How crypto criminals stole $713 million

There’s something uniquely agonising about having your cryptocurrency stolen. All transactions are recorded on a digital ledger, known as a blockchain, so even if someone takes your money and puts it in their own crypto wallet, it is still visible online.

“You can see your money there on the public blockchain, but there’s nothing you can do to get it back,” says Helen, who lost around $315,000 (£250,000) to thieves.

She likens it to watching a burglar pile up your prized possessions on the other side of an impassable chasm.

For seven years Helen and her husband Richard (not his real name), both UK residents, had been buying and stacking up crypto coins called Cardano.

They liked the idea of investing in a digital asset that had the potential to rise dramatically in value, unlike funds saved in more conventional ways. They knew it was riskier, but they were careful to keep their digital keys safe.

But somehow hackers got into their cloud storage account, where they kept information about their crypto wallets and how to access them.

In February 2024, after a small test transfer, the criminals sent all the couple’s coins to their own digital wallets in a swift and silent attack.

The couple then watched for months as their money was moved from one wallet to another, powerless to do anything. (The inherent contradiction with crypto currency is that all transactions are publicly trackable but users can be publicly untraceable if they choose.)

Helen and Richard are not wealthy. She is a personal assistant, he is a composer, and they had high hopes for their Cardano investments.

“We’d been buying these coins for so long… We used every scrap of money we could find to buy more,” says Richard. “Aside from my parents’ deaths, this theft is the worst thing to happen to me.”

Ever since, Helen has been on a mission to recover their money. She obtained detailed reports from various police forces and the Cardano developers. Now, even though she has the wallet address of the criminals, there is nothing anyone can do to unmask them.

Their plan is to save up enough to engage private investigators to try to trace the hackers.

“It leaves you with a feeling of helplessness,” she says, “but I am going to keep trying.”

A survey carried out for the Financial Conduct Authority (FCA) in August 2024, suggested that approximately 12% of British adults owned crypto-assets – equivalent to about seven million people.

Globally, it has been estimated that 560 million people are now crypto owners. But as ownership rose, so did theft. The pandemic ushered in a surge in the value of crypto coins and with it an explosion in attacks on the industry.

And 2025 was another bumper year for crypto criminals, with total thefts standing at more than $3.4bn (£2.5bn), according to investigators at blockchain analysis firm Chainalysis. The annual figure has remained in the same ballpark since 2020.

Most of the money is being stolen in massive cyber attacks on crypto companies. For example, North Korean hackers swiped $1.5bn (£1.1bn) from crypto exchange Bybit in February 2025.

The losses in this case and the vast majority of others are covered by the deep-pocketed crypto firms, with little impact on individuals. But 2025 also saw an increase in the number of attacks on individual crypto investors.

Chainalysis research says these individual attacks rose from 40,000 in 2022 to 80,000 last year.

Hacking, scamming or coercing of individuals accounted for an estimated 20% of all crypto value stolen – estimated at $713m (£532m).

But the company adds that the number could be far higher as not all victims will choose to report thefts publicly. When this happens, you could be left on your own.

Many thefts or scams in traditional finance are covered by banks or card companies. In the UK you can complain to the financial ombudsman service and may be compensated by the financial services compensation scheme.

“Crypto remains largely unregulated in the UK and high-risk,” says the FCA. “If something goes wrong, it is unlikely you will be protected so you should be prepared to lose all your money.”

A stark reminder of this comes if you search online for “Binance account hacked” – Binance is the world’s largest crypto exchange with a reported 1.4m UK users – but the page on its website offering advice to victims of theft is blocked in the UK.

The company has not been accepting new UK clients since 2023, because it is not authorised to operate by the FCA. Yet criminals don’t care where victims are, and people are being targeted all over the world indiscriminately.

Chainalysis has described these attacks on individuals as the “under-documented frontier for crypto crime”.

They put the volume of crimes down to the numbers of people entering the crypto world as investors as the value of coins has risen and argue that improved security practices at major services could have pushed “attackers toward individuals perceived as easier targets”.

Then there is the fact that the more crypto you hold and the more public you are about it, the more likely you are to be targeted – small time holders, (or hodlers, as the community calls them) are far less likely to be affected.

As for the thieves, they could be anywhere.

In October blockchain researchers from Elliptic, a crypto analysis company, warned that North Korean state-sponsored hackers are increasingly targeting wealthy cryptocurrency owners. There are plenty of young scammers and hackers from other countries too.

In December in the US, 22-year-old Evan Tangeman pleaded guilty to being part of a group of crypto thieves calling themselves the Social Engineering Enterprise, who are accused of stealing more than $260m (£194m) between October 2023 and May 2025.

Prosecutors allege they targeted the crypto-rich using hacked databases, tricking victims into thinking they were cryptocurrency exchanges, and persuading them to transfer coins.

Members of the gang, who were all young men mostly in the US, are said to have spent the stolen coins on private jets, expensive cars and luxury handbags that they would give away at nightclubs.

In some cases, prosecutors say, the gang organised home break-ins to steal hardware containing the keys to crypto stashes.

Burglaries and muggings have become so common there is now a term for them in the crypto community – “wrench attacks” – so called because criminals have been known to threaten victims with spanners.

Last April, crypto criminals in Spain tried to force a man and woman to part with their cryptocurrency.

Spanish police said the man was shot in the leg and he, along with his partner, were held captive for several hours while the criminals tried to access their crypto wallets. Eventually the woman was released but her partner remained missing, with his body later found in woodland.

Five people were arrested in Spain in connection with the case while four others in Denmark were charged.

There have been several similar cases in France including one when an attempted kidnap was captured on video.

Another case in early 2025 saw David Balland, co-founder of Ledger, a cryptocurrency security company, abducted with his wife from their home in central France.

Days later police rescued them – but Balland’s finger was cut off during the extortion attempt.

Then, last month, UK police arrested six people after masked men stopped a car travelling between Oxford and London and forced one of the occupants to transfer cryptocurrency valued at £1.5m.

Phil Ariss, director of UK Public Sector Relations at blockchain intelligence firm TRM Labs, has previously said that criminal groups already comfortable with using violence to achieve their goals were always likely to migrate to crypto.

“As long as there’s a viable route to launder or liquidate stolen assets, it makes little difference to the offender whether the target is a high-value watch or a crypto wallet.

“Cryptocurrency is now firmly in the mainstream, and as a result, our traditional understanding of physical threat and robbery needs to evolve accordingly.”

It’s difficult to determine exactly how prevalent “wrench attacks” are as few are publicly reported. But it appears as though these types of thefts are a small part of the growing issue of personal crypto thefts.

And many criminals rely on tried and trusted hacking or scam techniques that are becoming easier thanks to the abundance of data stolen in massive cyber attacks on companies.

“Data is a common problem as Bitcoin millionaires are becoming so frequent, and there are stolen databases that are enriching the target list all the time,” says Matthew Jones, founder of Haven, a crypto security firm.

A data breach at Kering, the parent company of luxury brands including Gucci and Balenciaga, is a case in point, according to one hacker interviewed by the BBC.

As well as millions of customer names and contact details, the databases show how much money people had spent at the stores.

The hacker the BBC spoke to says he purchased the spreadsheets for $300,000 (£224,000) in order to target the biggest spenders.

He claims to have used the information along with details from another stolen database to scam multiple Coinbase users out of at least $1.5m (£1.1m) in crypto.

The criminal provided confirmation that he was in possession of the stolen data and proved to the BBC that he owned $700,000 (£522,000) in Bitcoin, which he says came from one victim.

“I buy hacked databases and cross-reference them with others to check for rich people and for up-to-date phone numbers and emails. I’m still going down the list and tripled my money very fast,” he claimed.

The hacker wouldn’t give any details about himself other than the fact that he is a student at a US university.

When asked if he considered himself a hacker or a scammer he said, “Neither, I am only interested in making money.”

Kering did not respond to a request for comment about this but has previously told the BBC that its IT systems had been secured after the data breach and emphasised that no bank account numbers, credit card information, or government-issued identification numbers had been stolen in the attack.

Matthew Jones from Haven tells me that he himself has had crypto stolen and the experience prompted him to develop a crypto wallet with extra security features.

Features like continuous biometric checking to make sure that only the owner can send coins, and geofencing to block any transactions outside someone’s home or work, are now needed he says. He is also building a panic button into the digital wallet.

“People are walking around with millions of dollars in crypto these days and wallets have no ceiling on how much can be held – or how much can be stolen in one go,” he says.

Matthew Jones’s crypto wallet is all about what the industry champions as “self custody”.

Haven’s app is similar to those of Metamask and Trustwallet. Other companies like Trezor and Ledger offer physical devices like USB memory sticks but the idea is the same: you can be your own bank.

But with that added freedom comes added risk as you don’t have any protections at all.

If your coins are stolen from your own self custody wallet, you can’t even go to a crypto exchange to complain.

Asked if the freedom of “being your own bank” outweighs the increasing risks, Jones insists it does.

“Banks aren’t truly answerable to their customers and they hold the power to freeze or close your account based on broad, often vague reasons,” he argues.

He also says he objected to being asked by traditional financial institutions things like why he was moving money out of an account.

Helen and Richard lost all their coins after choosing to be their own bank. The factor that made it particularly painful was the fact that much of the money came from the sale of Richard’s mother’s house, after her death.

“My mother’s money has gone,” Richard says. “All that grafting she had done for my future and it was stolen. We’ve had to sell musical instruments and our car, and we were briefly homeless.”

Yet they aren’t entirely giving up on cryptocurrency. If they get their lost money back, or accumulate enough in savings, they plan to get straight back into crypto investing.

Top image credit: Getty Images

BBC InDepth is the home on the website and app for the best analysis, with fresh perspectives that challenge assumptions and deep reporting on the biggest issues of the day. Emma Barnett and John Simpson bring their pick of the most thought-provoking deep reads and analysis, every Saturday. Sign up for the newsletter here