Crypto phishing remains a risk for Canadians who use digital-asset wallets, exchanges or investment services. CoinMarketCap reported on October 10, 2026, that the US, UK and Canada froze $12 million in cryptocurrency in a phishing operation; that report does not say that individual losses will automatically be returned.
What crypto phishing looks like
Crypto phishing is a form of deception designed to get someone to reveal sensitive information or approve an action that gives another person access to a crypto account or wallet. A message may pretend to come from an exchange, wallet provider, investment service or someone the recipient knows. The real company or person being impersonated is not necessarily involved.
The message might arrive by email, text, social media, a messaging app or a phone call. It can claim there is a security problem, a payment waiting, an account restriction or an urgent investment opportunity. It may direct the recipient to a look-alike sign-in page, ask them to connect a wallet to a site, or tell them to share a password, verification code or wallet recovery phrase.
Crypto phishing can also involve a link or attachment that leads to a fake service or harmful software. A message may ask you to approve a wallet transaction without making clear what permissions you are granting. Once someone has shared access details or approved a transaction, it may be difficult or impossible to reverse a transfer.
CoinMarketCap’s report says authorities in the US, UK and Canada froze $12 million in cryptocurrency in connection with a phishing operation. That is a reported action, not a promise of reimbursement to people who may have lost money. If you are contacted about a recovery or refund, verify the claim independently: people who have already lost funds can be targeted again with false promises of getting them back.
Red flags in a crypto wallet phishing attempt
- Unexpected urgency: A message pressures you to act immediately to stop a supposed account closure, security breach or missed opportunity. Pause and contact the service using details you find independently.
- A request for secret information: Treat requests for a password, verification code, private key or wallet recovery phrase as a serious warning. Do not share these details with a person who contacts you.
- Links that take you to a sign-in page: A convincing-looking page may still be controlled by someone else. Avoid signing in through a link in an unexpected message; open the official app or type the service’s known address yourself.
- Pressure to connect or approve: Be cautious if a site tells you to connect your wallet, sign a message or approve a transaction before you can see what it does. Stop if you do not understand the request.
- Unexpected verification codes: A code arriving when you did not try to sign in may mean someone is attempting to access your account. Never read the code to a caller or send it in a reply.
- Unusual payment instructions: A demand to move cryptocurrency to a “safe” wallet, pay a fee to unlock funds or send a test transaction should be independently checked before you do anything.
- Promises of guaranteed returns or recovery: Be wary of claims that an investment cannot lose or that someone can retrieve crypto for an upfront payment. Do not rely on a stranger’s assurances.
- Small differences in names or addresses: Lookalike account names, web addresses and contact details can be easy to overlook. A familiar logo or profile picture does not prove a message is genuine.
What to do after a cryptocurrency phishing scam
- Stop interacting with the contact. Do not reply, open more links, download files or send more money. If you are still on a suspicious page, close it. Do not use contact details supplied in the message to check whether it is legitimate.
- Contact your exchange or wallet provider through an official channel. Use the app or contact information you locate independently. Explain what happened and ask what steps are available to secure the account. If you can still access it, change its password from a trusted device and review account security settings.
- Protect accounts that share information. If you reused the password elsewhere, change it on those accounts too. Turn on available multi-factor authentication, and secure the email account connected to your crypto services. Do not share new verification codes with anyone.
- If you shared a recovery phrase or private key, treat the wallet as exposed. Contact the wallet provider through a verified channel for guidance. Do not enter the phrase into a site or app suggested by the person who contacted you. A new wallet may be appropriate, but get trusted guidance before moving any remaining funds.
- If you approved a transaction, record what happened. Keep messages, emails, transaction details, wallet addresses, dates and screenshots. Do not delete the conversation or send funds to someone claiming they need a payment to trace or release your crypto.
- Tell your bank if banking details or money were involved. Contact it promptly using the number on your card or its official website. Ask whether it can secure the account, block a payment or advise you on next steps. If you paid by another method, contact that payment provider as well.
- Check your devices carefully. If you installed software or opened an attachment at the contact’s direction, stop using that device for financial activity until you have taken steps to check and secure it. Change important passwords from a separate, trusted device.
- Be cautious of follow-up approaches. Someone may claim to be a recovery service, investigator or official and offer to retrieve lost cryptocurrency for a fee. Do not provide access to your wallet or pay an advance charge without independently verifying who you are dealing with.
How to report it
Report suspected crypto phishing to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or by phone at 1-888-495-8501. You can report even if you did not lose money; include the contact method and any details you safely kept.
Contact your local police service, particularly if you lost money, your identity was misused or someone gained access to an account. Give police the records you kept and note any transaction details. If money or banking information was involved, contact your bank promptly as well.
For cryptocurrency, also notify the exchange or wallet provider through its official website or app. A report to a provider or authorities cannot guarantee that funds will be recovered, but timely, accurate information can help them assess the account and document what happened.
To check general Canadian cyber-safety guidance, visit the Canadian Centre for Cyber Security at cyber.gc.ca. When in doubt, end the conversation and reach the organization through a contact method you find independently.
Source: US, UK and Canada Freeze $12M in Crypto Phishing Operation – CoinMarketCap
Reviewed by our editorial team on .
The Scam Alert Team tracks fraud targeting Canadians and turns official warnings into clear, practical advice. Our team has a background in IT and cybersecurity, and every article is fact-checked against official sources before publication. How we verify alerts