Scams, hacks and payment fraud explained with data, along with the practices that protect the company, the wallet and Pix payments.
The main withdrawals in the Mercado Bitcoin hack occurred early on Nov. 2 across at least ten networks. The exchange says it froze $11.2 million and promises no customer will lose assets. Deposits and withdrawals remain suspended, with no date for resumption.
Binance reopened withdrawals for more assets and networks Tuesday (3), five days after the estimated US$ 6.3 billion hack. USDT on TRON was already in the first phase, on Nov. 1. The FBI blames North Korea, which denies responsibility.
Two April attacks, on Drift and Kelp DAO, made up almost 44% of the half-year's losses. CertiK's report shows wallet compromise and social engineering lead the damage.
Since February 2, 2026, every institution that operates Pix must follow the new Special Refund Mechanism. Scam money is now tracked beyond the first account, but recovery still depends on balance and speed.
Two December 2025 reports show a year among the worst for crypto theft, though it did not surpass 2022. The record belonged to North Korea, driven by the attack on Bybit.
An email from the “supplier” asking for new payment details is one of the costliest scams against companies. See how the fraud works, the FBI numbers and a verification protocol to apply before paying.
People who fall for a cryptocurrency scam often receive, days later, an offer to get their money back. That is the second scam. See how both work, what the FBI warned and how to react.
On September 8, 2025, 18 npm packages were infected with code that rewrites the destination of crypto transfers. The criminals earned little, according to early reports, but the attack shows why the address must be checked outside the website's screen.
Two months after the C&M Software case, a second Pix technology provider was breached through IT vendor credentials. On September 5, the Central Bank of Brazil answered with a R$15,000 per-transaction cap, minimum capital and mandatory authorization.
Legitimate credentials from an IT operator were used to send transfers from reserve accounts at the Central Bank of Brazil. Police cite R$541 million; other estimates reached R$1 billion.
The largest US crypto exchange told the SEC that criminals paid support agents to copy customer data and demanded US$20 million not to release it. The company refused and estimates a cost of up to US$400 million.
On February 21, attackers siphoned about 401,000 ETH from a Bybit cold wallet. Four days later, what is known is that the signers saw a fake screen, that North Korea is the main suspect and that the technical cause is still under investigation.
The wave of rumors about a supposed Pix fee ended with the announcement, on January 15, 2025, that the Revenue Service rule would be revoked, but left scammers with a ready-made script: fake messages and boletos in the tax authority's name. See what changed, what never existed and how not to fall for it.
The scammer does not break into the wallet. He plants in the victim's history an address that looks like the recipient's and waits for the wrong copy. In 2024, the trick took US$68 million in wrapped bitcoin and about US$129 million in USDT on TRON.