What Is Social Engineering in Crypto and How Can You Spot It?

Social engineering is important to recognize because one convincing message, one wrong file, or one careless confirmation can be enough to give access to sensitive systems or crypto.

How serious the consequences can be is easy to see right now at Binance. On October 29, 2026, billions of dollars in crypto were moved out of the exchange's wallets. Binance is still investigating the incident and says a compromised laptop belonging to a DevOps engineer may have been the first point of access. According to Binance, the attacker may have used that laptop to access a service container and submit unauthorized withdrawal requests.

Binance currently estimates the total impact at about $6.3 billion. According to the exchange, about $3 billion in affected crypto has already been frozen on-chain. Binance says it has found no evidence that wallet private keys were leaked and says it will cover all losses with the SAFU fund and its own company funds with the SAFU fund and its own company funds. Deposits are working normally again, while withdrawals are still paused at the time of writing because of changes to the withdrawal infrastructure.

How the laptop was compromised exactly is still unknown. So there is no confirmation yet that phishing, a fake job posting, or another form of social engineering caused the attack. Still, the incident shows why attackers often target people and devices with a lot of access rights. One compromised account or device can open the door to much more important systems.

That is exactly what social engineering is about: not necessarily breaking technical security directly, but tricking a person into unknowingly giving access, sharing information, or carrying out a harmful action.

Key Takeaways

• Social engineering is about tricking people into sharing information themselves or carrying out a harmful action.
• Attackers try to get login details, verification codes, seed phrases, or private keys.
• A harmful transaction or token approval can also cause financial damage without the attacker knowing your seed phrase.
• The ongoing Binance hack shows how big the impact can be when a device or account with a lot of access rights is compromised.

What Is Social Engineering in Crypto?

Social engineering in crypto is manipulating people so they share sensitive information themselves or carry out a harmful action. That means the attacker does not always need to break in technically. Often, they try to convince you to open a link, hand over a code, send crypto, or confirm a wallet request yourself.

Think of a fake message from a crypto exchange, someone pretending to be an employee of a crypto wallet, or someone pretending to be a friend. The goal can be to get your login details, one-time verification code, seed phrase, or private key. An attacker may also try to get you to sign a harmful transaction or give permission to move tokens out of your wallet.

Phishing is a well-known form of social engineering. In that case, you might be lured to a fake website where you are asked to enter login details or other sensitive information. With self-custody, that is especially risky. Anyone who has your seed phrase or private key can effectively control the crypto in that wallet.

But an attacker does not always need your seed phrase to cause damage. With a harmful token approval, for example, you give a dApp or smart contract permission to move certain tokens out of your wallet. If you give that permission to a malicious party, those tokens may be taken from your wallet.

How Does Social Engineering Work in Crypto?

Social engineering works by combining a believable story with an action the attacker wants from you. That action may seem harmless, like opening a link or looking at a file, but it can ultimately give access to data, accounts, or crypto.

The first step is usually making contact. That can happen through email, text message, phone, social media, a fake website, or even a job posting. After that, the attacker tries to build trust or create urgency. Then comes the real request, for example to open software, share a verification code, send crypto, or sign a transaction in your wallet.

An attack can also target employees at crypto companies. In the DMM theft in 2024, for example, an attacker pretended to be a recruiter and used a malicious job test to gain access to systems at a company that worked with DMM Bitcoin. The full attack is discussed later as an example.

The principle stays the same: the attacker is not only trying to get around technical security, but first convinces a person to do something that creates access.

What Forms of Social Engineering Are Common?

Different forms of social engineering can be combined in the same attack. Someone pretending to be an exchange employee might first call you, then send a link, and then ask you to confirm a wallet request.

• Phishing: a fake message, often by email, for example with a link to a fake login page.
• Smishing: phishing through text messages or chat apps like WhatsApp and Telegram.
• Vishing: deception over the phone, for example by someone pretending to be customer support.
• Impersonation: someone pretends to be a crypto exchange, wallet provider, government agency, employer, public figure, or influencer.
• Investment and romance scams: an attacker builds trust over a longer period and then tries to get you to invest money or crypto through a fake platform.
• Airdrop and approval phishing: an offer of free tokens lures you to a fake dApp or tries to get you to sign a harmful transaction or token approval.
• Recruitment scams: a fake job posting, coding task, or job test is used to spread malware, steal data, or gain access to an account.

Free crypto sounds appealing. That is exactly why an unexpected airdrop or exclusive claim link is a moment to be extra careful about who sent it and where you are being sent.

How Are Trust and Urgency Misused?

Attackers often try to win your trust first by pretending to be someone you know or an organization that sounds reliable. Think of the customer support team of a crypto exchange, your bank, an employer, a friend, or someone you have built a relationship with online.

Then comes the pressure. For example, you may be told your account will be blocked, fraud has been detected, or you need to move your crypto to another wallet right away. The goal is to make you act before you check whether the story is true.

In crypto, that pressure often comes with a request to send crypto to a supposedly safe wallet, scan a QR code, share a verification code, or sign a transaction immediately. Guaranteed returns, free crypto, and unusually high profit claims are also clear warning signs.

An urgent message is not automatically fraud. But time pressure combined with a request for passwords, verification codes, seed phrases, private keys, crypto, or a wallet confirmation is a strong warning sign.

Well-Known Examples of Social Engineering in Crypto

Well-known attacks show that social engineering can go far beyond simple spam or a fake email. Sometimes an attacker targets employees at a crypto company for months to eventually gain access to internal systems.

A clear example is the DMM theft in 2024. An attacker pretended to be a recruiter on LinkedIn and contacted an employee at Ginco, a company that develops software for business crypto wallets. The employee was sent a malicious Python script that was presented as part of a job test.

After the attackers gained access to the employee's session data, they were able to break into Ginco's communication system, according to the FBI. That access was likely used to manipulate a legitimate transaction request from DMM Bitcoin. In the end, 4,502.9 BTC was stolen, worth about $308 million at the time. The FBI attributed the attack to TraderTraitor, a North Korean hacking group.

Another common pattern is approval phishing. In that case, you yourself sign a blockchain transaction that gives an attacker address or malicious smart contract permission to move certain tokens out of your crypto wallet. The transaction can be technically valid while you think you are confirming something else.

Example: You see an offer for free tokens and connect your crypto wallet to a website. Then a request appears asking you to confirm something. It looks like you are only activating the claim for the free tokens, but in reality you may be giving permission to move existing tokens out of your wallet.

That is why it is not enough to only check whether a website looks trustworthy. Always look closely at exactly which transaction or permission your crypto wallet is showing before you confirm.

The Ongoing Binance Hack of October 2026

A very recent example of how serious the impact of one compromised device can be is the Binance hack that became public on October 29, 2026. In the incident, billions of dollars in crypto were moved out of the exchange's wallets.

Binance is still investigating the attack. According to the first findings, a compromised laptop belonging to a DevOps engineer appears to have been the possible entry point. Through that laptop, an attacker may have been able to access a service container and submit unauthorized withdrawal transactions.

Binance currently estimates the total impact at about $6.3 billion. According to the exchange, about $3 billion in affected crypto has already been frozen on-chain with help from other parties in the crypto industry.

Binance says it has not found evidence so far that the private keys of its wallets were leaked. The company says customer funds are safe and that all losses will be covered by the SAFU fund and its own company funds.

Who exactly is behind the attack has not yet been definitively established by Binance. Blockchain intelligence firms such as TRM Labs do see strong signs of involvement by TraderTraitor, a North Korean hacking group that has also been linked to earlier major crypto thefts.

It is also still unknown how the DevOps engineer's laptop was compromised. So as of October 30, 2026, there is no confirmation that phishing, a fake job posting, or another form of social engineering was the first step in the attack.

So while social engineering has not yet been confirmed as the cause, the case is still relevant. The possible entry point is an employee device with technical access rights. If an attacker manages to take over such a device or account, that can eventually open access to much more important systems.

The situation is still developing. Binance has announced that it will publish a detailed technical investigation report once the investigation is complete. Deposits are working normally again, while withdrawals are still paused at the time of writing because of changes to the withdrawal infrastructure.

Why Are Crypto Users Vulnerable to Social Engineering?

Crypto users are vulnerable to social engineering because one wrong action can sometimes have immediate financial consequences. If someone gets your seed phrase or private key in self-custody, they can control the crypto in that wallet. And if you yourself confirm a crypto transfer or harmful approval, that action is usually not easy to reverse on the blockchain.

With traditional financial services, there are sometimes extra checks that can stop or investigate suspicious payments. With a self-custody transaction on the blockchain, there is usually no central party that can reverse your transaction afterward. That means an attacker may only need to convince you once to confirm the wrong action.

Web3 can make this even harder sometimes. Legitimate dApps regularly ask for a wallet connection, signature, or token approval. A malicious request can therefore look like something you normally see too. But connecting a wallet is not the same as signing a message, and a signature is different from a token approval or confirming a transaction.

Even after an initial loss, victims can remain targets. So-called recovery services may promise to get stolen crypto back and then ask for payment upfront. That can be a new form of fraud.

How Can You Spot a Social Engineering Attack?

You can spot a social engineering attack mainly by the combination of unexpected contact, an identity claim, urgency, and a request to do something. So do not look only at one sentence, profile picture, or logo, but at the whole request.

Treat any unexpected request to send crypto, connect a crypto wallet, scan a QR code, share a seed phrase, or give out a verification code as suspicious. The same goes for promises of guaranteed returns, fast risk-free money, free crypto, or an exclusive investment opportunity.

In Web3, also pay close attention to the type of request your crypto wallet shows. Connecting a wallet, signing a message, sending crypto, and giving a token approval are different actions. An approval can, for example, give a smart contract permission to move certain tokens out of your wallet.

Always verify a claim outside the message you received. So do not just open the included link, but go to the official app or website yourself.

What Signs Point to a Suspicious Message?

A suspicious message often has one or more of these signs:

• You get unexpected contact with a request for money, crypto, data, login details, or a transaction.
• Pressure is applied with lines like: "Your account will be closed now" or "Act within ten minutes."
• You are told to send crypto to a supposedly safe wallet.
• You are asked to scan a QR code to pay or secure your account.
• The link or domain name is slightly different from the official spelling.
• You are asked to install software, open an attachment, or run code.
• Your crypto wallet shows an unknown contract address, an unclear signing request, or an unusually high or unlimited allowance.
• A free airdrop claim appears out of nowhere.

Spelling or grammar mistakes can be a clue, but they are not a reliable test. Many attackers now use convincing text and professional-looking websites.

How Do You Check the Identity of a Contact?

Check the identity through a channel you looked up yourself, never through a link, QR code, or phone number from the suspicious message.

You can handle this step by step:

1. Stop responding. Do not click anything else and do not share codes or information. That keeps you from confirming something under pressure.

2. Look up the official channel yourself. Open the app you already use or type the official website address yourself. Then contact support through the official support channel.

3. Check the full domain name. A familiar brand name in a message does not mean much. Look at the full web address, because attackers often use domains that look very similar to the real one.

4. Call a known contact back yourself. If you get an urgent request from a friend or coworker, call a saved number you already knew instead of only replying in the same chat.

5. Never share secret information as a check. A real support agent does not need your seed phrase, private key, or password to verify your identity. Be very careful with verification codes too.

A verified badge on social media or a security warning in a crypto wallet can be helpful, but it is not a guarantee that someone or something is safe.

How Can You Protect Yourself Against Social Engineering in Crypto?

The best way to protect yourself is to always check who is contacting you and what exactly you are being asked to do before you act on any unexpected request. Make that a habit before you send crypto, connect a wallet, sign something, or confirm a token approval.

Go to crypto exchanges, crypto wallets, and dApps through an official address you saved yourself or checked yourself. Do not use ads, DMs, or unexpected links as your starting point.

For every transaction, check the network, receiving address, amount, and the type of action you are taking. With a token approval, also check which party gets permission and how many tokens they can use. Limit allowances where possible and regularly review old approvals. Simply disconnecting a dApp does not automatically revoke an existing approval.

Also use unique and strong passwords for your accounts, and especially protect the email address linked to your exchange account. Turn on multi-factor authentication wherever possible for email, exchange accounts, and other important accounts.

MFA makes account takeover harder if a password is stolen. A passkey or FIDO security key is more resistant to phishing than a manually entered verification code, where available. But even strong account security does not stop you from sharing a seed phrase yourself or signing a harmful blockchain transaction.

Why Should You Keep Seed Phrases and Private Keys Secret?

You should keep your seed phrase and private key secret because they can give access to the crypto in your wallet. A seed phrase often consists of 12 to 24 words and can be used to restore access to a wallet. With those words or with your private key, someone can control your wallet and send crypto.

Normally, you only need a seed phrase when creating or restoring your own wallet. Not because a support agent asks for it, not for a giveaway, and not to "validate" a wallet.

So never share these details through chat, email, screenshots, cloud notes, or an online form. Store them offline and in a place where others cannot access them.

A hardware wallet keeps your private keys offline and usually requires physical confirmation before you make a transaction. That offers extra protection against certain forms of malware and account takeover. Still, a hardware wallet cannot stop you from approving a harmful transaction yourself.

How Do You Use Transaction Verification and Multi-Factor Authentication?

Use transaction verification by reading every wallet request before you hit confirm. Check the network, the receiving address, the amount, and especially what kind of action you are taking: connecting, signing, sending, or giving a token approval.

With a token approval, you give a dApp or smart contract permission to move a certain token up to a certain limit on behalf of your wallet. An unlimited allowance can increase the damage if you gave that permission to a harmful or compromised party. So where possible, choose a limit that matches what you actually want to do.

Wallet warnings and transaction simulation can flag suspicious domains, addresses, or transaction data. Treat them as an extra layer of checking. A technically valid transaction can still be harmful if it does not match what you meant to do.

Turn on MFA for your email and crypto exchange account. Two-factor authentication, or 2FA, is a form of MFA that uses two different authentication factors. An extra verification step helps against account takeover, but manually entered one-time codes can still be intercepted through phishing. So where possible, choose a phishing-resistant method like a passkey or FIDO security key.

What Can You Do After a Social Engineering Attack?

Stop responding to the attacker immediately and act as quickly as possible through safe channels you have checked yourself. Do not use links, phone numbers, or recovery offers from messages sent by the attacker.

Take it step by step:

1. Cut off contact: Do not respond anymore, do not click anything, and do not give any extra information.

2. Secure your accounts: Change compromised passwords, secure your email account, and replace or strengthen your MFA if needed.

3. Contact the involved party: Reach out to the crypto exchange, wallet provider, or other account provider through an official channel you looked up yourself.

4. Check token approvals: Did you confirm a suspicious wallet request? Then see whether you can revoke existing allowances. Disconnecting a dApp is not enough to remove an existing token approval.

5. Save evidence: Take screenshots and note messages, domains, phone numbers, profiles, wallet addresses, amounts, date, time, and transaction hashes.

6. Report the fraud and file a police report: Wallet addresses and transaction data can be important evidence, even if the theft has already happened.

After that, stay extra alert for recovery scams. Someone who promises to get your lost crypto back and asks for payment upfront may be trying to scam you again. Revoking an approval can limit future misuse of that permission, but it does not reverse a blockchain transaction that has already been completed.

Conclusion

Social engineering in crypto ultimately comes down to one thing: someone is trying to get you to do something you normally would not do. That could be sharing a seed phrase, sending crypto, giving out a code, or confirming a wallet request you do not fully understand.

The best defense is not just technical security, but checking before you act. Verify contacts through an independent channel, use strong account security, and read every transaction request before you confirm it.

Especially with seed phrases, private keys, and token approvals, the rule is simple: if you do not understand what access or permission you are giving, do not confirm the request.