How crypto money actually gets stolen
Each case here is a real pattern: what the attacker did, in what order, what the victim saw on screen, and the one step that would have stopped it.
Payout Fraud on Marketplaces: When a Seller Account Is Taken Over
Platforms paying many recipients face attacks on the recipient side. How payout destinations get changed and what detects it.
industries · Sep 2, 2026 · 2 minCASE 044When Your Payment Provider Fails While Holding Your Money
Providers hold merchant funds between payment and settlement. What happens if they fail, and how to limit what is exposed.
acquiring · Aug 28, 2026 · 2 minCASE 043Checking an OTC Counterparty Before the First Trade
The verification that takes an hour and the specific answers that should end the conversation.
otc · Aug 23, 2026 · 2 minCASE 042Choosing an Exchange: The Checks That Actually Predict Failure
Not fees or interface. The specific things that distinguished platforms that survived from those that did not.
exchange · Aug 17, 2026 · 2 minCASE 041Property Deposit Fraud and the Crypto Variant
The most reliably lucrative fraud in conveyancing, adapted to crypto settlement, and the confirmations that stop it.
industries · Aug 13, 2026 · 2 minCASE 040Impersonation Fraud Against Funds and Family Offices
Large infrequent transfers with several approvers attract a specific attack. How instructions are forged and what verification defeats it.
industries · Aug 7, 2026 · 2 minCASE 039Crypto Orders and Fulfilment Fraud in Online Retail
Irreversible payment protects the money and not the goods. The order patterns worth flagging and the screening that still applies.
industries · Aug 4, 2026 · 2 minCASE 038When Your Platform Is Used to Move Someone Else's Money
Financial technology companies inherit the compliance exposure of their users. The abuse patterns and the controls that detect them.
industries · Jul 30, 2026 · 2 minCASE 037Which Industries Get Targeted, and With What
Fraud patterns cluster by sector because the money moves differently in each. What to expect in yours.
industries · Jul 23, 2026 · 2 minCASE 036Crypto Card Fraud: What Happens After the Details Leak
Cards funded by a crypto balance have weaker recourse than bank cards. The common patterns and the configuration that limits damage.
cards · Jul 20, 2026 · 2 minCASE 035Checking a MiCA Compliance Claim in Five Minutes
Every European platform now claims MiCA compliance. What the claim means, which permission actually matters, and how to verify it.
licensing · Jul 13, 2026 · 2 minCASE 034Offshore Structures: Reading Where a Platform Actually Sits
The entity, the jurisdiction and the terms of service matter more than the website. How to find out what you are contracting with.
licensing · Jul 10, 2026 · 2 minCASE 033The Licence That Is Not a Licence
Registrations, memberships and offshore authorisations presented as regulatory approval. How to tell what a claim is actually worth.
licensing · Jul 4, 2026 · 2 minCASE 032How a Bad Quote Hides in a Good Relationship
Not fraud, just a spread you never measured. How to check whether your desk is pricing you fairly, and what to do when it is not.
otc · Jun 29, 2026 · 2 minCASE 031Fake OTC Desks: How the Large Trade Is Set Up
The approach, the credentials, the paperwork and the point at which the money moves. What verification takes an hour and saves everything.
otc · Jun 23, 2026 · 2 minCASE 030Who Sends First: Settlement Risk in Private Crypto Trades
The structural problem in every bilateral trade, the arrangements that solve it, and the ones that only appear to.
otc · Jun 19, 2026 · 2 minCASE 029The Bitcoin Payment Pretexts Used Against Businesses
Fake suppliers, urgent director requests and refund manipulation. The specific scripts, and why finance teams act on them.
bitcoin payments · Jun 14, 2026 · 2 minCASE 028Accepting Bitcoin Too Quickly: What Zero Confirmations Actually Risks
A broadcast transaction is not a settled one. When accepting at zero confirmations is reasonable and when it is not.
bitcoin payments · Jun 10, 2026 · 2 minCASE 027Interception: Changing the Address Between Invoice and Payment
How an attacker substitutes a payment address in transit, why both parties see what they expect, and the confirmation that stops it.
stablecoin payments · Jun 3, 2026 · 2 minCASE 026Stablecoin Yield: Where the Return Actually Comes From
A yield on a dollar-pegged asset is generated by an activity with risk. What the common sources are and which failures follow.
stablecoin payments · May 31, 2026 · 2 minCASE 025Frozen Stablecoin: When the Issuer Blocks an Address
Stablecoin issuers can freeze balances at any address. Why it happens, who it happens to, and how to avoid receiving tainted funds.
stablecoin payments · May 24, 2026 · 2 minCASE 024Fake USDT: Tokens That Look Right and Are Worthless
Anyone can create a token called USDT. How the counterfeit reaches a merchant, and the single check that distinguishes it.
stablecoin payments · May 19, 2026 · 2 minCASE 023The Compliance Failures That Close Merchant Accounts
What gets a merchant terminated by a crypto payment provider, why the notice is short, and how to avoid being in that position.
acquiring · May 14, 2026 · 2 minCASE 022When the Attacker Changes Your Settlement Address
A merchant account compromise redirects settlements rather than stealing a balance. Why it goes unnoticed and what detects it.
acquiring · May 11, 2026 · 2 minCASE 021The Overpayment Refund Scam Against Merchants
A customer pays too much and asks for the difference back. Why the original payment is not what it appears, and the policy that prevents it.
acquiring · May 4, 2026 · 2 minCASE 020No Chargebacks Does Not Mean No Fraud
What irreversible payments actually protect a merchant from, which fraud they do not touch, and the screening that still applies.
acquiring · Apr 29, 2026 · 2 minCASE 019The Fake Payment Gateway: Defrauding the Merchant Instead of the Customer
A cloned gateway that takes customer payments and never settles. How merchants are recruited and what verification prevents it.
acquiring · Apr 24, 2026 · 2 minCASE 018Custody Diligence: The Answers That Should End the Conversation
Specific responses from a custody provider that indicate you should stop, and why each one matters more than it sounds.
custody · Apr 21, 2026 · 2 minCASE 017What Custody Insurance Actually Covers, and What It Does Not
Policy limits are aggregate, exclusions are broad, and the most likely loss is usually not covered. How to read the claim properly.
custody · Apr 15, 2026 · 2 minCASE 016Fake Custody: Platforms That Show a Balance and Hold Nothing
How to distinguish a custodian holding your assets from a website displaying a number, using checks that cost nothing.
custody · Apr 9, 2026 · 2 minCASE 015How Multi-Signature Setups Actually Fail
Not broken cryptography. Lost keys, untested recovery, and thresholds that made sense until someone left.
corporate wallet · Apr 4, 2026 · 2 minCASE 014Nobody Legitimate Asks for a Recovery Phrase. Here Is Who Does.
The specific pretexts used to extract a recovery phrase, why they work on careful people, and the rule that has no exceptions.
corporate wallet · Apr 1, 2026 · 2 minCASE 013The Employee With Access: Insider Loss and How It Actually Happens
Most insider crypto losses are not dramatic thefts. They are unrevoked access, shared credentials and a departure nobody processed.
corporate wallet · Mar 27, 2026 · 2 minCASE 012The Fake Invoice: How Companies Lose Crypto to a Changed Address
An attacker in a mailbox changes one line on an invoice. Why finance teams pay it, and the control that makes it fail.
corporate wallet · Mar 21, 2026 · 2 minCASE 011Sending on the Wrong Network: The Mistake With No Recovery
Why the same asset on a different network is unreachable, which situations are recoverable, and the habits that prevent it entirely.
swap · Mar 15, 2026 · 2 minCASE 010Fake Swap Services: The Quote That Is Never Honoured
How a fraudulent swap takes the deposit and stalls, the pattern of the follow-up demands, and the checks that take one minute.
swap · Mar 12, 2026 · 2 minCASE 009Token Approvals: The Permission That Empties a Wallet Later
How an unlimited approval works, why the damage arrives weeks after the signature, and how to audit what you have already granted.
swap · Mar 6, 2026 · 2 minCASE 008Third Party Payment Fraud: When Someone Offers to Cash Out for You
The informal exchange offer that converts a legitimate holder into a money laundering participant, and why the consequences fall on you.
offramp · Mar 1, 2026 · 2 minCASE 007Why Your Bank Closed the Account After a Crypto Payment
What triggers a bank to exit a customer, why they cannot explain, and how to handle crypto proceeds so it does not happen.
offramp · Feb 23, 2026 · 2 minCASE 006When an Exchange Stops Your Withdrawal: Ordinary Causes and Warning Signs
Most frozen withdrawals are routine compliance. Some are the first sign of a failing platform. How to tell which one you are looking at.
offramp · Feb 20, 2026 · 2 minCASE 005The Recovery Scam: Fake Off-Ramps That Target People Already Defrauded
How operators find victims of earlier frauds and charge them again, why the pitch is convincing, and the one rule that defeats it.
offramp · Feb 14, 2026 · 2 minCASE 004The On-Ramp Fee Tricks That Are Legal and Still Cost You
Hidden spread, the cash advance charge, fixed network fees and the rate that expires. What to look at instead of the advertised percentage.
onramp · Feb 10, 2026 · 2 minCASE 003When an On-Ramp Freezes Your Purchase and Asks Questions
Why a completed purchase gets held, which answers resolve it, and the mistakes that turn a two-day review into a two-month one.
onramp · Feb 4, 2026 · 2 minCASE 002Account Takeover at the On-Ramp: The Sequence That Works
How an attacker gets from an email address to a drained exchange balance, and which single control breaks the chain.
onramp · Jan 29, 2026 · 2 minCASE 001Fake On-Ramp Sites: How the Cloned Checkout Works
A cloned exchange front end takes the payment and never delivers. How the clones are distributed, what they get right, and the checks that catch them.
onramp · Jan 24, 2026 · 2 min