How a ‘wrong number’ message turned into a $3.4 million crypto scam

Key takeaways

• This $3.4 million scam shows how modern crypto fraud increasingly relies on social engineering rather than technical exploits.

• The fraudsters used a gradual grooming process, engaging victims in friendly conversations over time to build emotional trust before initiating any financial discussions. This is very similar to the pig butchery model.

• The investment pitch combined the growth potential of Ether with the perceived stability of gold. This created a compelling but fraudulent narrative that convinced victims they had access to an exclusive, low-risk opportunity.

• Victims were asked to purchase Ether themselves on legitimate platforms and transfer it to the wallets provided. This gave them a false sense of control and legitimacy.

This scam did not start with a phishing link or a hacked wallet. It all started with a simple message: “Sorry, wrong number. »

According to U.S. prosecutors, the interaction evolved into a social engineering scheme that defrauded millions of victims and led to the seizure of $3.4 million in USDt (USDT).

From Innocent Messages to Multi-Million Dollar Fraud

Federal prosecutors in Boston have initiated civil forfeiture proceedings to recover approximately US$3.44 million related to an alleged online investment fraud.

According to authorities, the funds were seized in early 2025 as part of an investigation launched in late 2024 after complaints from victims in several US states reporting significant financial losses.

The operation did not involve sophisticated technical feats. Instead, she relied on a well-known but remarkably effective tactic: social engineering. Scammers used ordinary, everyday interactions to deceive unsuspecting victims.

Victims received text messages or chat messages that appeared to have been sent in error. The scammers used apps like WhatsApp and Telegram to send these messages.

On the surface, the communication seemed quite ordinary. There was no pressure, no immediate demands and no clear warning signs.

This lack of obvious threat is one reason the method can be so effective.

Unlike crypto scams that trigger immediate suspicion, the “wrong number” approach:

• Seems natural and socially appropriate

• Encourages polite responses

• Creates an opportunity for ongoing dialogue

In this case, as in others like it, what begins as an apparent mistake quickly turns into an opening for further contact.

The grooming stage: gradually building trust

After the initial exchange, scammers avoid rushing the process. They gradually cultivate trust through friendly conversations, sharing seemingly personal information, and maintaining a consistent and reliable personality.

Rather than approaching financial topics too early, scammers:

• Create a sense of emotional ease

• Make regular communication normal

• Foster the appearance of genuine personal connection

This strategy aligns with a broader category of fraud commonly referred to as “pig butchery,” in which victims are methodically “groomed” before being targeted for financial gain.

When money enters the discussion, victims often believe they are interacting with a familiar person rather than an unknown fraudster.

Did you know? The “wrong number” scam technique is an evolution of earlier email scams in which fraudsters pretended to contact the wrong person. Messaging apps have made this tactic more effective by enabling real-time, casual conversations that feel more authentic.

The pitch: a false investment Ether linked to gold

After establishing an initial climate of trust, the fraudsters subtly steered the discussion towards lucrative investment opportunities. Victims were presented with what appeared to be a prime investment opportunity in Ether (ETH), supposedly linked to tangible gold holdings.

This pairing appears to have been deliberate.

It merged:

Together, these elements created an attractive narrative: the promise of substantial returns while minimizing perceived risk.

Victims were told they had access to a rare and exclusive opportunity that was not available to the general public.

The transaction method: why victims bought Ether

Instead of asking for direct transfers, the scammers asked victims to:

1. Buy Ether through Established and Legitimate Exchanges

2. Send purchased Ether to designated wallet addresses

This approach had a significant psychological impact.

Victims feel reassured because:

• Transactions carried out on authentic and known platforms

• Personally managed and authorized for purchase

• Could observe and verify funds in their own wallet before transfer

As a result, the process never felt like it was directly giving money to the fraudsters. Rather, it was genuine participation in a legitimate investment opportunity.

Did you know? In many fraud cases, fraudsters appear to operate in organized groups using scripted playbooks. Some teams specialize only in the “conversation phase,” while others handle crypto transactions, demonstrating how modern fraud has become structured like a business operation.

What happened after the Ether transfer

After victims send their Ether to fraudsters:

• Funds were routed through various intermediary wallet addresses

• They were then converted to USDt, a stablecoin pegged to the US dollar.

• Finally, the stablecoins were transferred to unhosted wallets controlled by the authors.

This sequence was designed to:

• Hide transaction path

• Disconnect funds from their original source

• Significantly complicate efforts to recover them

Nonetheless, blockchain records, combined with investigative tools, helped authorities trace the money trail. The process ultimately resulted in the seizure of the assets.

Part of a larger fraud scheme

This lawsuit is part of a broader wave of fraud cases linked to cryptocurrencies. US authorities have taken action against fraud linked to pig butchery and romance scams. They also launched crackdowns on laundering operations involving stablecoins.

Through these incidents, common features appear:

• Initial awareness through social media, dating apps or informal platforms

• A slow, deliberate process for cultivating trust

• A Pivot to Cryptocurrency “Investment” Opportunities

• Fund transfers via multi-level transactions

Although the specific methods and technologies may vary, the intent and strategy remains consistent.

Did you know? Crypto scams often use multiple blockchains to move funds, not just one. After converting the assets into stablecoins, scammers can link them across networks to make tracking and recovery efforts even more difficult.

Why this scam worked

The main reason these projects succeed is that they are rooted in psychology rather than any technological flaw.

The perpetrators did not exploit vulnerabilities in the system itself. Instead, they targeted and manipulated predictable patterns of human behavior.

Several critical psychological elements contributed:

• Politeness bias: Individuals tend to respond politely even to messages that seem accidental.

• Confidence training: Constant, repeated contact creates a growing sense of familiarity and comfort.

• Perceived control: The victims personally handled the purchase and transfer of funds.

• Credibility: Linking cryptocurrency’s promise of strong growth to gold’s proven stability gave the proposition greater credibility.

By the time the fraud was revealed, the victim was already deeply involved, both emotionally and financially.

The legal response: moving from seizure to definitive confiscation

The U.S. government initiated civil forfeiture proceedings to recover the seized property.

Thanks to this legal mechanism, authorities can:

• Assert ownership of property suspected of being linked to criminal behavior

• Obtain judicial authorization for the definitive confiscation of these assets

• Allow victims or other third parties to file legitimate claims against the property

Unlike criminal prosecutions, civil forfeiture proceedings focus on the assets themselves and do not necessarily require a criminal conviction to move forward.

Warning signs to recognize

Scams of this nature tend to follow well-established patterns. Important red flags to watch for include:

• Unsolicited messages claiming to have been sent in error

• The rapid development of relationships and trust between previously unknown individuals

• Discussions that gradually evolve into investment suggestions

• Promises of exclusive access or guaranteed high returns in cryptocurrency

• Instructions for sending funds or cryptocurrencies to external wallet addresses

Any investment proposal that arises from a random conversation should be approached with the highest level of skepticism.

What to do if you receive similar messages

If you receive an unsolicited message regarding a lucrative crypto investment, you should:

• Avoid responding to or interacting with unknown contacts

• Resist the urge to continue the conversation just to be polite

• Never transfer money or cryptocurrency to wallet addresses provided by strangers

• Block and report suspicious phone numbers, accounts or profiles immediately

• Promptly notify law enforcement and relevant platforms or exchanges if funds have already been sent.

Quick action can sometimes improve the authorities’ chances of recovering the funds or freezing them.