Rapid7 uncovered 5,576 Binance accounts queued for attack and 316,002 German phone numbers with a 13.6% hit rate against exchange accounts in Operation Asterix.
A phishing campaign targeting crypto users across multiple countries amassed nearly 885,000 phone numbers and had 5,576 Binance accounts queued for attack before researchers caught it.
Rapid7 analysts Anna Sirokova and Jan Recinsky uncovered the operation, which they named Operation Asterix. The largest batch of numbers came from Germany – 316,002 mobile numbers, with a 13.6% hit rate against exchange accounts, the researchers said. That means roughly one in seven numbers on the German list belonged to a verifiable crypto user.
Attackers built fake versions of Ledger, Trezor, and Exodus wallet apps, the report said. Victims were approached through fake support emails or phone calls. Once a target downloaded a counterfeit app, it stole seed phrases. Handing over a seed phrase drains the wallet with no recovery path.
The campaign also included a checker tool built specifically for Kraken, per the Rapid7 findings. The tool validated phone numbers against actual exchange accounts, letting attackers confirm which numbers belonged to active Kraken users before attempting a targeted attack.
AI tools played a role in the campaign, the researchers said. Attackers used them to generate fake support emails at scale, bulk-validate datasets, and streamline the targeting process.
The campaign's scope extends beyond Binance. The researchers found directories covering Hong Kong, Bulgaria, the UK, the US, and Canadian fintech companies, along with lists tied specifically to Ledger wallet users. Crypto.com was also being impersonated, per the logs Rapid7 pulled.
The crypto industry has been bleeding from phishing for years. Trezor disclosed a breach in August involving 14,000 users' data, tied to a compromise at logistics firm ShipMonk. In July, a single phishing token approval on Ethereum cost one investor nearly $1 million. A fake Ledger Live app that made it onto the Microsoft Store resulted in $588,000 stolen across 38 transactions before it was taken down.
Phishing and social engineering scams accounted for $306 million out of $482 million in total crypto sector losses in the first quarter, per blockchain security firm Hacken.
The German dataset's 13.6% hit rate is the most telling number in the report, the researchers said. It suggests attackers are getting better at filtering for real targets.
Rapid7 analysts did not respond to requests for more details on the campaign's target filtering and specific vulnerabilities by time of publication.
Prepared with AlphaScala editorial tooling from the source reporting linked above. Indexable analysis may include a cited Alpha Score value. Publishing checks screen each story before release. Educational coverage, not personalized advice.