A newly uncovered cryptocurrency phishing campaign, dubbed Operation Asterix, targeted approximately 885,000 phone numbers across multiple countries, according to a report by cybersecurity firm Rapid7.
The campaign, which employed social engineering tactics, led to 5,576 accounts linked to users on Binance being queued for attack. Recovered logs also revealed fake emails impersonating Crypto.com. The largest dataset included 316,002 German mobile numbers, with additional directories covering Hong Kong, Bulgaria, the UK, the US, Canadian fintech companies, and Ledger-related lists.
Operation Asterix used fake apps mimicking Ledger, Trezor, and Exodus to trick victims into revealing seed phrases. Attackers initiated contact through fraudulent support emails and phone inquiries. Rapid7 analysts Anna Sirokova and Jan Recinsky detailed the campaign’s kill chain, from initial acquisition to data exfiltration.
The campaign achieved a 13.6% “hit rate,” matching 43,066 accounts to cryptocurrency users with exchange accounts based on the German dataset. A separate checker tool was also identified, designed to bulk-validate phone numbers against Kraken accounts. Rapid7 noted that artificial intelligence tools played a significant role in the operation.
Phishing attacks accounted for $306 million of the $482 million in crypto industry losses during the first quarter, according to blockchain security firm Hacken. Earlier incidents this year included a breach at Trezor affecting 14,000 users via its shipping provider, ShipMonk, and a $1 million loss from a malicious phishing token approval on Ethereum. In November 2023, a fake Ledger Live app on the Microsoft Store resulted in $588,000 stolen across 38 transactions.
Industry figures, including Binance co-founder Changpeng Zhao, have previously highlighted the persistent threat of phishing scams, citing a $50 million loss in an address poisoning incident in December 2025. On May 25, onchain analyst “b-block” reported scammers using Google to deploy malicious phishing ads impersonating Uniswap, stealing over $400,000 from victims.
