There is one incident here so far. How to recognize each kind of phishing, and what to do in what order after being scammed, is covered in 13 Crypto Phishing Scams and How to Spot Them. That page is organized by how the scam reaches you (fake support, approval pop-ups, Permit signatures, fake apps and extensions, search ads, hardware wallets, pig butchering and more), with checks and official sources for each.
Incidents covered
- Altered Code on the Signers' Page Cost Bybit's Cold Wallet $1.46 Billion
On February 21, 2025, assets were moved out of one of Bybit's Ethereum multisig cold wallets during a routine transfer. The investigations pointed to altered JavaScript in the Safe{Wallet} web page the signers had open. Based on Bybit's official timeline, Sygnia's investigation report and the FBI IC3 announcement; the last section covers what an individual should check on a hardware wallet's screen.
Which incidents get a write-up
An incident has to meet two conditions: the party involved, an investigator or a law enforcement agency has published primary material on it, and that material is enough to explain what happened without guessing at the gaps. Incidents known only from rumor or second-hand accounts are left out.
If a write-up here gets a fact wrong, tell me through the corrections page.