A fake tax app. A drained crypto wallet. And a swift freeze that gave one victim a real shot at recovery.
When a victim's HashPack wallet was drained through a fake tax application, ChangeNOW's AML systems caught the funds mid-transfer. What followed was a swift cooperation with the FBI that ended with the assets successfully handed over to investigators.
Incident Overview
The victim downloaded what appeared to be a legitimate tax preparation application. It wasn't. The app was a spoofed lookalike, designed to mimic a trusted tool and trick users into installing malware. Once on the device, it gained access to the victim's HashPack wallet credentials and drained the funds.
HashPack is a widely used non-custodial wallet for the Hedera (HBAR) network. The attacker made off with 497,000 HBAR and quickly began moving the funds to obscure their origin.
Early Detection and Fast Action
Shortly after the theft occurred, ChangeNOW received intelligence flagging the addresses associated with the stolen funds. Our AML team acted immediately:
- The flagged addresses were added to our internal blocklist
- Incoming transactions from those addresses were placed under monitoring
- A large transfer attempt, approximately $44,498.90 USD worth of HBAR, was identified and held before it could be completed
The speed of the response was critical. Stolen funds that pass through exchanges undetected are often broken up and converted within hours, making tracing extremely difficult.
Cooperation with the FBI
After the funds were secured, we notified the reporting source that assets had been frozen pending further action.
Shortly afterward, an FBI representative contacted us with a formal seizure request.
Following all necessary reviews and compliance checks in accordance with our AML/KYC procedures and law enforcement guidelines, the funds were successfully transferred to the FBI. We're glad this case had an outcome that gave the victim a real chance at recovery, and we're proud to have been part of making that happen.
How the Attack Worked: Spoofed Apps and Wallet Drainers
This type of attack is more common than most people expect, and it's effective precisely because it targets human behavior rather than blockchain infrastructure.
Here's how it typically unfolds:
Step 1 – The lure. Attackers create a near-identical copy of a real, trusted application (in this case, a tax preparation tool). These fake apps are often distributed through malicious ads in search engines, copycat websites, or third-party download sources. The design, name, and even reviews can look completely legitimate.
Step 2 – Installation. The victim, believing the app to be genuine, installs it on their device. At this point, the attacker gains a foothold.
Step 3 – Credential harvesting. The malware typically uses one or more of the following techniques:
- Keylogging: recording every keystroke, including wallet passwords and seed phrases
- Clipboard hijacking: intercepting copied seed phrases or wallet addresses in real time
- File system access: scanning for browser extension data where wallet keys may be stored locally
Step 4 – Drainage. Once the seed phrase or private key is obtained, the attacker imports the wallet into their own environment and transfers all assets out. Usually within minutes.
The Hedera network, like most blockchains, processes transactions quickly and irreversibly. Without early intervention at the exchange level, recovery is nearly impossible.
How to Protect Your Wallet
This case is a reminder that the weakest point in crypto security is rarely the blockchain itself, but the moment you interact with a malicious application. A few habits that can make a serious difference:
Only download from official sources. Go directly to the developer's official website or your device's official app store. Never use links from ads, emails, or social media to download apps.
Verify before you install. Check the developer name, number of downloads and reviews, and publication date. Fake apps are often recent uploads with inflated or missing reviews. Go to the official website and verify the download link.
Store your seed phrase offline. Consider keeping it on paper, in a secure location, away from any internet-connected device. Never type your seed phrase into any application unless you are 100% certain of its legitimacy.
Use a hardware wallet for significant holdings. Hardware wallets require physical confirmation for transactions, making remote theft significantly harder even if your device is compromised.
Be especially cautious during tax season. Attackers deliberately target high-traffic moments like tax filing periods, airdrop events, major market moves, when people are actively searching for new tools and may be less careful about what they install.
Final Thoughts
The blockchain doesn't have an undo button. But this case shows that with the right systems in place, fast action, and effective cooperation between exchanges and law enforcement, recovery is possible.
We are grateful to the source who flagged the addresses promptly. We also extend our sincere thanks to the FBI for their swift and professional cooperation throughout the seizure process. Cases like this are only resolved when every party acts quickly.
ChangeNOW remains committed to maintaining a safe environment for users and to working with authorities when it matters most. If you've encountered suspicious activity or believe your funds may have been stolen, don't hesitate to reach out to our support team.
For more on how we handle asset recovery and AML cases, visit our Asset Recovery Cases page.
