Incident Overview
On August 19, 2025, a victim lost 783 BTC ($91 million) in a social engineering scam where threat actors impersonated exchange and hardware wallet customer support representatives. The theft occurred exactly one year after the $243 million Genesis Creditor theft, with the stolen funds beginning to be laundered through privacy-focused services including Wasabi wallet.
The attack was executed through sophisticated social engineering tactics where the perpetrators impersonated legitimate customer support personnel from both cryptocurrency exchanges and hardware wallet companies. The victim was manipulated into providing access credentials or performing actions that compromised their Bitcoin holdings, resulting in the unauthorized transfer of 783 BTC valued at approximately $91 million. Following the theft, the threat actors immediately began implementing money laundering techniques, including "peeling" transactions to break up the large sum into smaller amounts and making deposits to Wasabi wallet, a privacy-focused Bitcoin mixing service designed to obscure transaction trails.
The timing of this theft is particularly notable as it occurred exactly one year after the massive $243 million Genesis Creditor theft, suggesting possible coordination or symbolic significance to the attackers.
Transaction Hash:
da598f2a941ee3c249a3c11e5e171e186a08900012f6aad26e6d11b8e8816457
Exploiter Address:
bc1qyxyk4qgyrkx4rjwsuevug04wahdk6uf95mqlej
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Phishing, these are the critical security checks that could have prevented this incident (August 2025).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Phishing
The Phishing hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.