Scams

Blockchain security firm PeckShield reported around $76 million in crypto losses from hacks and exploits in December, a 60% drop from November's $194.2 million. The month included 26 major incidents, with one user losing $50 million to an address-poisoning scam and another losing $27.3 million due to a multisig private key leak.

On December 31, 2025, Trust Wallet said its Chrome extension was temporarily removed after a Chrome Web Store bug blocked a new release, slowing a verification tool for reimbursement claims. The company earlier confirmed a malicious v2.68 was distributed on December 25, identifying 2,520 drained addresses and roughly $8.5 million tied to 17 attacker wallets.

As 2026 began, BROCCOLI(714) on BNB Chain surged nearly 1200% before reversing sharply. The spike coincided with a suspected market‑maker compromise, driving trading volume up about 4800% to roughly $500 million. A trader reported around $1 million profit during the volatility, and Binance said it is investigating without confirming a direct hack.

On 1 January 2026, Binance detailed an attempted fraud in which a user allegedly forged chat logs and transfer records to pose as a scam victim and pressure the exchange's support team for compensation. Internal checks, including blockchain analysis, indicated the wallet tied to the supposed scammer was controlled by the complainant and that documents came from an escrow platform and were altered to fit the story. The case underscores how crypto scams are expanding from targeting users directly to attacking exchange trust systems, amid wider industry losses from phishing, address poisoning, and social engineering schemes.

This guide distills seven common red flags in DeFi scams and offers practical checks users can run before committing funds. It highlights unrealistic "guaranteed 1,000% APY" promises, missing audits, opaque tokenomics, centralized governance, FOMO-driven marketing, anonymous teams, and fake or broken dApps. The focus is risk awareness, not investment advice.

South Korean prosecutors said on December 30 that 13 members of a Poipet, Cambodia-based organization were charged over a SpaceX-themed romance scam. The group allegedly took 1.93 billion won (about $1.3 million) between December 2024 and October 2025 using a counterfeit app, with 11 arrested and two indicted without detention.

A recently divorced Bitcoin holder lost his entire retirement savings, totaling one full BTC, after an online romance scheme used AI-generated identities and real-time deepfakes to build trust. The case shows how emotional manipulation combined with irreversible crypto transfers can defeat traditional fraud checks and overwhelm personal defenses.

On Tuesday, SlowMist released its 2025 Blockchain Security & AML Annual Report, estimating roughly $2.935 billion stolen in 2025, up 46% from 2024, even as incidents fell 51% to 200. DeFi logged 126 cases and about $649 million in losses, while CEX breaches (22) totaled $1.809 billion. The firm also noted 18 recovery or freeze events, with nearly $387 million secured from $1.95 billion in stolen funds.

Unleash Protocol suffered a governance-level exploit that allowed an attacker to deploy an unauthorised contract upgrade and withdraw about $3.9 million in user assets. The incident, identified by PeckShieldAlert and later confirmed by the team, affected tokens including WIP, USDC, WETH, stIP, and vIP, with 1,337.1 ETH ultimately funneled into Tornado Cash via Ethereum bridges. Platform operations have been paused while external security specialists investigate how the multi-signature admin controls were bypassed.

In 2025, blockchain investigator ZachXBT identified a Canadian actor known as Haby/Havard who allegedly impersonated Coinbase support and siphoned more than $2 million in crypto via social‑engineering phone calls. He tied on‑chain activity to social media posts, including a Dec. 30, 2024 XRP theft and a Feb. 2025 Bitcoin wallet screenshot showing $237,000, linking multiple victim cases.