Mars MarketThreat model
How crypto is stolen: four methods that account for most losses
Crypto theft rarely involves breaking cryptography. It involves persuading a person to sign something, connect something or copy something. Each of the four methods below is described from the victim's side, because that is where the warning has to land.
Scale
Reported losses from cyber-enabled crime reached approximately USD 21 bn in 2025, with cryptocurrency complaints among the most costly categories.4
Reported losses are a floor, not a total. Most victims of theft from this sector never file a report.
Method 01
Search interception: the clone that arrives before the original
The method described on the teardown page is also a theft method, and it is the one most readers will encounter first. A name with no legitimate open-web presence is harvested by pages that rank for it. Because the destination exists behind an anonymising network, the clone does not have to defeat a security control — it only has to be earlier in the results, and it will be.
From the victim's side the experience is unremarkable. The page loads quickly, looks professional, offers a clear next step, and the interface after the handoff resembles what the descriptions promised. Deposits confirm. Withdrawals do not. By the time the difference is visible, the balance is gone and there is no operator to complain to.
The reason this method works is that the reader never had a way to check the address in the first place. There is no certificate authority, no registrar listing, no official domain and no support line. The only verification available is a comparison against a source the reader does not have.
Method 02
Approval drainers: you do not send the money, you authorise it
This is the method that most surprises victims, because nothing appears to be transferred at the moment of the attack. A site invites you to connect a wallet and then asks you to approve a contract. The prompt is a standard wallet interaction, and users who have approved dozens of contracts treat it as routine.
What the approval does is grant a standing permission over a specific token in your wallet. It is not a payment and it does not move anything immediately, so no balance changes at the moment of consent. Later — sometimes minutes, sometimes months, and often in one transaction that clears everything the permission covers — the allowance is exercised and the balance leaves.
The defensive consequence is counter-intuitive: the dangerous moment is not the transfer, it is the signature. A prompt you do not fully understand is a prompt to refuse. Established wallets display the contract being approved, and the permission you are granting can usually be reviewed and revoked later from the wallet interface — a step worth taking periodically, since a stale approval from a site that has since been sold or re-registered is a permanent open door.
Recognition cue
Legitimate services ask for a specific payment at a moment you chose. Anything that asks for open-ended permission, before any price has been quoted, is asking for access rather than money.
Method 03
Address swapping: the destination you verified is not the destination that receives
Addresses are long, they are alphanumeric, and the human eye does not read them — it pattern-matches the first few and last few characters and accepts the rest. Attackers exploit exactly that gap. Malware on the device, or a compromised web interface, substitutes a lookalike destination at the moment of sending, keeping the opening and closing characters familiar enough that the swap survives a glance.
The same gap is exploited without malware, by generating addresses that begin and end with the same characters as the intended recipient. Someone who checks the first four and last four characters — which is most people, and which is often described as the correct procedure — will approve a transfer to a different wallet.
The countermeasures are mechanical rather than attentional, because attention does not scale to strings nobody can read. Compare the full address rather than its ends. Send a small test amount first and confirm receipt before sending the rest. Where the hardware device displays the destination, trust that display over the screen, since it is the one surface malware on the host cannot rewrite. And never let a clipboard be the source of truth for a destination you care about.
Method 04
Key capture: the recovery that does not exist
No legitimate party will ever ask for the words that restore your wallet. This is stated everywhere and it is still the most reliable earning method in the field, because the ask is always dressed as help rather than as an ask.
The recurring impersonations are consistent. A support agent who found you rather than the reverse. A "validation" or "synchronisation" page that claims to repair a wallet and requires the recovery phrase to do it. A wallet extension update, or a browser extension that looks like the one you already use. A giveaway, airdrop or migration that requires importing your keys to participate. A message from a person who is already inside one of your group chats and continues the conversation from where it left off.
Every one of these ends the same way: whoever receives the words controls the wallet permanently, and no platform, issuer or authority can reverse it. The recovery phrase is not a password to be produced on request. It is the wallet.
| Method | Moment of loss | Reversible? | Primary countermeasure |
|---|---|---|---|
| Search interception | On deposit | No | Never treat a search result as a destination |
| Approval drainer | Later, sometimes months later | No | Review and revoke approvals; refuse open-ended permissions |
| Address swapping | At send | No | Full-string comparison, test transactions, device display |
| Key capture | Immediately on disclosure | No | Never produce the phrase; verify contacts out of band |
The common row in the last column is the one worth remembering: in crypto there is no reversal step, so every method is defeated before the transaction or not at all.
Supply side
Why the volume keeps rising anyway
The technical barrier to running these campaigns has collapsed. Phishing infrastructure is sold as a service with published prices, including tiered development packages and low-cost updates, and one analysis of a single operation recorded thousands of deposits and more than USD 1.5 m in cryptocurrency collected over three years.3
Tools of that kind put executable campaigns in the hands of people who cannot write code, and generative tooling has reduced the cost of writing convincing text to near zero. The consequence for an individual reader is that the quality of the wording on a page is no longer evidence of anything, and any assessment based on whether something "looks professional" is now obsolete.
This is precisely why the check has to move from the artefact to the structure. A page can be beautiful and fraudulent at the same time. What cannot be faked is a publisher who names itself, states a method, keeps a record of past claims and accepts corrections — and that is a test you can apply in two minutes.
Twelve rules that reduce exposure If money has already moved