The Growing Danger in the Crypto Space
The world of cryptocurrency has always been associated with financial opportunity, innovation, and the promise of decentralization. However, alongside the rise in adoption and valuation, there is a parallel and alarming surge in threats – both physical and digital – targeting crypto owners. In 2025, security experts warn that these risks have reached unprecedented levels, fueled by data leaks, organized cybercrime, and a disturbing rise in violent attacks.
From kidnappings over relatively small sums to highly coordinated global hacking operations, the message is clear: owning cryptocurrency now comes with risks far beyond market volatility. This year has seen a record number of targeted crimes against crypto investors, with perpetrators leveraging both brute force violence and cutting-edge cyber tactics to steal digital assets.
Physical Attacks Against Crypto Owners Reach New Heights
The Rise of “Wrench Attacks” and Violent Extortion
At the Baltic Honeybadger 2025 conference in Riga, Latvia, SatoshiLabs founder Alena Vranova sounded the alarm about a disturbing trend: the growing prevalence of so-called “wrench attacks” – a term describing the act of physically coercing someone into revealing their cryptocurrency private keys.
These are not sophisticated hacks or remote thefts. They are face-to-face, violent crimes, and the statistics paint a chilling picture. According to Vranova, 2025 is on track to double the record for the most physical crypto-related attacks in a single year. What’s even more shocking is that these attacks are not limited to Bitcoin millionaires or early adopters. Even small holders – people with as little as $6,000 in crypto – are being targeted.
Example: In several cases cited by Vranova, victims were kidnapped, tortured, and even murdered for holdings valued between $6,000 and $50,000.
How Data Leaks Are Fueling Violence
Vranova emphasized that a key driver behind these physical crimes is the massive leakage of personal information from centralized exchanges and crypto service providers. Many platforms, due to KYC (Know Your Customer) compliance, store highly sensitive data – names, home addresses, identification documents – which become gold mines for criminals when leaked.
Over 80 million crypto user identities have already been exposed, with more than 2.2 million records containing home addresses. This gives attackers a precise roadmap to their targets, making it easier to plan and execute violent crimes.
The Bull Market Effect on Crime Rates
A disturbing correlation has emerged: when Bitcoin prices rise, so do the attacks. During bull markets, the perceived value of holdings increases, and so does investor enthusiasm, making crypto owners more visible and more tempting to criminals.
This year’s spike in physical crimes has coincided with multiple high-profile data breaches. In May 2025, Coinbase disclosed a breach exposing home addresses and other personal details. A month later, Cybernews reported that databases with over 16 billion leaked credentials from platforms like Apple, Facebook, and Google appeared on the dark web.
Such leaks don’t just enable physical attacks; they also open the door to phishing campaigns, social engineering scams, identity theft, and targeted hacking attempts.
Digital Attacks: The Rise of “GreedyBear”
Koi Security’s Discovery of an Industrial-Scale Crypto Theft Operation
While physical attacks are alarming, the digital battlefield is equally dangerous. Cybersecurity firm Koi Security has uncovered a massive, multi-pronged cybercrime campaign that stole more than $1 million in cryptocurrency.
The operation, codenamed “GreedyBear”, is unlike traditional hacking groups. Instead of specializing in a single attack vector, GreedyBear combined malicious browser extensions, crypto-focused malware, and sophisticated scam websites into a coordinated, large-scale theft system.
Fake Browser Extensions Targeting Popular Wallets
The group created over 150 fake browser extensions posing as legitimate crypto wallets, including MetaMask, TronLink, Exodus, and Rabby Wallet. These were uploaded to official marketplaces, such as the Firefox add-on store, and passed security checks through a technique called Extension Hollowing.
Initially harmless, the extensions built a reputation with positive reviews – until they were later modified to harvest wallet credentials directly from unsuspecting users. This allowed GreedyBear to bypass early detection while infiltrating thousands of devices.
Crypto-Focused Malware Distribution
In addition to browser attacks, the group deployed close to 500 malware samples designed to target cryptocurrency users. These included:
- LummaStealer – A credential-stealing malware explicitly designed to capture wallet information.
- Luca Stealer – A ransomware variant demanding cryptocurrency payments.
Much of this malware was spread through Russian websites offering cracked software or pirated applications, a common lure for unsuspecting victims.
Professional-Level Scam Websites
The third component of the campaign was a network of polished scam websites mimicking legitimate crypto products, hardware wallet vendors, and wallet recovery services. Unlike typical phishing pages, these sites had high-quality designs, marketing copy, and branding, making them appear trustworthy even to experienced users.
A central command-and-control server coordinated all operations, handling credential collection, ransomware distribution, and scam deployments. Investigators even found AI-generated code, suggesting the attackers were using automation to scale and diversify their attacks quickly.
Expert Warnings and Defensive Measures
Security Experts Call for Stronger Defenses
Koi Security researcher Tuval Admoni described GreedyBear as a paradigm shift in crypto theft, warning that more cybercrime groups will adopt multi-vector strategies. Cyvers CEO Deddy Lavid stressed the urgent need for:
- Stronger vetting of browser extensions by vendors
- Greater transparency from developers
- User vigilance against both physical and online threats
How Crypto Owners Can Protect Themselves
Given the scale of both physical and digital risks, experts recommend:
- Limit KYC Exposure – Use decentralized exchanges (DEXs) or services that require minimal personal data.
- Secure Storage – Keep the majority of assets in cold storage hardware wallets stored in secure, undisclosed locations.
- OPSEC Practices – Avoid publicly revealing crypto holdings or transaction details.
- Personal Security – Implement home security systems, avoid predictable routines, and be cautious about meeting strangers for OTC trades.
- Digital Hygiene – Regularly audit installed browser extensions, use antivirus software, and avoid downloading from unverified sources.
A New Era of Crypto Security Threats
The cryptocurrency ecosystem is entering a phase where threats are more complex, coordinated, and ruthless than ever before. The convergence of large-scale data breaches, violent physical crimes, and industrial-level cyberattacks means that every crypto owner, regardless of wealth, needs to take security seriously.
Owning digital assets in 2025 is not just about portfolio management and market timing – it’s about staying alive and keeping your identity and property safe. The tools and tactics used by attackers are evolving fast, and without proactive defenses, the consequences can be catastrophic.
