Crypto
Home›Crypto›Market Structure›Rapid7 details Operation Asterix crypto phishing campa…
Rapid7 details Operation Asterix crypto phishing campaign
The campaign identified 5,576 Binance accounts matched to users for an attempted attack, and used fake Ledger, Trezor, and Exodus apps to target seed phrases.
Cybersecurity firm Rapid7 unveiled a crypto phishing campaign, Operation Asterix, designed to steal investors’ assets by redirecting victims to fake wallet provider websites. The firm said the operation targeted roughly 885,000 phone numbers across several countries.
Rapid7 reported that its findings included 5,576 accounts matched to users on the crypto exchange Binance that were queued for attack. The recovered logs also showed fake emails impersonating Crypto.com.
The largest directory of phone numbers contained 316,002 German mobile numbers, with additional lists covering regions including Hong Kong, Bulgaria, and the UK, as well as the US and Canadian fintech companies. Rapid7 said the campaign also incorporated Ledger related directories.
Rapid7 said attackers pushed fake apps impersonating Ledger, Trezor, and Exodus, aiming to obtain seed phrases. The firm added that victims were contacted through fake support emails and phone inquiries, and tied the broader wave of crypto losses in early 2026 to phishing and social engineering scams, citing Hacken for $306 million of $482 million lost in the first quarter.