How crypto criminals stole $713 million

There’s one thing uniquely agonising about having your cryptocurrency stolen. All transactions are recorded on a digital ledger, often known as a blockchain, so even when somebody takes your cash and places it in their very own crypto pockets, it’s nonetheless seen on-line.

“You’ll be able to see your cash there on the general public blockchain, however there’s nothing you are able to do to get it again,” says Helen, who misplaced round $315,000 (£250,000) to thieves.

She likens it to watching a burglar pile up your prized possessions on the opposite facet of an impassable chasm.

For seven years Helen and her husband Richard (not his actual identify), each UK residents, had been shopping for and stacking up crypto cash known as Cardano.

They appreciated the concept of investing in a digital asset that had the potential to rise dramatically in worth, in contrast to funds saved in additional standard methods. They knew it was riskier, however they have been cautious to maintain their digital keys secure.

However by some means hackers acquired into their cloud storage account, the place they saved details about their crypto wallets and how one can entry them.

In February 2024, after a small take a look at switch, the criminals despatched all of the couple’s cash to their very own digital wallets in a swift and silent assault.

The couple then watched for months as their cash was moved from one pockets to a different, powerless to do something. (The inherent contradiction with crypto forex is that each one transactions are publicly trackable however customers may be publicly untraceable in the event that they select.)

Helen and Richard will not be rich. She is a private assistant, he’s a composer, and so they had excessive hopes for his or her Cardano investments.

“We would been shopping for these cash for therefore lengthy… We used each scrap of cash we might discover to purchase extra,” says Richard. “Except for my dad and mom’ deaths, this theft is the worst factor to occur to me.”

Ever since, Helen has been on a mission to get better their cash. She obtained detailed studies from varied police forces and the Cardano builders. Now, regardless that she has the pockets deal with of the criminals, there may be nothing anybody can do to unmask them.

Their plan is to avoid wasting up sufficient to have interaction personal investigators to attempt to hint the hackers.

“It leaves you with a sense of helplessness,” she says, “however I’m going to maintain making an attempt.”

A survey carried out for the Monetary Conduct Authority (FCA) in August 2024, instructed that roughly 12% of British adults owned crypto-assets – equal to about seven million individuals.

Globally, it has been estimated that 560 million individuals at the moment are crypto homeowners. However as possession rose, so did theft. The pandemic ushered in a surge within the worth of crypto cash and with it an explosion in assaults on the business.

And 2025 was one other bumper yr for crypto criminals, with whole thefts standing at greater than $3.4bn (£2.5bn), in line with investigators at blockchain evaluation agency Chainalysis. The annual determine has remained in the identical ballpark since 2020.

Many of the cash is being stolen in huge cyber assaults on crypto firms. For instance, North Korean hackers swiped $1.5bn (£1.1bn) from crypto alternate Bybit in February 2025.

The losses on this case and the overwhelming majority of others are coated by the deep-pocketed crypto corporations, with little influence on people. However 2025 additionally noticed a rise within the variety of assaults on particular person crypto buyers.

Chainalysis analysis says these particular person assaults rose from 40,000 in 2022 to 80,000 final yr.

Hacking, scamming or coercing of people accounted for an estimated 20% of all crypto worth stolen – estimated at $713m (£532m).

However the firm provides that the quantity could possibly be far larger as not all victims will select to report thefts publicly. When this occurs, you can be left by yourself.

Many thefts or scams in conventional finance are coated by banks or card firms. Within the UK you possibly can complain to the monetary ombudsman service and could also be compensated by the monetary providers compensation scheme.

“Crypto stays largely unregulated within the UK and high-risk,” says the FCA. “If one thing goes flawed, it’s unlikely you can be protected so you ought to be ready to lose all of your cash.”

A stark reminder of this comes in case you search on-line for “Binance account hacked” – Binance is the world’s largest crypto alternate with a reported 1.4m UK customers – however the web page on its web site providing recommendation to victims of theft is blocked within the UK.

The corporate has not been accepting new UK purchasers since 2023, as a result of it isn’t authorised to function by the FCA. But criminals do not care the place victims are, and persons are being focused everywhere in the world indiscriminately.

Chainalysis has described these assaults on people because the “under-documented frontier for crypto crime”.

They put the amount of crimes all the way down to the numbers of individuals getting into the crypto world as buyers as the worth of cash has risen and argue that improved safety practices at main providers might have pushed “attackers towards people perceived as simpler targets”.

Then there may be the truth that the extra crypto you maintain and the extra public you’re about it, the extra doubtless you’re to be focused – small time holders, (or hodlers, because the neighborhood calls them) are far much less more likely to be affected.

As for the thieves, they could possibly be wherever.

In October blockchain researchers from Elliptic, a crypto evaluation firm, warned that North Korean state-sponsored hackers are more and more concentrating on rich cryptocurrency homeowners. There are many younger scammers and hackers from different international locations too.

In December within the US, 22-year-old Evan Tangeman pleaded responsible to being a part of a bunch of crypto thieves calling themselves the Social Engineering Enterprise, who’re accused of stealing greater than $260m (£194m) between October 2023 and Could 2025.

Prosecutors allege they focused the crypto-rich utilizing hacked databases, tricking victims into pondering they have been cryptocurrency exchanges, and persuading them to switch cash.

Members of the gang, who have been all younger males largely within the US, are mentioned to have spent the stolen cash on personal jets, costly vehicles and luxurious purses that they’d give away at nightclubs.

In some instances, prosecutors say, the gang organised house break-ins to steal {hardware} containing the keys to crypto stashes.

Burglaries and muggings have develop into so frequent there may be now a time period for them within the crypto neighborhood – “wrench assaults” – so known as as a result of criminals have been recognized to threaten victims with spanners.

Final April, crypto criminals in Spain tried to drive a person and lady to half with their cryptocurrency.

Spanish police mentioned the person was shot within the leg and he, alongside along with his accomplice, have been held captive for a number of hours whereas the criminals tried to entry their crypto wallets. Finally the lady was launched however her accomplice remained lacking, along with his physique later present in woodland.

5 individuals have been arrested in Spain in reference to the case whereas 4 others in Denmark have been charged.

There have been a number of related instances in France together with one when an tried kidnap was captured on video.

One other case in early 2025 noticed David Balland, co-founder of Ledger, a cryptocurrency safety firm, kidnapped along with his spouse from their house in central France.

Days later police rescued them – however Balland’s finger was lower off throughout the extortion try.

Then, final month, UK police arrested six individuals after masked males stopped a automobile travelling between Oxford and London and compelled one of many occupants to switch cryptocurrency valued at £1.5m.

Phil Ariss, director of UK Public Sector Relations at blockchain intelligence agency TRM Labs, has beforehand mentioned that legal teams already snug with utilizing violence to attain their objectives have been all the time more likely to migrate to crypto.

“So long as there is a viable path to launder or liquidate stolen belongings, it makes little distinction to the offender whether or not the goal is a high-value watch or a crypto pockets.

“Cryptocurrency is now firmly within the mainstream, and consequently, our conventional understanding of bodily menace and theft must evolve accordingly.”

It is troublesome to find out precisely how prevalent “wrench assaults” are as few are publicly reported. However it seems as if a lot of these thefts are a small a part of the rising concern of non-public crypto thefts.

And lots of criminals depend on tried and trusted hacking or rip-off strategies which are turning into simpler due to the abundance of information stolen in huge cyber assaults on firms.

“Knowledge is a typical downside as Bitcoin millionaires have gotten so frequent, and there are stolen databases which are enriching the goal checklist on a regular basis,” says Matthew Jones, founding father of Haven, a crypto safety agency.

A knowledge breach at Kering, the father or mother firm of luxurious manufacturers together with Gucci and Balenciaga, is a working example, in line with one hacker interviewed by the BBC.

In addition to thousands and thousands of buyer names and get in touch with particulars, the databases present how a lot cash individuals had spent on the shops.

The hacker the BBC spoke to says he bought the spreadsheets for $300,000 (£224,000) with a view to goal the largest spenders.

He claims to have used the data together with particulars from one other stolen database to rip-off a number of Coinbase customers out of a minimum of $1.5m (£1.1m) in crypto.

The legal offered affirmation that he was in possession of the stolen knowledge and proved to the BBC that he owned $700,000 (£522,000) in Bitcoin, which he says got here from one sufferer.

“I purchase hacked databases and cross-reference them with others to verify for wealthy individuals and for up-to-date cellphone numbers and emails. I am nonetheless taking place the checklist and tripled my cash very quick,” he claimed.

The hacker would not give any particulars about himself aside from the truth that he’s a pupil at a US college.

When requested if he thought of himself a hacker or a scammer he mentioned, “Neither, I’m solely concerned about creating wealth.”

Kering didn’t reply to a request for remark about this however has beforehand advised the BBC that its IT techniques had been secured after the info breach and emphasised that no checking account numbers, bank card info, or government-issued identification numbers had been stolen within the assault.

Matthew Jones from Haven tells me that he himself has had crypto stolen and the expertise prompted him to develop a crypto pockets with additional safety features.

Options like steady biometric checking to make it possible for solely the proprietor can ship cash, and geofencing to dam any transactions outdoors somebody’s house or work, at the moment are wanted he says. He’s additionally constructing a panic button into the digital pockets.

“Persons are strolling round with thousands and thousands of {dollars} in crypto as of late and wallets don’t have any ceiling on how a lot may be held – or how a lot may be stolen in a single go,” he says.

Matthew Jones’s crypto pockets is all about what the business champions as “self custody”.

Haven’s app is just like these of Metamask and Trustwallet. Different firms like Trezor and Ledger supply bodily gadgets like USB reminiscence sticks however the thought is identical: you may be your personal financial institution.

However with that added freedom comes added danger as you have no protections in any respect.

In case your cash are stolen from your personal self custody pockets, you possibly can’t even go to a crypto alternate to complain.

Requested if the liberty of “being your personal financial institution” outweighs the rising dangers, Jones insists it does.

“Banks aren’t really answerable to their prospects and so they maintain the facility to freeze or shut your account primarily based on broad, typically imprecise causes,” he argues.

He additionally says he objected to being requested by conventional monetary establishments issues like why he was shifting cash out of an account.

Helen and Richard misplaced all their cash after selecting to be their very own financial institution. The issue that made it significantly painful was the truth that a lot of the cash got here from the sale of Richard’s mom’s home, after her demise.

“My mom’s cash has gone,” Richard says. “All that grafting she had performed for my future and it was stolen. We have needed to promote musical devices and our automobile, and we have been briefly homeless.”

But they don’t seem to be totally giving up on cryptocurrency. In the event that they get their misplaced a reimbursement, or accumulate sufficient in financial savings, they plan to get straight again into crypto investing.

Prime picture credit score: Getty Photographs

BBC InDepth is the house on the web site and app for the most effective evaluation, with recent views that problem assumptions and deep reporting on the largest problems with the day. Emma Barnett and John Simpson carry their decide of essentially the most thought-provoking deep reads and evaluation, each Saturday. Sign up for the newsletter here