Mind your wallet

Crypto's going mainstream, bitcoin's tail is up and you're overcome by FOMO, or fear of missing out. But how much do you really know about pig-butchering, address poisoning and phishing, or keys and rug-pulls?

And what should you do to protect yourself from crypto scammers who defraud gullible investors across the world, including Hong Kong, to tune of billions of dollars each year?

Let's start with stablecoins, which are pegged to a fiat currency. For example, Tether or USDT is the largest stablecoin in the world and is pegged to the US dollar.

Stablecoins are widely used in crypto trading as a bridge between official currencies and crypto assets. And they now account for the most number of illicit crypto transactions, according to blockchain analytics firm Chainalysis.

So, investors should be wary of "dirty" stablecoins used for crimes such as money laundering and only buy USDTs from reputed and licensed exchanges.

HISTORY Lessons

Additionally, investors should trace the history of the USDT using a blockchain explorer - an investigative tool to view all information on a blockchain including transactions, blocks and addresses. By entering the transaction hash, one can view all transactions and find out if any address is red-flagged.

Some blockchain explorers also offer risk assessments on whether the USDT has a questionable history to help the buyer make an informed decision and minimize risk.

You should also be wary of fake or counterfeit tokens.

Earlier this year, Hong Kong's police received a complaint from someone who put up a luxury watch worth HK$2.9 million for sale on social media and was paid in USDT but later found out that the USDT was not genuine but a nearly worthless asset called BEP-20:Tether USDT.

Rug-pulls, honeypots and pig butchers

Rug-pulls were among the highest number of scams in the first half of this year, accounting for 22 percent of 223 security events tracked by industry specialist SlowMist.

The 223 scams resulted in losses of US$1.43 billion (HK$11.2 billion), a 50 percent rise from a year ago.

Exit scams or rug-pulls happen when developers hype their tokens but suddenly withdraw all the cash, pulling the rug out from under the investors who are left with worthless tokens.

An infamous example is the Squid Game Token which launched in October 2021 on the heels of the hit Netflix series Squid Game.

Its price soared from a few cents to over US$2,800 in a matter of days amid a frenzy on social media but the token became worthless in less than a month after the developers disappeared off the face of the earth with an estimated US$3.38 million.

In Honeypot scams, criminals use malicious contracts to entice victims with the prospect of substantial returns in fake schemes, which then drain their funds or prohibit withdrawals.

The anonymity behind crypto trading has also led to an explosion in pig-butchering - scammers who befriend people on social media romantically or otherwise and promise massive returns in fake schemes, much like fattening pigs before slaughter, before fleecing them.

Pig-butchering has turned into a global billion-dollar industry and most of these crypto scammers operate out of Asia.

Its been the largest revenue-generating scam so far this year, and one Myanmar-based scam compound has netted "at least US$101.22 million" so far in 2024, says Chainalysis.

There are also dos and don'ts to be followed when investing in bitcoin, ether and other coins.

In Hong Kong, investors have access to three bitcoin and three ether exchange-traded funds and they can also legally buy cryptocoins through licensed exchanges OSL and Hashkey Exchange.

OSL charges a fee of 0.3 percent while Hashkey charges 0.23 percent for general customers and less for VIPs.

Brokerages like Futu and Tiger Brokers also offer trading at competitive fees, with a 0.08 percent platform usage fee for Futu and a 0.05 percent handling fee for Tiger.

While exchanges and brokers offer convenience of trading, those buying large amounts of coins should use their own hardware wallets - also known as cold wallets - in which private keys are securely stored. A small amount can be kept in hot wallets - exchanges or personal software wallets - for trading.

There's a well-worn saying "not your keys, not your coins," which means investors should have sole control of private keys for their tokens.

Also, software or hardware wallets should be downloaded or bought from official stores.

Private key leaks were the top cause of crypto theft in the second quarter, often due to users storing them or mnemonic phrases in cloud services like Google Docs or when using fake wallets, according to MistTrack, the investigative arm of SlowMist.

Going phishing

In phishing scams, fraudsters send emails or texts from what appears to be a well-known or trusted source to trick people into giving them their personal and financial information.

They also use malicious links on platforms like X, formerly known as Twitter. Nearly 80 percent of the first comments under tweets from prominent crypto projects are plagued by phishing accounts, says SlowMist.

Another common phishing tactic is address poisoning, when an attacker creates a fake address that closely resembles the genuine recipient's address and then sends a very small amount of cryptocurrency to the victim's wallet, causing its address to be recorded in the victim's transaction history.

When a victim copy-pastes an address from its transaction history without verifying it, the funds are sent to the attacker's address instead of the intended recipient's.

So users are advised to save addresses used frequently in their wallet and enable microfiltering to block malicious transfers and minimize the risk of being phished, SlowMist suggests.

Crimes on the rise

In the US, bitcoin ATM scams exceeded US$110 million last year, up nearly tenfold since 2020, while crypto investment fraud losses jumped 53 percent to US$3.94 billion.

Worldwide, crypto hacks last month alone lead to losses worth US$313.86 million, according to blockchain security firm Peckshield, which says the loss was dominated by phishing attacks involving bitcoin and decentralized stablecoin Dai.

The number of virtual asset-related crimes in Hong Kong jumped 46 percent to 3,415 last year with losses soaring 158 percent to HK$4.4 billion. This included a fraud at the JPEX crypto exchange in which investors lost an estimated HK$1.6 billion.

While the crypto market is volatile by nature, alternative assets are gaining more acceptance in markets around the world with investment banks, pension and hedge funds recently snapping up bitcoin and related stocks.

Former US president Donald Trump, who's hoping to be re-elected to the White House this November, once called bitcoin a scam but now wants a bitcoin reserve to hedge against financial instability.

Hong Kong lawmaker Johnny Ng Kit-chong has echoed Trump's view, suggesting that the city's Exchange Fund should invest in bitcoin, but the Hong Kong Monetary Authority's ruled it out, for now.

Bitcoin surged by 73 percent in March to a record high of over US$73,000 after 11 spot bitcoin ETFs were launched in the US.

Ahead of their launch, Bitwise Asset Management chief investment officer Matthew Hougan estimated they would net US$55 billion of assets in their first five years but in just eight months after their debut, the 11 ETFs now boast collective assets of around US$52 billion, according Trackinsight.

The market has also been driven by bitcoin's halving in April, which happens every four years and reduces the reward for mining new bitcoin, increasing its scarcity and potentially its price.

But bitcoin is also volatile - it fell below US$50,000 last month and is currently hovering around US$54,000.

To sum up, new investors should approach virtual assets with caution and gain a solid understanding of major coins like bitcoin, ethereum and USDT while learning how to store and manage them securely. When navigating the world of decentralized finance and digital assets - from trading on platforms to holding coins in your own wallets - vigilance remains key, along with a brave heart for volatility.