On April 28, 2025, the cryptocurrency world witnessed one of its most devastating thefts — not through a smart contract exploit or an exchange hack, but through something far more insidious: social engineering. An elderly American investor lost 3,520 Bitcoin, valued at $330.7 million, after being manipulated into sharing wallet credentials by scammers who posed as trusted authorities. If you hold cryptocurrency, this incident contains lessons you cannot afford to ignore.
The Basics
Social engineering is a technique where attackers manipulate people into revealing confidential information or performing actions that compromise their security. Unlike hacking, which exploits software vulnerabilities, social engineering exploits human psychology — trust, fear, urgency, and the desire to be helpful. In the crypto context, this typically means scammers impersonating exchange support, wallet providers, or even law enforcement to convince victims to share seed phrases, private keys, or wallet access.
The April 28 attack followed a textbook pattern. The victim, who had held over 3,000 BTC since 2017 with virtually no transaction history, was targeted by attackers who had clearly researched their on-chain profile. Over multiple interactions, the scammers built credibility before persuading the victim to share sensitive credentials during a phone call.
Why It Matters
This was not a naive beginner making an obvious mistake. The victim had successfully held Bitcoin through multiple market cycles, regulatory crackdowns, and exchange collapses over nearly eight years. Their technical competence in maintaining a large BTC position was not in question. What failed was their psychological defenses against a sophisticated, patient, and well-researched social engineering campaign.
The attackers laundered the stolen Bitcoin through a pre-built network of exchange accounts, converting much of it to Monero — a privacy coin that makes transaction tracing nearly impossible. They bridged some BTC to Ethereum and deposited it into DeFi protocols. Investigators recovered only about $7 million of the $330.7 million. With Bitcoin trading at approximately $94,978 and Ethereum at $1,798 on April 28 according to CoinMarketCap, the total losses represent life-changing wealth that is unlikely to be recovered.
Getting Started Guide
Protecting yourself from social engineering starts with a simple rule: never share your seed phrase, private keys, or wallet passwords with anyone, for any reason. No legitimate service will ever ask for these. If someone claims to be from your wallet provider, exchange, or a government agency and requests this information, it is a scam — end the conversation immediately.
Here are practical steps every crypto holder should take today:
First, separate your holdings. Use a hardware wallet for long-term storage and a separate software wallet for daily transactions. Never connect your hardware wallet to DeFi protocols or unfamiliar websites.
Second, add a passphrase. Most hardware wallets support an optional passphrase (sometimes called the 25th word). Even if someone obtains your seed phrase, they cannot access your funds without the passphrase. Choose something memorable but not guessable.
Third, verify independently. If you receive any communication about your crypto accounts — email, phone call, text message — do not respond through the provided channels. Instead, navigate directly to the service’s website or app and check for alerts there.
Fourth, limit your exposure. Avoid discussing your crypto holdings publicly, including on social media. The April 28 victim’s on-chain history made them an identifiable target.
Common Pitfalls
Many crypto holders make the mistake of thinking their security is adequate because they use a hardware wallet or two-factor authentication. The April 28 attack bypassed all of these measures because the victim voluntarily shared their credentials. Social engineering attacks are designed to create a sense of urgency or authority that overrides your normal caution.
Another common mistake is assuming that older or less tech-savvy family members who hold crypto are safe because they do not engage with DeFi or complex protocols. In fact, they may be more vulnerable to phone-based social engineering because they are more likely to trust callers who claim to represent institutions.
Next Steps
Take 15 minutes today to audit your own security. Check whether your seed phrase is stored securely offline — not in a photo, not in a cloud document, not in a notes app. Verify that your exchange accounts use hardware security keys for two-factor authentication rather than SMS. Consider setting up a multi-signature wallet for holdings above a threshold you define. And most importantly, have a conversation with anyone in your life who holds cryptocurrency about the reality of social engineering attacks. The $330.7 million lost on April 28 could have been prevented by a single moment of skepticism.
Disclaimer: This article is for educational purposes only and does not constitute financial or security advice. Always conduct your own research and consult qualified professionals.
3520 BTC stolen through a phone call. no exploit, no flash loan, no bridge hack. just a human tricked into reading 24 words aloud. opsec dies last
Mass adoption is happening incrementally — people just don’t notice
The pace of innovation in crypto continues to surprise me
3520 BTC held since 2017 with zero transactions then one social engineering attack wipes everything. dormant whales are the softest targets in crypto
Every cycle the infrastructure gets more robust
the infrastructure didnt help here though. this was a person being tricked into sharing credentials. no smart contract or protocol could prevent that
3520 BTC held since 2017 with no transactions. scammers specifically target dormant whales because they often have weaker opsec
dormant whales are the easiest targets. no chain activity means whoever is watching knows the owner probably isnt tech savvy enough to spot the scam
coldcard_maxi a hardware wallet is useless when someone is socially engineered into reading their seed phrase over the phone. the failure is human not technical
Hassan T. exactly right. the hardware wallet is irrelevant when the victim voluntarily gives the seed phrase. you cant patch social engineering with better firmware
330M stolen and the victim probably didnt even know current market price. OG holders who never touch their wallets are sitting ducks for these attacks
Bear markets are for building — and builders are delivering
this has nothing to do with building. an elderly person got socially engineered out of 3,520 BTC they held since 2017. totally different conversation
tom is right. this was pure social engineering. hardware wallet would not have helped if the victim verbally gave up their seed phrase
a hardware wallet is useless when someone calls pretending to be from ledger support and the victim reads their seed phrase out loud
$330.7M stolen without touching a single line of code. every time we harden the tech the attackers just go after the person holding the keys
330M stolen without a single line of code being exploited. every time we harden wallets and multisigs the attackers just pivot to calling the holder directly. the human is always the weakest link
Kwame A. exactly. hardening the tech just shifts the attack surface to the human. social engineering will always find a way around code
3520 BTC held since 2017 with zero transactions. scammers specifically target dormant wallets because the owners often have outdated opsec and no recent chain activity to flag anomalies
opsec_rat_ dormant since 2017 with zero transactions is the exact profile scammers look for. these holders often have paper wallets stored in a desk drawer and no idea what a hardware wallet is
scammers targeting dormant wallets from 2017 is smart from their perspective. those holders often have paper wallets and outdated opsec. easy marks
dormant_whale_watch spot on about 2017 holders having outdated opsec. my uncle still has his BTC on a paper wallet in a filing cabinet. sent him this article immediately
3,520 BTC stolen through a phone call. no smart contract exploit, no bridge hack, no flash loan. just a human being tricked into reading 24 words out loud
Lev M. 3520 BTC lost to a phone call. this is why I tell everyone I know to split their stack across multiple wallets with different keyholders. one wallet one failure point
3520 BTC held since 2017 with basically no transaction history. that wallet was a sitting duck. any whale that inactive eventually shows up on some attacker radar
trustless_pls_ exactly. zero transactions means zero operational security practice. first time they need to move funds and they get socially engineered because they have no muscle memory for verifying whats real