This almost got us: the phishing tricks behind 2025–2026’s biggest crypto heists

On 13 October 2026, at 11:14 AM, an email landed in our inbox. “VYBE Device Alert: New login from Xiaomi Mi 10 Android 10.0 we dont recognize.” A red Delete Device button sat right under it. For a second, it worked. My first thought was someone’s in my account, not who sent this?

That second is exactly what attackers buy. It’s the same second behind the biggest crypto thefts of the last two years, and it’s showing up every day in Filipino inboxes, SMS threads and Telegram groups.

What happened in the big crypto heists

“Cold wallet” sounds unhackable. The keys sit offline, and every transfer needs several people to sign. But in the largest heists, attackers didn’t break the cryptography. They went after the people and the screens those people trusted.

Bybit, February 2025: about $1.5 billion

• On or about 21 February 2025, about $1.5 billion in virtual assets was stolen from the Bybit exchange. The FBI publicly attributed it to North Korea, activity it tracks as “TraderTraitor” (FBI PSA I-022625-PSA).
• It started weeks earlier, on 4 February, when a Safe{Wallet} developer’s Mac was compromised. Forensics point to a Docker project in the Downloads folder, “a possible indication of social engineering.” The attackers then used a hijacked AWS session token to get around MFA (Sygnia; heise).
• On 17 February they planted malicious code in Safe’s web interface. During a routine cold-to-warm transfer, the signers saw a correct-looking screen while a different transaction went to their Ledger devices for signing. Bybit’s CEO said he didn’t verify the transaction data on the Ledger screen before signing (CertiK).

Upbit, November 2025: about $30 million

South Korean officials accused North Korea of stealing about $30 million in crypto from the Upbit exchange (The Record).

Bitget, September 2026: about $387.5 million

• On 24 September 2026, about $387.5 million was moved out of Bitget’s hot and warm wallets. Bitget says cold wallets and private keys were not affected (The Block).
• Bitget’s investigation says the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then sent fraudulent withdrawal commands (Bitget postmortem summary).
• Attribution: suspected, not confirmed. Bitget’s CEO called North Korean involvement “very likely.” TRM Labs says it has not yet definitively attributed it (TRM Labs), and Elliptic calls it “highly likely” linked to the DPRK based on laundering overlaps (Elliptic).

CryptoBilis (Ledger reseller), October 2026: about $86–93 million

This is the newest one, and it’s close to home. CryptoBilis sells Ledger hardware wallets in Indonesia, Malaysia and the Philippines.

• On 9 October 2026, buyers who got their Ledger from CryptoBilis found their wallets emptied. Ledger asked the reseller to pause all sales and shipments, and said its own systems and direct sales were not affected (The Block).
• On 10 October, Ledger said one affected user’s device contained an unauthorized hardware implant. On 11 October it said every confirmed case so far involves devices sold through CryptoBilis (CoinDesk).
• Losses are estimates, not official. On-chain researchers put them above $86 million. Bitquery counts $92.9 million from 311 wallets on five chains, and says Tether froze about $10 million (Bitquery). Ledger has not confirmed a total.
• How: supply-chain tampering is confirmed in one device. The full picture is still contested. Some researchers point to phishing, fake ads and fake apps instead (OAK case file). Attribution: unattributed. No one has publicly named a culprit.
• If you bought from CryptoBilis in the last 90 days: don’t set up an unused device. If you already set it up, move your funds to a new Ledger bought directly from Ledger, with a new seed phrase. That’s Ledger’s own advice.

The lesson: a wallet is only as safe as where it came from. Buy from the maker, and check the box hasn’t been tampered with.

The scale

Chainalysis counted over $3.4 billion in crypto stolen in 2025, with North Korea responsible for at least $2.02 billion of it. Personal wallet compromises reached 158,000 incidents and $713 million (Chainalysis). Fewer dollars per victim, but many more victims: attackers are going wide.

The common thread: people, not passwords

Look past the billion-dollar headlines and the playbook is familiar:

• Trick a person into running something. Bybit began with a developer’s laptop.
• Fake the screen people trust. The signers trusted the web page, not the device.
• Impersonate a brand you already use. In April 2025, Ledger confirmed that physical letters with Ledger branding were asking owners to scan a QR code and enter their 24-word recovery phrase (The Block; Ledger Support). Ledger also warns about fake versions of its wallet app that end in a request for your 24 words (Ledger).
• Even the real sender can be fake. On 9 September 2026, Trezor said its third-party email provider was breached and that a “Critical Security Alert: STM32 Entropy Vulnerability” email was phishing, even though it came through Trezor’s own mailing system (The Crypto Times). Unattributed.
• Poison the copy-paste. In December 2025, one user lost about $50 million in USDT after copying a look-alike address from their transaction history (Beosin 2025 report). Unattributed.
• Drainers. Wallet-drainer “signature phishing” took $83.85 million from 106,106 victims in 2025, down 83% from 2024 but still active (Scam Sniffer).

This isn’t just crypto. Verizon’s 2025 DBIR found that about 6 in 10 breaches involve a person.

The one that landed in our inbox

Here’s the VYBE email, recreated with the recipient details removed. Count the red flags before you read them.

1. The sender domain doesn’t match. The display name says “VYBE”, but the address is a random string at esteban-frederic.fr, a French domain with nothing to do with the brand.
2. Urgency and fear. A stranger’s phone “logged in.” You’re supposed to act before you think.
3. Generic greeting. “Hello Greetings from VYBE.” No name, odd grammar.
4. The button is the trap. “Delete Device” most likely leads to a fake login page. If you use the service, open the app yourself and check your devices there.

The right move: don’t click, report it as phishing in your mail app, and delete it.

The Philippine phishing scene, right now

Crypto is just one lure. Here’s what Filipinos are getting every week.

• The CICC logged 18,633 cybercrime complaints in 2025. Consumer fraud led with 35%, and losses from consumer fraud, online fraud, hacking and phishing reached ₱418.187 million. Report scams to Hotline 1326 (GMA News).
• In 2024, GCash was the e-wallet most used by fraud victims, with ₱76.49 million lost; Maya losses were ₱13.99 million (NewsBytes.PH).
• In February 2026, the SEC flagged Riscoin, recruited through Facebook and Telegram, as an unregistered “crypto copy trading” scheme promising 1–4% daily returns (BitPinas; Inquirer).
• Crypto awareness among Filipino adults rose to 20% in the BSP’s 2025 Consumer Finance and Inclusion Survey, up from 6% in 2021 (BSP CFIS 2025). More people who’ve heard of crypto means more targets for “investment” pitches.

Red flags, whatever the lure

• The sender’s real address or number doesn’t match the brand.
• A deadline: “12 hours”, “today”, “or your account will be locked”.
• A request for your OTP, MPIN, password or recovery phrase. Legit companies never ask.
• A link or QR code where an app would normally do the job.
• A small fee to unlock something bigger (parcel, refund, job, “withdrawal”).
• Guaranteed or daily returns.

Checklist for crypto holders

• Never type your seed phrase into any website, app, form or chat. Ledger and Trezor both warn never to enter it anywhere.
• Verify on the device screen. Check the address and amount on the hardware wallet itself before you approve.
• Don’t copy addresses from your history. Use saved contacts and check the whole address, not just the first and last characters.
• Get wallet apps only from the maker’s official site.
• Treat unexpected “security alerts” as hostile, even from the real domain.
• Check the SEC’s advisories before joining any “investment” group.

Checklist for SMEs

• Turn on MFA for email, banking, e-wallets and admin accounts. Prefer app or passkey approval over SMS codes.
• Set a call-back rule for payment changes and fund transfers: verify on a known number, never via the email or chat that asked.
• Run a 10-minute phishing briefing each quarter, using real samples like the ones above.
• Use endpoint protection with EDR on every laptop, especially those of finance staff and admins. Bybit started on one laptop.
• Know your exposure. Find weak spots like exposed logins, leaked credentials and unpatched systems before attackers do.
• Keep a one-page incident plan: who to call, how to lock accounts, and when the 72-hour NPC breach notice clock starts.

How ARA Industries helps

ARA Industries deploys and supports WithSecure Elements for Philippine businesses:

• Endpoint Protection (EPP) and EDR: stops malicious downloads and spots suspicious activity on laptops and servers, like a developer machine quietly talking to an attacker.
• Exposure Management: shows you what attackers can see, from risky configurations to exposed accounts, so you fix the likeliest way in first.
• Managed support: our team watches the alerts, helps you respond, and keeps your staff trained, so you don’t need a full security team in-house.

Partner Featured: WithSecure. ARA Industries is a registered WithSecure partner.

Got a suspicious email, text or “crypto opportunity”? Don’t click. Report it to the CICC at Hotline 1326, and send it to us if you want a second look.