Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁
SlowMist Warns of Rising Crypto Scams Targeting Panic and Trust
Key Takeaways
- Scammers are shifting from technical hacks to psychological tricks that target stressed or rushed users;
- A fake Chrome extension and tampered downloads from trusted sites were used to steal sensitive data;
- Fraudulent wallets and copycat websites led to major losses, including $6.5 million from one TikTok-promoted device.
SlowMist, a blockchain security firm, reported a rise in scams during the second quarter of 2025, with attackers focusing less on technical skill and more on manipulating user behavior.
According to SlowMist’s head of operations, Lisa, the tactics have become more effective by targeting how people respond under stress or urgency.
One example is a Chrome add-on called "Osiris" that claims to detect phishing and suspicious websites, but it quietly replaces downloaded files such as .exe, .dmg, and .zip with harmful ones.
Did you know?
Subscribe - We publish new crypto explainer videos every week!
Candlesticks, Trendlines & Patterns Easily Explained (Animated Examples)
These downloads often originated from popular platforms like Notion or Zoom, and although the browser indicated that the files came from official sources, they had already been tampered with.
Once opened, the software searched the victim’s computer for sensitive information, including browser data and macOS Keychain contents.
Another type of scam targeted crypto hardware wallet users. In one case, a person lost $6.9 million after buying a wallet promoted on TikTok. Others purchased wallets that had already been activated by attackers, which drain funds as soon as the new owner makes a deposit.
SlowMist also investigated an incident involving a fake version of Revoke Cash, a tool that helps users cancel crypto wallet permissions. This fraudulent website looked identical to the real one but asked visitors to enter their private key.
SlowMist discovered that the site used EmailJS to send any entered data, including wallet addresses and private keys, straight to the attacker’s email inbox.
Recently, TRM Labs reported that approximately $2.1 billion in crypto was stolen during the first half of 2025. How? Read the full story.