Hackers no longer brute-force systems — they attack you, the person: Delta & Capital on crypto theft

Hackers no longer brute-force systems — they attack you, the person: why social engineering became the top cause of crypto theft

Social engineering is a fraud method where attackers rely not on system or smart-contract vulnerabilities but on human trust, panic, and carelessness, inducing victims to voluntarily leak seed phrases, verification codes, or sign malicious approvals. In crypto, it has replaced technical vulnerabilities as the top cause of asset theft.

Many theft cases look on the surface like a wallet problem or an exchange problem, but the root cause is mostly the same thing — social engineering.

It doesn't brute-force systems technically; it exploits human trust, panic, greed, or carelessness to induce users to voluntarily surrender accounts, verification codes, seed phrases, or even personally sign a malicious approval. Compared with cracking passwords or attacking servers, attacking the person is often easier and more likely to succeed.

From Delta & Capital's technical team's review of many theft cases: in most wallet and exchange theft cases, the root cause is not a blockchain or smart-contract flaw but the attacker's exploitation of human nature. Industry data confirms this — per Verizon's 2025 Data Breach Investigations Report, about 60% of security incidents involve a human element, and about nine in ten of all breaches relate to phishing and other social-engineering methods; Chainalysis's 2025 Crypto Crime Report shows crypto-scam-related losses that year reached about $17B, and the FBI IC3 annual report also records substantial figures.

1. Why are crypto users more likely to become targets?

Digital assets have three distinct traits: irreversible transfers, fast cross-border movement, and fully self-custodied private keys.

Once assets leave the wallet, you can hardly stop payment as with a bank card. This means an attacker who fools a user just once can often take all the assets. Precisely for this reason, attackers are willing to invest heavily in cultivating a person's trust — the payoff is high enough and nearly irreversible.

Many recent wallet-theft events exploited not blockchain flaws but user trust. Many attacks have no technical barrier at all: register an avatar and handle identical to the official one, build a high-fidelity fake site, buy a few social ads, and you can find targets in Telegram, Discord, and WeChat groups.

At a glance: traditional hacking vs. social engineering

2. The real starting point of social engineering is often a person actively approaching you

This is the vigilance ordinary users most need to build: social engineering usually begins not with a link, but with a person.

It's that overly enthusiastic support agent who adds you first; that "teacher" in the group who guides you to profit and treats you with special care; that new friend of a few weeks who seems to understand you especially well; even a perfectly normal-looking partnership invitation. They won't ask for money upfront — they first approach, show goodwill, and build trust, then at a moment you've let your guard down, manufacture tension and push you step by step toward that final action.

Psychology research breaks this down into repeatedly exploitable compliance principles: authority (impersonating officials, law enforcement, or security teams), urgency and scarcity (limited-time airdrops, account about to be frozen), reciprocity and commitment (giving you small favors or letting you profit a little first), and social proof (everyone in the group flaunting gains). Recognizing them is the most effective first line of defense for ordinary people.

The core in one line: the more actively someone contacts you, the more enthusiastic, and the more they manufacture a "do it now or it's too late" urgency, the more it's worth stopping to think one layer deeper — why now? why me? why so urgent?

3. The most common types of social engineering in crypto

In anti-fraud and case-assistance practice, Delta & Capital finds the vast majority of cases fall into these types:

Fake support / official impersonation. The most common today. Scammers impersonate exchanges, wallet officials, security teams, even project teams, contacting you first — "account anomaly detected", "suspected high-risk transaction needs identity verification", "system upgrade requires re-binding the wallet" — then send a high-fidelity phishing site guiding you to enter the seed phrase, or induce a WalletConnect connection and a malicious approval signature. Once the seed phrase leaks even once, wallet control is already handed over.

Fake airdrops / approval phishing. "Free" is the human weakness scammers love most. They post so-called official airdrops on X, Telegram, and Discord — click the link, connect the wallet — but the real danger is not connecting the wallet, it's the approval transaction they ask you to sign next. Many malicious contracts request unlimited approval; once confirmed, the attacker can drain your wallet's tokens anytime. Many victims only discover assets gone when checking the balance days later.

Fake investment mentors / pig-butchering. Especially frequent in bull markets. Scammers stage luxury cars, profit screenshots, and trading records, invite you into a VIP group where everyone flaunts trades daily. Once trust is built, they recommend "insider" projects, copy-trading platforms, or fake exchanges. Early on they may even let you profit a little and withdraw small amounts; as you invest more, the platform suddenly can't withdraw, support vanishes, and the site shuts down.

Fake plugins / fake wallets. Attackers make wallet plugins or apps with nearly identical names and logos, even buying ads to rank first in search results. You download, install, and enter the seed phrase to restore the wallet — and your assets are silently controlled in the background. Such malicious apps sometimes masquerade as genuine, with tens of thousands of downloads.

Hijacked official accounts. More and more attackers directly steal the social accounts of well-known projects and KOLs to post limited-time mints and emergency airdrops. Users see a familiar official handle, connect their wallet without doubt, and lose assets minutes later — many learn only afterward that it wasn't the project scamming them, but the official account already being controlled.

4. AI is industrializing social engineering

Delta & Capital's technical team warns that the most alarming change in 2026 is how AI drastically cuts the cost and barrier of fraud.

With deepfakes, attackers can mass-generate videos of celebrities or exchange executives shilling coins or running giveaways, and forge the voice and video calls of your acquaintances. Per identity-verification firm Sumsub, deepfakes already account for about 11% of global fraud methods; CertiK data shows that in just the opening months of 2026, verified losses from AI-deepfake giveaway scams reached about $577M, with a single social-engineering attack's maximum loss once as high as about $284M. Meanwhile, wallet drainer-as-a-service tools spread on Telegram.

5. Even large platforms can become a social-engineering breach point

Social engineering's attack surface isn't just individuals. A widely discussed industry case shows: attackers didn't breach the exchange's technical systems but bribed offshore outsourced support staff, using their legitimate access to steal the personal information of about 69,000 users (names, contacts, partial ID information, etc., publicly disclosed in 2025), then using this information to launch precise secondary social-engineering scams against users.

This case gives ordinary users two takeaways: first, once your identity information leaks, scams targeting you appear especially credible — they can accurately state your name, holdings, even recent operations; second, the more an active contact seems to know your information, the more you should raise vigilance — verification via official channels always comes first.

6. The correct action checklist after an incident

Many people's first reaction upon finding funds transferred out is to keep refreshing the balance. In fact, the earlier you act, the higher the chance of preserving useful leads. Combining Delta & Capital's experience assisting many cases, we suggest handling in this order:

Save all evidence: chat logs, emails, texts, phishing-page screenshots;

Fix on-chain information: the stolen wallet address, transaction hashes, approval records;

Record the timeline: when funds first flowed out, and the addresses they subsequently passed through;

Revoke suspicious approvals and move remaining assets to a brand-new address that has never interacted with anything;

Report to the police immediately and keep the receipt — the prerequisite for starting judicial procedure;

If funds entered a centralized exchange, file a risk report with the platform immediately. On-chain transactions are immutable. Even if attackers use bridges, DEXs, and mixers for multi-layer transfers to obscure the path, these operations still leave on-chain traces. Through fund-flow analysis and address association, continuously monitoring whether they enter identifiable nodes like exchanges preserves a time window and complete on-chain evidence for later platform assistance, police reports, and cross-border compliance communication. To stress: the chain shows where the money went, but whether it can be lawfully handled depends on the stolen funds' landing point, response speed, and judicial cooperation — no guarantee exists.

7. Summary

Many victims, recalling how they were scammed, say one thing: "It felt completely normal at the time." Because scammers never ask for money at the start — they first build trust, then manufacture tension, then guide you step by step through the operation.

So when you encounter an actively contacting support agent, receive an airdrop link, are asked to enter a seed phrase, are asked to sign an unfamiliar approval, or are rushed to transfer immediately, you should stop and confirm one more time. In the digital-asset world, scammers often study people faster than they study code. Wallets can be upgraded, systems patched, security software updated — but human vigilance is always the most important line of defense protecting assets.

Key concepts at a glance

Social engineering: rather than attacking system vulnerabilities, it exploits human trust, panic, and carelessness to induce voluntary information disclosure or dangerous actions.

Approval phishing: inducing a user to sign an approval (especially unlimited approval) in a DApp, so assets can be legally drained without the private key ever leaking.

Unlimited approval: granting a contract unlimited permission to move one of your tokens — the core entry of approval-type theft.

Deepfake: AI-generated, convincingly realistic audio/video, often used to impersonate celebrities, officials, or acquaintances for fraud.

Drainer-as-a-service (DaaS): packaging wallet-theft tools into cheap subscription services, drastically lowering the fraud barrier.

Mixer / bridge: used to sever or lengthen the source-destination correspondence of funds, significantly raising tracing difficulty.

FAQ

Q: What is social engineering? How does it differ from hacking?

Social engineering doesn't attack systems — it attacks people, using trust, panic, and greed to induce you to surrender key information or sign malicious operations. It often needs no technical barrier, yet is currently the top cause of crypto theft.

Q: My private key wasn't leaked — why was my wallet still drained?

Most likely you were once induced to sign an approval (especially unlimited approval). With that approval, the attacker can move your coins within the allowance — no private key needed.

Q: A stranger added me and guides me to profit — how do I tell if it's a scam?

Beware any combo of active contact, letting you profit a little first, then manufacturing urgency. Anything asking you to enter a seed phrase, sign an unfamiliar approval, rush a transfer, or guaranteeing stable high returns is almost certainly a problem.

Q: What should I do first after a theft?

Save all evidence, fix wallet addresses, transaction hashes, and approval records, revoke suspicious approvals and move remaining assets, and report to the police as soon as possible; if funds entered an exchange, file a risk report with the platform. The earlier you act, the better.

Content support: this article is provided with on-chain security and anti-fraud educational support by the Delta & Capital technical team. Delta & Capital focuses on blockchain data analytics and compliance-technology research, with core capabilities spanning on-chain transaction tracing and fund-flow analysis, on-chain forensics and recovery, KYT/AML real-time risk control and address-risk identification, KYT/SOW (source-of-funds proof) tracing and reconstruction, cross-chain and multi-asset fund-path restoration, and appeal/lifting support for CEX/DEX account restrictions, risk controls, and freezes.

Risk & compliance notice: this article is anti-fraud and investor-education content, not investment advice, and constitutes no guarantee of recovery or unfreezing. Digital-asset prices are volatile and high-risk — view rationally and guard against related risks; if assets are stolen or defrauded, report to police immediately and pursue rights through lawful channels, guarding against secondary scams under the guise of recovery or unfreezing.