Rapid7 warns of crypto phishing attack using 885,000 phone numbers
Rapid7 researchers have uncovered a large-scale phishing campaign dubbed Operation Asterix, in which attackers collected around 885,000 phone numbers from several countries. The attackers linked phone numbers to accounts on crypto exchanges and redirected potential victims to fake wallet websites in an attempt to steal their seed phrases.
According to the report, researchers also found signs that artificial intelligence tools were actively used in preparing the attacks. The attackers’ infrastructure included fake services impersonating Ledger, Trezor and Exodus, as well as messages posing as Crypto.com notifications.
Attackers checked phone numbers for crypto accounts
The largest database uncovered by researchers contained 316,002 German mobile phone numbers. Separate datasets covered users in Hong Kong, Bulgaria, the UK and the U.S., as well as Canadian fintech companies and Ledger customers.
From the German dataset, the attackers were able to match 43,066 phone numbers with users of cryptocurrency services. This means that around 13.6% of the numbers represented potentially viable targets.
Rapid7 separately identified 5,576 accounts linked to Binance users that had been prepared for subsequent attacks. The campaign infrastructure also included a tool for bulk-checking phone numbers for associated Kraken accounts.
After identifying potential victims, the scammers used emails and phone calls while impersonating customer support representatives. Users were directed to fake Ledger, Trezor and Exodus apps and websites, where the attackers attempted to obtain their seed phrases and gain access to their crypto assets.
Rapid7 also found evidence of AI tools in the recovered materials. According to the researchers, they played a significant role in the infrastructure and preparation of the phishing campaign.
Phishing remains a major source of crypto losses
Such attacks allow criminals to bypass the technical security of blockchains and wallets by targeting users directly. According to Hacken, phishing and other social engineering methods caused around $306 million of the $482 million stolen from the crypto industry in the first quarter of 2026.
In April, Polymarket faced claims of a potentially large-scale user data leak. An unidentified seller on a dark web forum offered information that they claimed belonged to hundreds of thousands of platform users.
Polymarket rejected claims that it had been breached, saying the data being offered was already publicly available through open APIs and on-chain information. The company said it found no evidence that its internal systems had been compromised or that private user data had been leaked.
An alleged GTA VI leak was also recently used to promote the CYBERLEEK token. After gameplay footage was published alongside a mention of the token, its market capitalization surged nearly 5,800% within an hour to $3.46 million.
Latest Trezor Wallet News
-
Afghanistan
-
Albania
-
Algeria
-
Angola
-
Argentina
-
Armenia
-
Australia
-
Austria
-
Azerbaijan
-
Bahamas
-
Bahrain
-
Bangladesh
-
Belarus
-
Belgium
-
Bolivia
-
Botswana
-
Brazil
-
Brunei
-
Bulgaria
-
Cambodia
-
Cameroon
-
Canada
-
Chile
-
China
-
Colombia
-
Congo
-
Costa Rica
-
Cote d'Ivoire
-
Croatia
-
Cuba
-
Cyprus
-
Czechia
-
DR Congo
-
Denmark
-
Dominican Republic
-
Ecuador
-
Egypt
-
El Salvador
-
Estonia
-
Eswatini
-
Ethiopia
-
Finland
-
France
-
Georgia
-
Germany
-
Ghana
-
Greece
-
Haiti
-
Hong Kong
-
Hungary
-
India
-
Indonesia
-
Iran, Islamic republic
-
Iraq
-
Ireland
-
Israel
-
Italy
-
Jamaica
-
Japan
-
Jordan
-
Kazakhstan
-
Kenya
-
Korea
-
Kuwait
-
Kyrgyzstan
-
Laos
-
Latvia
-
Lebanon
-
Lesotho
-
Libya
-
Lithuania
-
Luxembourg
-
Madagascar
-
Malaysia
-
Malta
-
Mauritius
-
Mexico
-
Moldova
-
Mongolia
-
Montenegro
-
Morocco
-
Mozambique
-
Myanmar
-
Namibia
-
Nepal
-
Netherlands
-
New Zealand
-
Nigeria
-
North Macedonia
-
Norway
-
Oman
-
Pakistan
-
Palestine
-
Panama
-
Papua New Guinea
-
Paraguay
-
Peru
-
Philippines
-
Poland
-
Portugal
-
Puerto Rico
-
Qatar
-
Reunion
-
Romania
-
Rwanda
-
Saudi Arabia
-
Serbia
-
Singapore
-
Slovakia
-
Slovenia
-
Somalia
-
South Africa
-
Spain
-
Sri Lanka
-
Sweden
-
Switzerland
-
Syria
-
Taiwan
-
Tajikistan
-
Tanzania
-
Thailand
-
Trinidad and Tobago
-
Tunisia
-
Turkey
-
UAE
-
Uganda
-
Ukraine
-
United Kingdom
-
United States
-
Uruguay
-
Uzbekistan
-
Venezuela
-
Vietnam
-
Yemen
-
Zambia
-
Zimbabwe
- Forex
- Crypto
