Rapid7 counted the targets: 885,000 phone numbers, one fake wallet page
A security firm pulled the lid off a crypto phishing operation and found the size of the mailing list: 885,000 phone numbers. The prize at the end is the one thing your wallet tells you never to type into a website.
The cybersecurity company Rapid7 has published details of a crypto phishing campaign built around a very simple idea: message enough phone numbers, and some of the people holding them will own crypto. The list Rapid7 documented runs to 885,000 numbers. That is roughly the population of a mid-sized European city, every adult in it, messaged at once.
The message pushes people to a website that looks like their wallet provider. Same logo, same layout, same calm tone. The page asks you to "restore" or "verify" your wallet, which in practice means typing in your recovery phrase — the 12 or 24 words that are the wallet. Hand those over and the money is gone before you close the tab. Rapid7 gave the number of targets. Nobody has given the number of people who fell for it, and that is the figure that actually matters.
Think of it as cold-calling, except the phone bill is nearly zero and one success pays for the whole day. Phone number lists are cheap and have been traded for years after breach upon breach. The attacker doesn't know which of the 885,000 people owns crypto — that's the point. The message itself is the filter. Whoever panics and clicks has identified themselves.
What makes crypto worth the effort is the part your bank never lets you feel. Card fraud has a phone number you call, a form you fill, and a department whose whole job is to reverse things. A wallet has none of that.
There is no chargeback in crypto. That single missing feature is the entire business model of these people.
And this is where the story stops being about crypto. The same machinery — a bought list, a cloned page, a message that sounds like support — works on bank apps, delivery services, and tax refunds. Crypto is simply the version where the money leaves permanently. If you have ever wondered why scam texts feel like they arrived in industrial volume, it's because they did. 885,000 is one campaign, from one firm's research, in one snapshot.
Anyone with a wallet app on their phone and a few hundred in it — the first crypto most people under 30 ever buy sits exactly there, and it is the easiest money in the world to lose in ninety seconds. Also the people who bought some coins back in 2021, forgot about them, and would absolutely believe a message saying their wallet needs "verification" after all this time. And, quietly, everyone else on that list of 885,000 who has never touched crypto at all: they still got the message, which means their number is sitting in a database labelled worth trying.
Two things to watch. First, whether Rapid7 or the wallet companies being impersonated publish the fake domains — once names are out, browsers and registrars start blocking them, usually within days. Second, whether the same setup reappears under fresh domains a week or two later, which is what normally happens: the pages are cheap, the list is reusable. If wallet providers issue named warnings to their users, the campaign worked well enough to hurt. Silence usually means nobody counted.
No wallet app, ever, asks for your recovery phrase on a web page. Not for verification, not for a migration, not for support. If a page asks, the page is the attack — there is no second interpretation. Now go and look at the messages you deleted last week. Which brand did they pretend to be?
Sources: Rapid7 research disclosure on the phishing campaign; Cointelegraph, reporting on the findings.