A $572K phishing ring shows how crypto really gets stolen — and how to spot it

Belgian police have arrested a 19-year-old accused of helping run a European phishing network that stole more than 500,000 euros (about $572,000) by impersonating government officials, then laundered the money through crypto. The case is a useful reminder that most crypto theft doesn't break the code — it tricks the person.

The scam worked like this: fake government emails and phone calls pressured victims into installing remote-access software, which handed control of their devices to the attackers. Investigators found suspects in an Antwerp Airbnb, and the network used money mules and cash carriers before moving proceeds through cryptocurrency. The investigation began in March 2026, and a judge has issued an arrest warrant.

Seen in the bigger picture, phishing and social engineering are the leading cause of crypto losses. Of the $482 million stolen in the first quarter of 2026, about $306 million came from phishing and social-engineering attacks, according to security firm Hacken. Attackers target human behavior, not the protocol itself.

There are plenty of recent examples. On May 25, scammers ran malicious Google ads impersonating the decentralized exchange Uniswap and stole more than $400,000; DeFiLlama says fake Google ads are a common phishing source. CertiK links phishing to North Korea-tied hackers, and even the $600 million Ronin Bridge hack in 2022 started with a fake LinkedIn recruiter and a malware-laden PDF.

For a beginner, a few habits stop most of this. No real agency or exchange asks you to install remote-access software or read out a code. Type exchange and wallet addresses yourself instead of clicking ads or search results. Never share your seed phrase or approve a transaction you don't understand, and slow down when someone creates urgency — that pressure is the attack.