult.

Why It's Effective

Fraud pages are meticulously designed to replicate legitimate services, and messages are deliberately crafted to create urgency. Warnings of "unauthorized access detected," threats of account lockdown, or promises of rewards pressure victims to act quickly without verifying the website's authenticity. This time pressure is intentional.

As cryptocurrency adoption grows, the pool of potential victims expands. Newcomers in particular lack the technical knowledge to recognize threats, making them easy targets.

Protection Strategies

Never share recovery phrases or private keys — Legitimate wallet providers will never request this information via message, email, or phone.

Be suspicious of urgent messages — Warnings about account closure or threats are classic fraud tactics designed to bypass critical thinking.

Type URLs manually instead of clicking links — Copy the website address directly into your browser rather than following links in messages.

Verify the domain name carefully — Fake sites closely mimic real ones but often contain subtle spelling variations in the URL.

Enable two-factor authentication — Add an extra security layer whenever the service offers this option.

Use hardware wallets for significant amounts — Hardware wallets store private keys offline, providing superior security for large holdings.

Conclusion

In the cryptocurrency world, user behavior is more often the deciding factor in security breaches than technical vulnerabilities. Understanding the fundamental rule—that legitimate providers never request recovery phrases—is your strongest defense against these increasingly sophisticated frauds.