Public discussions about cryptocurrency fraud often focus on phishing messages, fake investment platforms and scams promoted through social media. But a new analysis by an Israeli blockchain intelligence company suggests that the biggest financial losses increasingly come from a different type of attack: criminals gaining direct access to victims’ digital wallets.
According to an analysis of 1,034 cryptocurrency fraud cases conducted by Lionsgate Intelligence Network, wallet compromises accounted for 34.5% of cases involving losses of more than $1 million, nearly twice their share across the company’s broader dataset.
Wallet compromises accounted for 34.5% of cases involving losses of more than $1 million
(Photo: Chris Ratcliffe/Bloomberg)
The company said the findings indicate that sophisticated attackers targeting high-value victims are increasingly moving away from traditional investment scams and focusing on taking control of digital assets directly.
Lionsgate Intelligence Network, a Jaffa-based blockchain forensics and financial intelligence company founded by former Israeli Military Intelligence Unit 8200 veteran Bezalel Eitan Raviv, said it supports victims and assists investigations involving cryptocurrency theft, money laundering and digital asset tracing.
The company says it works with U.S. law enforcement-related investigations, including cases involving agencies such as the FBI, U.S. Secret Service, Homeland Security Investigations and IRS Criminal Investigation.
The findings are based on more than 1,000 victim reports submitted to the company during 2026, but Lionsgate stressed that the data reflects cases brought to its forensic team and should not be viewed as representative of all global cryptocurrency crime.
Million-dollar losses reveal a different threat
The analysis found that while fake investment platforms remain the most common type of crypto fraud overall, the pattern changes dramatically when looking at larger losses.
In high-value cases, attackers increasingly use methods such as stealing private keys or recovery phrases, compromising accounts, impersonating trusted services or tricking victims into approving malicious blockchain transactions.
Once attackers gain access, funds can often be transferred within seconds through a network of wallets, exchanges, mixers and cross-chain bridges designed to make tracing more difficult.
“The public still associates cryptocurrency crime primarily with phishing messages or fake investment opportunities on social media,” Raviv said.
“That perception may accurately describe large-scale consumer scams, but it is not what we encounter when working on multi-million-dollar cryptocurrency investigations. The most sophisticated criminal organizations increasingly focus on gaining direct control of digital wallets.”
Delayed reporting hurts recovery efforts
The company also highlighted a challenge facing investigators: many victims wait too long before seeking help.
According to Lionsgate’s analysis, only 35.5% of individual victims sought forensic assistance within three months of the theft, while 45.8% waited a year or longer before reporting the incident.
The company said delays can make recovery more difficult because stolen assets are often quickly moved between multiple blockchain addresses and services.
“We provide actionable blockchain intelligence in near real time, allowing investigators and victims to respond before organized criminal networks can move or cash out stolen assets,” Raviv said.
Companies face wider risks
The report said attacks targeting employees, executives or other key personnel can create consequences beyond the immediate financial loss.
Such incidents may lead to operational disruption, forensic expenses, legal costs, regulatory obligations and potential insurance issues related to cybercrime and financial fraud.
Lionsgate said it has analyzed more than 7,000 cryptocurrency fraud investigations since its founding in 2022 and currently monitors more than $1.5 billion in suspicious digital assets each month.
The company said approximately 95% of those assets have not been reported to law enforcement or identified by relevant platforms as malicious.
“Every victim carries a unique intelligence dataset,” Raviv said. “When combined, these insights can help expose criminal networks, disrupt illicit financial flows and support asset recovery efforts.”
A changing crypto crime landscape
The company argues that public awareness has not kept pace with the evolution of cryptocurrency crime.
While scams involving fake investments and social engineering remain widespread, Lionsgate said criminals are increasingly using artificial intelligence and open-source intelligence techniques to identify and target valuable victims.
The result, according to the company, is a shift toward more personalized attacks designed to gain direct access to the digital wallets where large amounts of cryptocurrency are stored.