Hong Kong crypto dealer falls victim to WhatsApp scam, loses over 4 million HKD

On October 16, 2026, according to an AASTOCKS financial news report, the "Cyber Sentinel" platform under the Cybersecurity and Technology Crime Investigation Bureau of the Hong Kong Police Force disclosed that a local Hong Kong company engaged in virtual currency exchange (OTC) business fell victim to a new type of social engineering fraud, with losses exceeding 4 million Hong Kong dollars (approximately US$514,000). The briefing stated that the criminal gang maliciously took over the instant messaging accounts of company employees, completely replicating existing client work group information to forge a closed-loop trading scenario, causing the victimized institution to directly transfer large amounts of crypto assets to external fraudulent addresses without undergoing substantive multi-factor authentication.

Dual Tactics: Cloned Work Groups and Blacklist Isolation

Based on the crime chain disclosed by the police, this incident exhibits highly targeted, directional penetration characteristics. Employees involved routinely used WhatsApp groups to coordinate business activities with internal colleagues and multiple key clients, handling daily cryptocurrency settlements.

After successfully hijacking the employee's account privileges, the scammers first severed the communication link between the victim and their actual clients. Through backend operations, the perpetrators directly locked the original genuine work group and blacklisted all real clients and colleagues within it, depriving the affected employee of the ability to receive any warning messages through the original channel without their knowledge.

Following the communication isolation, the scam ring extracted images, group names, all member nicknames, and corresponding avatars from the genuine group to create a highly counterfeit work group. Operating inside the cloned group, the perpetrators impersonated client representatives and issued cryptocurrency exchange and transfer instructions to the affected staff using standard business scripts. Relying on established operational habits, the employee directly transferred the cryptocurrency into the externally designated wallet provided by the scammers. Suspicion only arose when attempting to deduct the fiat equivalent from the client's platform account due to insufficient funds. The staff member subsequently verified the matter via a traditional phone call with the actual client, who confirmed the transaction was never initiated. Only after checking the device list did the compromised employee realize the account had been continuously synchronized and logged in on an unknown terminal for an extended period.

150 Cases in Two Weeks Highlight the Proliferation of Social Engineering Hijackings

This loss suffered by the virtual currency exchanger is not an isolated incident. According to aggregated data from the Hong Kong Police Force's "Cyber Sentinel", during the past two-week statistical cycle, law enforcement in Hong Kong has cumulatively received over 150 reports of similar online fraud involving communications account hijacking, with cumulative losses exceeding 15 million Hong Kong dollars.

Data calculations indicate that the single-loss incident at the virtual currency exchange company (over 4 million Hong Kong dollars) directly accounted for 26.67% of the total amount involved in similar fraud cases across Hong Kong over the past two weeks. Compared to fragmented account impersonation lending fraud targeting ordinary individuals, cryptocurrency over-the-counter trading institutions have emerged as primary attack targets for professional cybercriminal organizations conducting credential forgery and man-in-the-middle hijackings, given their large daily fund turnover volumes and inherent characteristics such as irreversible on-chain blockchain transactions.

Internal Control Blind Spots and Prevention Benchmarks in On-Chain OTC Settlement Processes

This incident exposes institutional loopholes within the internal control mechanisms of the current cryptocurrency over-the-counter exchange industry. Some small and medium-sized institutions still heavily rely on isolated instant messaging applications as command entry points for large-scale asset transfers, while internally adhering to the operational inertia of releasing tokens prior to bookkeeping, and lack an independent offline dual-person cross-review authorization mechanism.

The Hong Kong Police Force has issued prevention advisories to institutions and practitioners, noting that while counterfeit groups can replicate profile pictures and historical nicknames, the underlying real phone numbers of members and the physical publication timestamps of historical chat records cannot be forged. In response to security defenses within instant messaging environments, police recommend that relevant institutions enforce a four-tier risk control baseline:

Mandate all personnel to activate the official two-factor authentication (2FA) feature of their communication tools; scan search engine top advertisements to avoid falling into fake webpage login phishing traps; strictly prohibit logging into business communication tools on public computers or within non-encrypted public network environments; any instruction involving large-scale cryptocurrency on-chain outbound transfers must incorporate independent telephone or offline multi-channel dual-person secondary verification prior to on-chain broadcasting.

The Hong Kong Police Force stated that the asset money-laundering pathway involving 4 million Hong Kong dollars in this case has been formally opened and tracked by the Cyber Crime Investigation Bureau, with subsequent investigative progress to be continuously updated on the force's public anti-crime platform.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps