Written by Zoltan Vardaistaff writerReviewed by Robert Lakinstaff editor

Written by Zoltan Vardaistaff writer

Reviewed by Robert Lakinstaff editor

Cybersecurity firm unveils crypto phishing campaign targeting 885,000 phone numbers

Latest NewsPublishedAug 20, 2026

Rapid7 unveiled a new cryptocurrency phishing campaign targeting 885,000 phone numbers, aiming to steal investors’ holdings by redirecting them to fake wallet provider websites.

Cybersecurity firm Rapid7 unveiled a new cryptocurrency phishing campaign known as Operation Asterix, targeting roughly 885,000 phone numbers from several countries to steal cryptocurrency investors’ assets.

The phishing campaign led to 5,576 accounts matched to users on crypto exchange Binance, which were queued for attack, while the recovered logs also showed fake emails impersonating Crypto.com, as reported by a Monday report by Rapid7.

Of the 885,000 phone numbers, the largest file included 316,002 German mobile numbers, with additional directories covering Hong Kong, Bulgaria, the UK, the US, Canadian fintech companies and additional Ledger-related lists. 

Phishing attacks and social engineering scams drove the majority of the crypto industry’s losses in the first quarter of the year, accounting for $306 million out of the total $482 million lost, as reported by blockchain security company Hacken.

As part of the Asterix phishing campaign detailed by Rapid7 analysts Anna Sirokova and Jan Recinsky, attackers drove victims to fake apps impersonating Ledger, Trezor, and Exodus, seeking to steal their seed phrases. Attackers reached out to victims through fake support emails and phone inquiries.

Operation Aseterix kill chain from acquisition to exfiltration. Source: Rapid7.

Cointelegraph has contacted the analysts for further comment on what they found regarding target filtering, hardware wallet spoofing and self-custody vulnerabilities. We will update this article when they reply.

Earlier in August, wallet provider Trezor reported a breach of personal data affecting about 14,000 users through its shipping provider, ShipMonk.  

In July, a crypto investor lost nearly $1 million after signing a malicious phishing token approval transaction on Ethereum. 

In November 2023, a fake Ledger Live app on the Microsoft Store resulted in the theft of $588,000 across 38 transactions. 

Related: DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Asterix phishing campaign boasts 13% “hit rate” 

Attackers matched 43,066 accounts to cryptocurrency users with exchange accounts, validated from the larger German dataset of over 316,000 phone numbers, meaning that the campaign has a “hit rate” of approximately 13.6%, as reported by Rapid7. 

The report also identified a checker for Kraken, which sought to bulk-validate phone numbers against accounts from the cryptocurrency exchange. The cybersecurity company stated that the recovered artifacts showed that artificial intelligence tools were used as a notable part of the phishing campaign.

Phishing attacks are a long-standing headwind for the crypto industry, as they enable attackers to exploit human behavior rather than the code of a protocol. 

On May 25, onchain analyst “b-block” warned that scammers used Google to deploy malicious phishing ads impersonating decentralized exchange Uniswap, reportedly stealing more than $400,000 from victims. 

Leading crypto industry figures, including Binance co-founder Changpeng Zhao, have previously called for better wallet security measures to avoid phishing scams, after an investor lost $50 million in an address poisoning scam in December 2025.  

Magazine: How a ‘Wrong Number’ message turned into a $3.4M crypto scam 

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• Phishing
• Hackers
• Hacks
• Social Engineering
• Scams
• Wallet
• Scams & Cybercrime

More on the subject

MAYAChain halts network after estimated $1.7M exploit

Aug 19, 2026

Ezra Reguerra

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra

DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Aug 16, 2026

Zoltan Vardai

MAYAChain halts network after estimated $1.7M exploit

Aug 19, 2026

Ezra Reguerra

Alleged $165M crypto Ponzi mastermind faces US charges after Fiji deportation

Aug 18, 2026

Ezra Reguerra

DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Aug 16, 2026

Zoltan Vardai