Rapid7 Uncovers ‘Operation Asterix’ Targeting 885,000 Crypto Investors Globally
A major phishing campaign discovered by Rapid7 targeted hundreds of thousands of phone numbers across multiple countries, attempting to redirect crypto investors to fake wallet sites and steal their digital assets.
Major cryptocurrency phishing campaign Operation Asterix has been exposed by cybersecurity firm Rapid7, targeting approximately 885,000 phone numbers spread across several countries in a coordinated effort to steal investor assets. The campaign focused on redirecting users to counterfeit cryptocurrency wallet provider websites, with particular emphasis on compromising accounts across major exchanges. According to Rapid7, the operation successfully identified and staged 5,576 Binance accounts for attack, while also uncovering fraudulent emails impersonating Crypto.com.
The campaign’s geographic reach was substantial, with Germany bearing the largest brunt at 316,002 targeted mobile numbers, supplemented by victim lists from Hong Kong, Bulgaria, the United Kingdom, the United States, and Canadian fintech firms. Additional datasets specifically targeted Ledger wallet-related contacts.
Attack Vectors and Sophistication
Rapid7 researchers Anna Sirokova and Jan Recinsky detailed how Operation Asterix employed multiple attack vectors to compromise victims. The campaign leveraged spoofed applications mimicking legitimate hardware wallet providers including Ledger, Trezor, and Exodus, designed to trick users into surrendering their seed phrases. Victims were contacted through what appeared to be official support communications—both via fabricated emails and direct phone inquiries—before being directed to the malicious platforms. Notably, the attackers employed artificial intelligence tools as a central component of their phishing infrastructure.
The campaign demonstrated a measurable success rate, with researchers matching 43,066 cryptocurrency user accounts to legitimate exchange profiles from the larger German dataset alone, representing approximately a 13.6% hit rate. Investigators also uncovered a validation checker configured to bulk-verify phone numbers against Kraken accounts, suggesting broader targeting capabilities across the exchange ecosystem.
A Long-Standing Industry Challenge
Phishing and social engineering attacks continue to represent the cryptocurrency industry’s most persistent vulnerability. According to blockchain security firm Hacken, these tactics drove $306 million in losses during the first quarter of 2026—representing more than 63% of the total $482 million in crypto losses that quarter. This pattern reflects the reality that attackers often bypass sophisticated protocol defenses by exploiting human psychology and trust rather than technical weaknesses.
Recent incidents highlight the evolving nature of these threats. Wallet provider Trezor recently disclosed a breach affecting approximately 14,000 customers through its shipping provider ShipMonk. Earlier, fraudulent wallet applications—including a counterfeit Ledger Live app distributed through the Microsoft Store—resulted in nearly $588,000 in combined theft. These incidents, combined with Operation Asterix’s scope, demonstrate that even established brands remain vulnerable to impersonation. A May phishing campaign impersonating Uniswap through malicious Google advertisements resulted in over $400,000 in losses, while industry leaders including Binance co-founder Changpeng Zhao have called for improved wallet security standards.
Operation Asterix exposes fundamental vulnerabilities in protecting cryptocurrency users against sophisticated social engineering, reinforcing that enhanced security practices and careful verification of official channels remain critical for safeguarding digital assets and driving mainstream crypto adoption.
Source: Rapid7, via Cointelegraph. Not financial advice.