Crypto Criminals: How Sh90 Billion Was Stolen with Age-Old Scams

There's something uniquely agonising about having your cryptocurrency stolen. All transactions are recorded on a digital ledger, known as a blockchain, so even if someone takes your money and puts it in their own crypto wallet, it is still visible online. "You can see your money there on the public blockchain, but there's nothing you can do to get it back," says Helen, who lost around $315,000 (£250,000) to thieves. She likens it to watching a burglar pile up your prized possessions on the other side of an impassable chasm. For seven years Helen and her husband Richard (not his real name), both UK residents, had been buying and stacking up crypto coins called Cardano. They liked the idea of investing in a digital asset that had the potential to rise dramatically in value, unlike funds saved in more conventional ways. They knew it was riskier, but they were careful to keep their digital keys safe. But somehow hackers got into their cloud storage account, where they kept information about their crypto wallets and how to access them. In February 2024, after a small test transfer, the criminals sent all the couple's coins to their own digital wallets in a swift and silent attack. The couple then watched for months as their money was moved from one wallet to another, powerless to do anything. (The inherent contradiction with crypto currency is that all transactions are publicly trackable but users can be publicly untraceable if they choose.) Helen and Richard are not wealthy. She is a personal assistant, he is a composer, and they had high hopes for their Cardano investments. "We'd been buying these coins for so long... We used every scrap of money we could find to buy more," says Richard. "Aside from my parents' deaths, this theft is the worst thing to happen to me." Ever since, Helen has been on a mission to recover their money. She obtained detailed reports from various police forces and the Cardano developers. Now, even though she has the wallet address of the criminals, there is nothing anyone can do to unmask them. Their plan is to save up enough to engage private investigators to try to trace the hackers. "It leaves you with a feeling of helplessness," she says, "but I am going to keep trying." Most of the money is being stolen in massive cyber attacks on crypto companies. For example, North Korean hackers swiped $1.5bn (£1.1bn) from crypto exchange Bybit in February 2025. The losses in this case and the vast majority of others are covered by the deep-pocketed crypto firms, with little impact on individuals. But 2025 also saw an increase in the number of attacks on individual crypto investors. Chainalysis research says these individual attacks rose from 40,000 in 2022 to 80,000 last year. Hacking, scamming or coercing of individuals accounted for an estimated 20% of all crypto value stolen - estimated at $713m (£532m). But the company adds that the number could be far higher as not all victims will choose to report thefts publicly. When this happens, you could be left on your own. In some cases, prosecutors say, the gang organised home break-ins to steal hardware containing the keys to crypto stashes. Burglaries and muggings have become so common there is now a term for them in the crypto community - "wrench attacks" - so called because criminals have been known to threaten victims with spanners. Last April, crypto criminals in Spain tried to force a man and woman to part with their cryptocurrency. Spanish police said the man was shot in the leg and he, along with his partner, were held captive for several hours while the criminals tried to access their crypto wallets. Eventually the woman was released but her partner remained missing, with his body later found in woodland. Five people were arrested in Spain in connection with the case while four others in Denmark were charged. There have been several similar cases in France including one when an attempted kidnap was captured on video. Another case in early 2025 saw David Balland, co-founder of Ledger, a cryptocurrency security company, abducted with his wife from their home in central France. Days later police rescued them - but Balland's finger was cut off during the extortion attempt. Then, last month, UK police arrested six people after masked men stopped a car travelling between Oxford and London and forced one of the occupants to transfer cryptocurrency valued at £1.5m. Phil Ariss, director of UK Public Sector Relations at blockchain intelligence firm TRM Labs, has previously said that criminal groups already comfortable with using violence to achieve their goals were always likely to migrate to crypto. "As long as there's a viable route to launder or liquidate stolen assets, it makes little difference to the offender whether the target is a high-value watch or a crypto wallet. "Cryptocurrency is now firmly in the mainstream, and as a result, our traditional understanding of physical threat and robbery needs to evolve accordingly."