A Hong Kong company engaged in over-the-counter cryptocurrency exchange lost more than HK$4 million, or about $514,000, in a social engineering scam, according to AASTOCKS, which cited CyberDefender, a platform operated by the Cyber Security and Technology Crime Bureau of the Hong Kong Police Force.
Police said the group behind the fraud took control of an employee’s WhatsApp account, copied information from the original client work group, and recreated a closed-loop trading setup. That led the victim firm to transfer a large amount of crypto assets to an external fraudulent address without substantive multi-layer verification.
Attackers cut off the real channel before cloning the work group
Based on the sequence outlined by police, the employee normally used a WhatsApp group to coordinate with internal colleagues and several key clients and to handle routine crypto settlement.
After obtaining access to the employee’s account, the fraudsters first severed the real communication channel. They blocked the original work group and placed all genuine clients and colleagues on a blacklist, leaving the employee unable to receive warning messages through the usual channel.
Once that isolation was in place, the group extracted the original group image, group name, member nicknames and matching avatars, then created a highly convincing replacement group. Inside the fake group, the scammers posed as a client representative and used familiar business language to issue crypto exchange and transfer instructions.
Following the established workflow, the employee sent cryptocurrency to an external wallet specified by the fraudsters. Suspicion arose only when the firm prepared to deduct the fiat consideration from the client’s platform account and found the balance was insufficient. The employee then verified the matter with the client by phone and learned that no such exchange had ever been initiated. A later check of the device list showed the account had been synchronously logged in on an unknown terminal for an extended period.
More than 150 similar cases reported in two weeks
Police said the loss suffered by the crypto exchange business was not an isolated incident. Data compiled by CyberDefender showed that, over the past two weeks, Hong Kong police received more than 150 reports of similar fraud involving hijacked communication accounts, with combined losses exceeding HK$15 million.
Using the figures provided in the report, the OTC firm’s single loss of more than HK$4 million accounted for 26.67% of the total amount involved in those cases over the same two-week period.
Police also said that compared with scattered impersonation and borrowing scams targeting individuals, OTC crypto firms have become a key target for organized cybercriminal groups because they handle larger daily fund flows and blockchain transactions are irreversible once sent on-chain.
Police set out four control measures
The case exposed weaknesses in internal controls across parts of the crypto OTC sector. Some smaller firms still rely heavily on a single messaging tool as the instruction channel for large asset transfers, while internal practice still follows a release-first, bookkeeping-later routine without an independent offline dual-review authorization process.
Hong Kong police said a cloned group may copy avatars and historical nicknames, but it cannot forge members’ underlying phone numbers or the actual timestamps of historical chat records.
For messaging security, police advised firms and practitioners to adopt four measures:
- require all staff to enable the official two-factor authentication, or 2FA, feature on communication tools;
- check sponsored search results to avoid phishing traps that imitate login pages;
- prohibit logins to business communication tools on shared computers or unencrypted public networks;
- for any instruction involving a large on-chain crypto transfer, require an independent phone confirmation or offline multi-channel second review by two people before the transaction is broadcast.
Police said the laundering path tied to the more than HK$4 million case is now under investigation by the cybercrime unit, and further updates will be posted on the police anti-crime public platform.