Do not sign another message, approve another transaction, install a suggested update or follow instructions from the person who contacted you. Stop communicating through the suspicious channel.
Closely monitor major global cryptocurrency theft incidents
Detect threats. Preserve evidence. Trace funds.
Scan suspicious activity, phishing, malicious approvals and wallet exposure.
Investigate theft and fraud cases, collect evidence, and follow on-chain movement in one place.
URGENT INCIDENT WATCH
全球加密诈骗与盗币
CRYPTO INTELLIGENCE
Major crypto news & analysis
Search news
THE PEOPLE WHO SHAPED CRYPTO
Crypto Figures
Ideas, influence, ambition and the choices that changed the industry.
FRAUD PATTERN LIBRARY
50 Crypto Scam Patterns
Learn how common deception methods unfold—from first contact to attempted withdrawal.
INCIDENT RESPONSE DESK
If you suspect your wallet is compromised
Never disclose your recovery phrase, private key, wallet password or one-time authentication code.
Create an incident case record
Record incident details and prepare an evidence report. Never enter a recovery phrase, private key, password or authentication code.
SECURITY INTELLIGENCE
Cases that demand attention
Historical incidents and recent reported cases, organized for on-site investigation study.
FROM SECURITY CENTER
Security guides
Search practical guides by attack type, warning sign or protective action. Select any guide to read the complete playbook.
Learn on-chain investigation
CRYPTO INVESTIGATION ACADEMY
Learn on-chain investigation
A structured curriculum: preserve evidence, reconstruct movements, test hypotheses and write defensible findings.
MODULE 01 · TRIAGE
Incident intake & evidence preservation
Build an incident timeline, preserve original transaction hashes, record chain IDs, UTC timestamps, token contracts, screenshots and communications. Never collect seed phrases or private keys.
MODULE 02 · TRANSACTIONS
Read a transaction from first principles
Separate transaction hash, block, sender, recipient, value, fee, nonce, execution status and event logs. Distinguish a successful transaction from a successful token transfer.
MODULE 03 · TOKEN FLOWS
Decode token transfers and approvals
Inspect ERC-20 Transfer and Approval events, token contract identity, decimals, spender permissions, allowance changes and suspicious approvals. Do not infer token identity from ticker symbols alone.
MODULE 04 · WALLET GRAPH
Build a wallet relationship graph
Represent wallets and services as nodes, transfers as directed edges. Track first-seen time, amounts, assets, transaction IDs, hop count and confidence. Common funding or timing is a lead, not proof of common control.
MODULE 05 · CROSS-CHAIN
Follow bridge movements
Match source and destination events using bridge contract, message or nonce identifiers, asset mapping, amount after fees and timestamp windows. Do not match transfers by amount and time alone.
MODULE 06 · LAUNDERING PATTERNS
Recognize obfuscation patterns
Study peel chains, fan-out/fan-in, rapid consolidation, swaps, liquidity pools, privacy tools and repeated address cycles. Describe observed behavior precisely; avoid unsupported claims about identity or intent.
MODULE 07 · SERVICE ATTRIBUTION
Identify exchange and service touchpoints
Assess public labels, deposit patterns, address reuse and service-specific transaction behavior. Record the source and date of every label. Only the service can confirm account ownership.
MODULE 08 · OSINT
Correlate public information
Build a source matrix for domains, public statements, company records, usernames and breach disclosures. Separate direct evidence, corroborated inference and unverified leads.
MODULE 09 · REPORTING
Prepare an evidence-led case report
Write an executive summary, incident timeline, wallet inventory, transaction graph, evidence register, confidence ratings, unresolved questions and requested preservation action.
KNOWLEDGE CHECK
Test your investigation judgment
A wallet sends funds to a deposit address publicly labeled as an exchange. What can you safely conclude?
FROM COMMUNITY
Market views & real experiences
Recent community posts about markets, scams and wallet theft.
INCIDENT INTELLIGENCE DATABASE
Crypto theft case library
Historical incidents and recent reported cases, organized for on-site investigation study.
Showing all cases
Case values are reported estimates at the time of the incident, not current market values. Attribution, recovery and loss figures may change as investigations develop. “Frozen” does not mean “returned”. The October 30, 2026 Binance report is marked developing and its attacker attribution remains unconfirmed.
ON-CHAIN INVESTIGATION
Trace & evidence workspace
Organise wallet-to-wallet movements, preserve transaction evidence and build an auditable investigation worksheet.
ON-CHAIN INVESTIGATION
Trace a transaction
Enter a public wallet address or transaction hash.
INVESTIGATION WORKFLOW
From transaction hash to evidence trail
Start with a public wallet address or transaction identifier. Verify the network and transaction in an independent block explorer, then record each confirmed movement below. This workspace organises evidence; it does not identify a wallet owner or independently prove criminal conduct.
PRACTICAL WORKBENCH
Build a trace worksheet
Record each observed transfer as a separate evidence row. Keep the transaction hash and source chain with every claim.
EVIDENCE STANDARDS
What to preserve
Keep the original transaction hash, network, block height, UTC timestamp, token contract, amount, source and destination addresses, explorer URL, screenshots and the reason each transfer is relevant. Record facts separately from assumptions. Never enter seed phrases, private keys, exchange passwords or recovery codes.
CRYPTO ASSET DEFENCE CENTER
Protect your wallet before attackers reach it
Practical security playbooks, threat intelligence, interactive checks and incident-response tools for everyday crypto users and advanced wallet operators.
THE MOST IMPORTANT RULE
Never disclose your recovery phrase, private key, wallet password or one-time authentication code.
Legitimate exchanges, wallet providers, investigators and government agencies do not need your secret recovery phrase to verify a transaction or investigate a theft.
01Verify every linkBefore connecting
02Inspect every signatureBefore approving
03Limit permissionsAfter every dApp use
04Prepare a response planBefore an incident
INTERACTIVE SECURITY TOOLS
Check before you connect, sign or send
TOOL 01 · LINK INSPECTION
Suspicious URL pattern checker
Inspect a URL for common phishing signals directly in this page. No URL is uploaded by this checker.
This checks visible URL patterns only. It does not query domain reputation, inspect website code or certify a site as safe. A clean result is not proof of legitimacy.TOOL 02 · ADDRESS POISONING
Compare two wallet addresses
Check whether a candidate address resembles a trusted address while still being different. This helps expose look-alike addresses inserted into transaction history.
The comparison is character-based. It does not prove that either address belongs to a person or service, or that it is valid on a particular network.TOOL 03 · SIGNING SAFETY
Transaction approval pre-flight
Check the details you should understand before approving a transaction or message signature.
0 of 8 checks completed. Do not sign until every item is understood.
TOOL 04 · PERSONAL SECURITY AUDIT
Build your wallet protection baseline
Mark the protections already in place. Your progress is calculated locally in this browser.
0 of 10 protections confirmed.
THREAT KNOWLEDGE LIBRARY
Understand the attack before it happens
Search practical guides by attack type, warning sign or protective action. Select any guide to read the complete playbook.
INCIDENT RESPONSE DESK
If you suspect your wallet is compromised
Follow the order carefully. The right action depends on whether the recovery phrase, a device, a token approval or an exchange account was compromised.
If malware, remote-access software or a suspicious browser extension may be involved, disconnect the affected device from the network. Do not create a new wallet or enter a recovery phrase on that device.
If the recovery phrase or private key is exposed, create a new wallet with a newly generated phrase on a trusted, uncompromised device or genuine hardware wallet. Move remaining assets to the new wallet. Prioritize valuable assets and verify the destination carefully. A compromised phrase cannot be made safe by changing a password.
From a clean device, review token allowances and NFT operator approvals on the correct network. Revoke suspicious permissions using a trusted wallet interface or verified block explorer. Revoking is an on-chain transaction and usually costs gas. Disconnecting a dApp alone does not revoke token allowances.
Contact the exchange, wallet provider or payment provider through independently verified official channels. Request an account lock, withdrawal hold, session revocation or preservation of relevant records where available. Never transfer funds to a so-called safe wallet provided by support.
Save transaction hashes, wallet addresses, network names, UTC timestamps, token contract addresses, URLs, emails, chat exports, phone numbers, screenshots and support ticket IDs. Do not edit original evidence files.
Report to your local police or cybercrime authority and the relevant exchange. Include transaction IDs, amounts, assets, addresses, dates, platform names and communications. Report fraudulent domains to the appropriate national cyber-security response team.
Do not pay advance taxes, unlock fees, tracing deposits or guaranteed recovery fees. Treat unsolicited recovery agents and people claiming to be law enforcement with extreme caution.
CASE INTAKE BUILDER
Create an incident evidence record
Enter non-secret incident details to prepare a structured report you can save and share with an exchange or authority. Never enter a recovery phrase, private key, password or authentication code.
SECURITY INTELLIGENCE
Cases that demand attention
Historical incidents and recent reported cases, organized for on-site investigation study.
SECURITY INTELLIGENCE
Recent warnings worth reading
Tampered hardware wallets reported
Police warned about cases involving hardware wallets allegedly containing malicious components capable of capturing recovery phrases or private keys. Buy through authorized channels, inspect device integrity and never enter a recovery phrase into a suspected device.
Permit signatures and malware-assisted wallet theft
Police described scams in which fake video-call updates delivered malware, followed by social engineering that induced victims to sign Permit messages. An off-chain signature can grant future token spending authority without an immediate transfer.
Approval phishing investigations
Chainalysis described approval-phishing operations that combine social engineering with on-chain spender and consolidation infrastructure. A single approval can expose a token balance to later transfers.
Scam operations are becoming industrialized
Chainalysis estimated $17 billion in crypto scam and fraud losses during 2025, with impersonation scams and AI-enabled tactics expanding. Treat polished interfaces, deepfake video and social proof as weak trust signals.
SECURITY RESEARCH BASIS
Guidance and threat research
- Singapore Police Force advisory on tampered cryptocurrency hardware wallets — 28 October 2026.
- Singapore Police Force advisory on malicious links, Permit signatures and unauthorized crypto transactions — 1 July 2026.
- Singapore Police Force and Cyber Security Agency guidance on crypto asset compromise and wallet drainers.
- Chainalysis 2026 crypto scam research and approval-phishing investigation — January and June 2026.
- MetaMask technical guidance on transaction simulation and token allowance revocation.
- FBI guidance on cryptocurrency investment fraud and recovery scams.
Use official security advisories from your own country and the wallet or exchange provider involved. Procedures and reporting channels vary by jurisdiction.
VICTIM ACTION PLAN
What to do after crypto is stolen
IMMEDIATESecure what remainsUse a clean device. Move unaffected assets to a new wallet only if safe. Revoke risky token approvals with trusted tools.
DOCUMENTPreserve evidenceSave transaction hashes, wallet addresses, dates, amounts, token contracts, URLs, emails and chat records.
REPORTContact platformsNotify the exchange or service that received funds. Provide transaction details and request urgent review or preservation.
ESCALATEReport to authoritiesFile a report with your local police or national cybercrime authority. Include a clear timeline and evidence bundle.
WALLET COMPROMISE
Seed phrase or private key exposed
Assume the wallet is permanently compromised. Do not reuse the seed phrase. Never share it with anyone claiming to investigate.
MALICIOUS APPROVAL
Tokens drained after a signature
Identify the approval transaction and spender contract. Revoke remaining allowances through a trusted chain-specific interface.
EXCHANGE ACCOUNT
Exchange account takeover
Contact the exchange through its official website, secure the email account and preserve login alerts and support case numbers.
INVESTMENT FRAUD
Fake investment or recovery scam
Stop sending funds. Preserve conversations, payment records, websites and account details. Report the fraud and any follow-on recovery scam.
DEFI EXPLOIT
Protocol or smart-contract exploit
Record contract addresses, block numbers, event logs and affected transactions. Follow official project incident updates.
CROSS-CHAIN
Funds moved across networks
Record both sides of every bridge transfer and the matching timestamps. Do not assume similarly sized transfers are linked without evidence.
Safety notice: No legitimate investigator needs your seed phrase, private key, exchange password or remote access to your device. Be wary of anyone promising guaranteed recovery, asking for an upfront “unlock” or “tax” payment, or claiming they can reverse a confirmed blockchain transaction. Blockchain tracing can identify leads; freezing or returning funds generally requires cooperation from a custodian, platform or competent authority.
WELCOME TO THE CRYPTO SAFETY COMMUNITY
Real voices. Different perspectives. Better decisions.
FIND YOUR CONVERSATION
Voices worth readingFrom existing posts
Community
Safety guides
CRYPTO PEOPLE
The People Behind Crypto
Six in-depth profiles examining the founders, builders and former industry leaders whose decisions shaped the modern crypto market.
CRYPTO FRAUD ATLAS
50 Crypto Scam Patterns
Fifty distinct illustrated scam scenarios, organized to help readers recognize how fraud unfolds. These are illustrative patterns, not verified individual victim reports.
