A group of young scammers stole more than $240 million in bitcoin by calling a wealthy crypto investor and impersonating trusted companies. The callers claimed the victim’s accounts and wallet were under attack, then tricked him into granting access and sharing security codes that enabled the theft. The case highlights how convincing phone-based “account security” stories can bypass technical safeguards when people are pressured to act fast.
The scheme began with a phone call. A man was contacted at home by someone claiming to be a Google representative, warning him of attempts to breach his account. Shortly after, a second caller claimed to be from the Gemini crypto exchange and warned of a malware attack affecting his crypto wallet. This two-call structure built layered credibility, with each impersonated organization reinforcing the other's urgent warning.
Under this pressure, the victim was manipulated into granting access to his Google Drive and revealing security codes. Those codes and that access allowed the attackers to siphon off more than 4,100 bitcoin, valued at over $240 million. The stolen funds were then laundered through multiple exchanges and converted to cash.
The attack combined several classic social engineering elements:
This reflects techniques like phishing for information (T1598) and using victim contact information to build trust and pressure (T1656).
Organizations and individuals, particularly executives, finance and treasury staff, and anyone holding cryptocurrency, should treat unsolicited account security calls with skepticism. Rather than acting on the caller's instructions, hang up and independently contact the company through an official number found on its website or app. No legitimate support representative should ever ask for a one-time passcode or security code over the phone, and requests to grant access to files or drives during an unsolicited call should be treated as a red flag rather than a routine security step. High-net-worth individuals and known crypto holders should be aware they can be specifically targeted with tailored, multi-person impersonation schemes designed to feel credible and urgent.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Scammers called the victim posing as a Google representative and later a Gemini crypto exchange employee, warning of a breach and malware, then convinced him to grant access to his Google Drive and share security codes that enabled the theft of over 4,100 bitcoin.
Prosecutors said the group targeted the man because he was a wealthy, longtime crypto investor, making him a high-value target for a tailored impersonation scheme.
Hang up and contact the company directly using an official number from its website or app, and never share security codes or one-time passcodes with a caller.
No, prosecutors describe it as part of a broader pattern, with the group linked to other multimillion-dollar thefts using a similar playbook since late 2023.
A crypto investor lost over two hundred forty million dollars… from a phone call that sounded like Google and Gemini support. First call: someone says, 'I’m from Google, we see attempts to breach your account.' Then a second caller claims to be Gemini, warning of malware in your crypto wallet and asking for Google Drive access and security codes. Here’s the trick: they sound helpful, talk about protecting your account, but they’re really after one thing, your one-time codes and file access. That’s how they drained over four thousand one hundred bitcoin. Your move: if anyone calls about an urgent Google, Gemini, or account breach, hang up and call back using the official number from the website or app, never read them security codes.
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
The article describes real-world social engineering aimed at both consumers and financial firms, including phone-based attacks on hedge funds and a turnkey scam kit that impersonates Tesla to steal cryptocurrency. The kit uses a professional-looking fake presale website with urgency tactics…
Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast)…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
U.S. prosecutors say a group led by Malone Lam ran social engineering scams that stole over $245 million in cryptocurrency. The scammers allegedly called crypto holders while pretending to be customer support from Apple or Google, talked victims into handing over key account details, and in at…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
