Thirty documented attack patterns observed against US-based crypto holders in 2024-2026. Each case describes the mechanism, names a representative loss, lists the defensive signals that would have caught it, and ends with the 30-minute recovery protocol if you have already been hit. The patterns repeat across years; the defenses stay the same.