What is social engineering in crypto?

Social engineering in crypto is the use of deception to get someone to open the door for an attacker. Instead of breaking encryption, the attacker breaks trust, by posing as a colleague, a support agent, a recruiter or a romantic interest. Because blockchain transactions cannot be reversed, a single convincing message can lead to a permanent loss.

What are examples of social engineering in crypto?

The FBI describes social engineering as the main way criminals carry out SIM swaps, by impersonating the victim and talking a mobile carrier into moving their number, a scheme covered in what a SIM swap attack is. Other common forms include fake exchange support staff who ask for a recovery phrase, messages that link to look-alike login pages, and fake job offers that ask a candidate to install software, a pattern in crypto job scams.

Fox Business, summarizing the FBI's annual internet crime report for 2025, said crypto investment scams often begin on social media, by text, through ads or on dating apps. Victims are steered to fake platforms, shown made-up profits, then asked to pay "taxes" or "fees" before the scammers disappear. The same report counted about 181,565 crypto-related complaints and $7.2 billion lost to crypto investment fraud.

How does social engineering lead to crypto company hacks?

Large breaches often start with one person. Ledger's report on its December 2023 Connect Kit incident says a former employee fell for a sophisticated phishing attack, which gave the attacker access to a code publishing account and let them push malicious code to crypto apps. In the October 2026 Binance theft, Euronews reported that investigators were looking at several factors, including a compromised DevOps engineer's laptop, though the full chain of events had not been published.

How do you spot a social engineering attempt?

Common signs include urgency, a request to move funds to a "safe" wallet, a request for a recovery phrase or one-time code, and contact that arrives unexpectedly from someone claiming authority. A legitimate exchange or wallet maker does not need your recovery phrase. For calls that claim to come from a mobile carrier, the FBI advises hanging up and dialing the carrier's customer service line yourself, and the same habit works for any company.

Wallet approvals deserve the same caution, since signing a malicious request can hand over funds, as described in crypto phishing and wallet drainers. Anyone who has been targeted can find reporting steps in what to do if you are scammed.

Loss figures are as reported for the year cited and may be revised.