Crypto scammers have stolen 25 billion rubles from Russians since the start of the year

Around crypto, the scams are not getting more sophisticated so much as more repeatable. The same playbooks keep working: fake arbitrage, “triangle” deals, cloned video calls, and phishing sites that swap real assets for worthless tokens.

1. One of the most durable schemes, according to the expert quoted in Izvestia, is pseudo-arbitrage in crypto chats. The pitch is simple: buy crypto on one platform for $1 and sell it on another for $1.2, pocketing a spread of about 20%. The first exchange is usually real, just enough to get the victim to complete the transaction through p2p exchange or conversion. The second is a phishing clone of a little-known platform in Russia, with a domain that looks almost identical to the original.
2. To lower suspicion, scammers let the victim withdraw a test amount of $10–15. When the victim tries to pull out a larger sum, one of two things happens: the account is blocked without explanation, or the transfer is said to have failed AML (anti-money laundering) checks, with the usual offer to “unlock” the funds by sending another transfer. That second transfer, naturally, also goes to the criminals.
3. Another scheme uses classifieds services and so-called “triangles.” The fraudster finds two victims at once: one is offered tech at an artificially low price, the other is offered to sell crypto at an inflated rate. They are then connected directly under the pretext of “avoiding the platform fee.” The first victim sends rubles to the crypto seller, and the seller releases the order on the exchange. The buyer ends up with no goods and no money, while the crypto seller can end up as the last link in the chain between stolen funds and the deceived buyer.
4. A third pattern involves stealing access through fake video conferences. Victims are found in topical chats where scammers already know they hold crypto, then invited to a call for a job interview, a technical issue, or a deal discussion. The link leads not to the official service but to a visually identical clone of Zoom, Google Meet, or Microsoft Teams. There the victim enters the login and password for a Google or Apple account. In 20–30 minutes, the attackers can get access to email, saved passwords, and two-factor authentication codes, then drain funds from connected services before the call even ends.
5. Another common route exploits trust in known crypto services. Users are redirected through the built-in browser of a crypto wallet to a phishing site with an address that is almost indistinguishable from the real one. They are offered a chance to place assets at interest. After the transaction is confirmed, the real funds go to the scammers, while the wallet shows fake tokens that look like USDT or USDC but were issued by a different smart contract. The balance looks real on screen; the tokens are useless off it, because no exchange will accept them.

Trezor, the hardware wallet maker, also recently said hackers compromised the system of an email service provider and used it for mass mailings. For PSPs and crypto businesses, the operating lesson is boring but clear: the fraud usually begins far upstream from the final loss, and the first “normal” touchpoint is often exactly what makes the scam work.