Rapid7 has disclosed details of a large-scale cryptocurrency phishing operation dubbed “Operation Asterix,” designed to target people through phone and email lures that ultimately aim to extract crypto seed phrases. The campaign reportedly reached into datasets covering roughly 885,000 phone numbers across multiple regions, with the largest tranche tied to Germany.

In Rapid7’s investigation, the phishing workflow included targeting users connected to the Binance exchange, producing 5,576 accounts matched to exchange users that were queued for attack. The firm also found evidence of fake communications impersonating Crypto.com, highlighting how the operation blended vishing tactics with exchange-branded messaging.

Key takeaways

• Rapid7 traced Operation Asterix to a dataset of about 885,000 phone numbers, with Germany the largest source (316,002 numbers).
• The campaign identified 43,066 accounts tied to crypto exchange users and generated 5,576 Binance-matched targets for follow-on attacks.
• Attackers used fake Ledger, Trezor, and Exodus applications to pressure victims into revealing seed phrases.
• Rapid7’s artifacts suggest automated tooling, including “checker” logic for Kraken account validation, alongside AI-assisted components.

Operation Asterix: scale, filtering, and “hit rate”

Rapid7’s report describes Operation Asterix as a campaign built around “targeting” rather than indiscriminate spam. According to the firm, attackers matched 43,066 accounts to cryptocurrency users using data validated against the broader German dataset containing more than 316,000 mobile numbers. Rapid7 estimates this translates to an approximate “hit rate” of 13.6% for the validated matching process.

The company also points to recovered artifacts indicating a separate checker function aimed at bulk-validating phone numbers against accounts associated with Kraken. This matters because it suggests the operation was not limited to a single exchange or geography; instead, it used verification steps to determine which phone numbers were most likely to correspond to crypto users.

How victims were lured: impersonation and seed-phrase extraction

At the center of Rapid7’s findings is the social-engineering phase of the campaign. Analysts Anna Sirokova and Jan Recinsky write that the attackers attempted to move victims toward fake applications impersonating well-known self-custody brands, including Ledger, Trezor, and Exodus.

Rapid7 says victims were driven to these impersonation surfaces with the objective of obtaining seed phrases—an outcome that can permanently compromise funds if users enter them into attacker-controlled flows. The phishing operation also used direct contact channels: attackers reached out through fake support emails and phone inquiries designed to look legitimate.

Rapid7’s findings also emphasize the operational chain—how contact was established, which targets were selected, and how the campaign progressed toward data exfiltration. While the report focuses on observed behavior in artifacts recovered by the security team, the practical implication for users is straightforward: even when the message appears to come from a brand or support channel, the risk is highest when the interaction attempts to steer victims toward entering recovery information.

Binance and Crypto.com were among the exchanges impersonated

One of the most consequential elements in Rapid7’s disclosure is how the campaign narrowed down real exchange users. The report states that it identified 5,576 accounts matched to users on Binance that were queued for attack. Rapid7 also reports that recovered logs included fake emails impersonating Crypto.com.

For traders and long-term holders, this pairing of exchange-linked targeting with brand impersonation underscores a common problem: attackers often aim to compromise trust in familiar service identities. Rather than relying solely on generic phishing, Operation Asterix appears to have used verification steps and exchange references to increase the likelihood of a victim responding.

Rapid7’s account of the target composition further indicates that the campaign’s infrastructure included lists beyond Germany. The largest file contained 316,002 German mobile numbers, while additional directories reportedly covered phone numbers associated with regions including Hong Kong, Bulgaria, and the UK, alongside US and Canadian fintech-related lists and Ledger-related lists.

Broader crypto security context: a persistent human-layer threat

Operation Asterix lands in a wider pattern of crypto fraud that repeatedly exploits users rather than breaking underlying protocols. The article notes that, according to blockchain security company Hacken, phishing and social engineering drove most of the crypto industry’s losses in the first quarter, accounting for $306 million out of a reported total of $482 million lost.

This is consistent with earlier incidents referenced in the same material. For example, it points to a Trezor-related personal data breach involving its shipping provider ShipMonk reported in August, a separate Ethereum-related case in July where a crypto investor lost nearly $1 million after approving a malicious phishing token approval transaction, and a prior episode in November 2023 where a fake Ledger Live app placed on the Microsoft Store led to theft totaling $588,000 across 38 transactions.

Taken together, these examples reinforce that crypto users face two different—but overlapping—risk categories: technical compromise through malicious software and direct loss from social-engineering flows that trick users into granting access or revealing recovery material.

What to watch next

As Rapid7’s disclosure shows, campaigns like Operation Asterix increasingly combine datasets, exchange validation, and impersonation of popular self-custody brands—meaning the most urgent question for users isn’t only whether phishing exists, but whether attackers can improve their targeting accuracy. Investors should watch for follow-on reporting from security teams on the specific tooling and any indicators of compromise tied to the fake Ledger, Trezor, and Exodus lures, while continuing to treat unsolicited support messages and “wallet recovery” requests as high-risk until independently verified.

Bitcoin’s move above $71,000 is renewing investor interest, while ASDeFi Cloud Mining offers a way to participate in mining without owning or managing ASIC hardware.

On August 20, the price of Bitcoin once again broke through the $71,000 mark, hitting a new high in nearly three months. The recent market rally has not only been driven by improved sentiment in the cryptocurrency market, but also by the U.S. Treasury’s expansion of its long-term Treasury bond buybacks and the liquidation of a large number of short positions, which have further amplified the market’s upward momentum.

For investors who have been following Bitcoin over the long term, the price breaking through $71,000 signifies that the asset’s value is once again drawing market attention, but it also raises another question:

Aside from waiting for the price of BTC to continue rising, how else can investors participate in the Bitcoin ecosystem and try to build additional sources of passive income?

Following Bitcoin’s rise, investors are turning their attention to opportunities beyond holding

The traditional approach to investing in Bitcoin is simple: buy BTC and wait for the price to rise. While this approach can yield solid returns during a bull market, investors often face long waiting periods during market volatility. 

Furthermore, after BTC rises rapidly, new investors must consider whether the current price is already too high. As a result, some investors are seeking more ways to participate in the Bitcoin ecosystem. From trading and ETFs to custody, computing power, and crypto infrastructure, Bitcoin investment is no longer limited to simply “buying and selling.”

Bitcoin mining is becoming more specialized

In the past, individual investors could participate in mining simply by purchasing mining rigs. However, as competition in the network has intensified, costs such as mining rig procurement, electricity, cooling, space, network infrastructure, and equipment maintenance have become significant barriers to entry. 

For the average investor, the challenge lies not only in understanding Bitcoin but also in managing the infrastructure required for mining. Therefore, ASDeFi Cloud Mining offers an alternative way to participate: by centrally managing computing power, equipment, and daily operations through the platform, users can participate in Bitcoin mining without having to purchase and deploy ASIC miners at home.

What is ASDeFi cloud mining?

Founded in 2020 and headquartered in the United Kingdom, ASDeFi primarily provides AI cloud computing power and cryptocurrency mining services. Through centralized management of computing power and automated operations, the platform allows users to participate in cryptocurrency mining via a web browser or mobile app without having to purchase mining equipment or deal with issues such as electricity, cooling, and maintenance. This model offers a way to participate in the Bitcoin ecosystem without relying on short-term price predictions.

How should the claim of “$5,000 in passive income per day” be interpreted?

“$5,000 per day” is a relatively high yield target and does not mean that ordinary investors will automatically earn this amount after signing up. Actual returns typically depend on factors such as hashrate, investment amount, contract terms, and the price of BTC. 

Therefore, a more reasonable way to understand this is that ASDeFi can serve as a tool for some investors to explore ways to generate returns on cryptocurrency assets. Before participating, investors should familiarize themselves with the contract term, investment amount, yield calculation method, and withdrawal rules, and invest according to their own financial circumstances.

How to get started with ASDeFi Cloud Mining?

1. Register for a cloud mining account

Once registration is complete, users receive a free $15 bonus to purchase hashrate contracts, which will generate $0.60 in daily contract earnings.

2. Complete account information

Log in to the account dashboard and link a cryptocurrency wallet address to receive contract earnings.

3. Understanding computing power contracts

Go to the contracts page to view the amounts, terms, and earnings rules for different computing power contracts, and select the one that best fits your budget.

4. Start the service and view earnings

After completing the relevant configurations, the platform will run the computing power service according to the contract terms. Users can view their account earnings data and manage their earnings via the web or mobile app.

Current examples of computing power contract earnings:

What does BTC breaking through $71,000 mean?

BTC’s recent break above $71,000 is not only a significant price milestone but also reflects a shift in market sentiment following a prolonged correction. Massive liquidations of short positions have further fueled the rally, but this does not guarantee that BTC will continue to rise. Future prices may still be influenced by factors such as interest rates, U.S. dollar liquidity, ETF capital flows, regulatory policies, and global market risk appetite.

Conclusion

BTC has broken through the $71,000 mark, once again highlighting its prominence in the global cryptocurrency market. The recent price surge has been driven by factors such as improved liquidity, a rebound in market sentiment, and short-covering; however, this rapid rise also indicates that market volatility remains high. 

For investors holding BTC long-term, in addition to monitoring price movements, it may be beneficial to explore cryptocurrency infrastructure such as cloud mining. Through centralized management of computing power resources and automated operations, ASDeFi offers an option for users who wish to participate in the cryptocurrency computing power ecosystem.

For more information, visit the official website and download the app.

Bitcoin price extended its breakout to $72,490 on Aug. 20 after forced short covering pushed the price through its 200-day moving averages, but an overbought daily reading raises the risk of a pullback.

Bitcoin price breaks above its 200-day averages

According to data from crypto.news, Bitcoin (BTC) price traded near $71,900 on Binance at the time of writing, up about 3.8% on the daily chart after reaching $72,490 earlier in the session.

The move extended a breakout that began when BTC cleared the $64,000–$66,000 range that had contained the price through much of July and the first half of August. Bitcoin rose from below $65,000 to nearly $70,000 during the first stage of the rally before buyers pushed it above $72,000.

The daily chart shows that Bitcoin has now crossed its 200-day simple moving average at approximately $69,010 and its 200-day exponential moving average near the same level. BTC had remained below both trend indicators since its sharp June decline.

The breakout also took Bitcoin above its shorter moving averages. The 20-day SMA stood at $64,595, while the 50-day and 100-day averages were grouped between $64,264 and $66,211.

That cluster may become a wider support area if the price gives back part of the rally. Holding above the 200-day averages would provide a stronger sign that the move represents more than a temporary derivatives-driven rebound.

Short liquidations accelerated the Bitcoin rally

The one-week CoinGlass liquidation heatmap shows that Bitcoin moved through several layers of leveraged short positions as it crossed $66,000, $68,000, and $70,000.

The densest liquidity visible before the breakout was concentrated around $65,000–$66,000. Once Bitcoin crossed that area, forced purchases by traders closing bearish positions helped carry the price toward $69,000.

Further short-liquidation bands between $69,000 and $71,000 added fuel to the advance. The heatmap shows fewer established liquidation clusters above the current price because BTC reached the area rapidly and had spent little time building leveraged positions there.

The rally followed a long period of compression around $63,000–$65,000. Market data supplied with the charts showed more than $1 billion in Bitcoin short liquidations during one hour, and $2.7 billion in bearish positions closed across the broader crypto market.

Liquidations can increase the speed of a move because exchanges automatically buy Bitcoin to close short positions. However, demand generated by forced covering can fade once the largest short clusters have been cleared.

Momentum supports buyers but RSI warns of overheating

Bitcoin’s 4-hour chart remains bullish after the Supertrend indicator flipped positive. Its trailing level has risen to $67,752, placing the first dynamic support roughly 6% below the current price.

The Chaikin Money Flow reading of 0.28 also shows that buying pressure has accompanied the breakout. A positive CMF reading means more volume has entered Bitcoin during periods when the price closed near the upper part of its trading range.

The daily chart carries a clearer warning. Bitcoin’s 14-day relative strength index jumped to 78.7, well above the 70 level commonly used to mark overbought conditions.

An overbought RSI does not require an immediate reversal, especially during a short squeeze. It does show that the rally has moved faster than its recent trend, increasing the chance of consolidation or profit-taking.

The latest daily candle also produced a high near $72,490 before the price eased below $72,000. Buyers must therefore turn the $69,000–$70,000 region into support to prevent the breakout from becoming a brief move above the 200-day averages.

Analysts watch $67K and $65K for a pullback

Crypto trader Daan Crypto Trades said in an Aug. 20 X post that Bitcoin had made a higher high and was testing its daily 200-day moving-average region.

Daan placed the move inside a wider $60,000–$80,000 range and said the trend had improved on the daily chart. However, the trader expected volatility to remain elevated after Bitcoin escaped the compressed range.

Lennart Snyder offered a more cautious assessment in a separate X post. Snyder said Bitcoin had entered a larger range but remained below important resistance, leading him to favor waiting for the price to settle before opening a new position.

Snyder identified the midpoint of the breakout candle around $67,000 as one area where momentum traders could look for support. He placed a deeper potential buying zone at $65,000–$66,000, near the upper boundary of Bitcoin’s former consolidation range.

Those levels broadly match the technical charts. The 4-hour Supertrend stands near $67,752, while the daily moving-average cluster between $64,264 and $66,211 could offer support during a larger retracement.

On the upside, a sustained close above $72,500 would leave the $74,000 area as the next nearby psychological level. Bitcoin would then face a broader supply region between $78,000 and $80,000, where the market traded before the June sell-off.

US liquidity and ETF demand remain key

The breakout came as US Treasury yields and the dollar pulled back following the Treasury Department’s reported plan to increase long-dated bond buybacks from $2 billion to at least $4 billion per operation in September.

Lower yields can support non-yielding assets such as Bitcoin by reducing the relative return available from government bonds, though the derivatives data indicate that forced short covering was a major immediate driver of the rally.

Data from SoSoValue also showed $517 million in net inflows into US spot Bitcoin exchange-traded funds on Aug. 19. Continued ETF demand would offer stronger evidence that institutional buying is replacing the short squeeze as the source of support.

A renewed rise in US yields, weaker ETF flows, or a daily close below $69,000 would weaken the breakout. Holding the 200-day averages while the RSI cools would give buyers a firmer base for another attempt above $72,500.

US spot Bitcoin exchange-traded funds (ETFs) saw a surge in demand on Wednesday, pulling in $517.2 million in net inflows—marking their biggest single day since May 4. That strong session helped lift total August net inflows to $1.47 billion, extending a momentum shift that has become increasingly noticeable as the month progresses.

According to data referenced by Cointelegraph, the funds have drawn in roughly $1 billion since Monday, representing their strongest weekly net inflow since the week ended Jan. 16, when they attracted about $1.42 billion.

Key takeaways

• Bitcoin spot ETFs recorded $517.2 million in net inflows on Wednesday, the largest single-day figure since May 4.
• August net inflows reached $1.47 billion as inflow strength continued after Monday’s near-$1 billion total.
• Spot Ether ETFs added $189.2 million in net inflows on Wednesday, bringing this week’s Ether inflows to about $291.5 million.
• ETF inflows coincided with a broad crypto price rally and US Treasury action to expand long-dated debt buybacks.
• Market attention also returned to US crypto policy progress, following renewed discussion of the CLARITY Act.

ETFs post best day since May amid risk-sensitive market signals

The latest ETF numbers arrived alongside a rising crypto tape. At the time of writing on Thursday, Bitcoin was trading near $72,000, up 11% over the prior 24 hours, according to CoinGecko. Ether also gained sharply, up 19% to $2,286.

The close timing matters because it suggests the inflows were not isolated to ETF-specific flows alone. Instead, they came during a day when broader market conditions appeared to favor assets perceived as hedges against currency debasement rather than pure “risk-on” trades.

Cointelegraph quoted Jonatan Randin, senior market analyst at PrimeXBT, saying the Treasury’s move to expand buybacks at the long end helped push yields and the US dollar lower—while gold and silver outperformed equities. In his view, the market interpreted the action as a currency-related development rather than a growth catalyst.

Why Treasury buybacks and regulation talk may be feeding the same narrative

The Wednesday ETF inflow surge was linked to two parallel storylines: the US Treasury’s decision to expand buybacks of longer-dated government debt, and renewed attention on crypto regulation after President Donald Trump urged Congress to advance the CLARITY Act at a White House event.

Cointelegraph’s reporting connected the Treasury decision to the broader price action, including the way Bitcoin traded in sympathy with gold and silver. Randin’s comments emphasized that Bitcoin’s correlation shifted toward the “debasement trade”—an environment where investors often look to hard assets rather than companies or conventional growth exposure.

Investors tend to focus on the interaction between rates, the dollar, and liquidity expectations because those factors can influence whether demand flows into speculative or “hedging” allocations. When ETFs see strong net inflows while Bitcoin’s price behavior resembles traditional hedges, it can indicate a different driver than simple momentum trading.

Ether ETFs also benefit as weekly inflows climb

While Bitcoin led the day’s flows, Ether ETFs also contributed to the broader picture. Spot Ether ETFs logged $189.2 million in net inflows on Wednesday, increasing this week’s net inflows to about $291.5 million.

That matters for market structure: simultaneous strength across major spot products can reinforce the impression that inflows are responding to a macro or policy-driven catalyst rather than reflecting a rotation limited to a single asset.

At the same time, the gap between Bitcoin’s $517.2 million inflow and Ether’s $189.2 million highlights how investor positioning still appears weighted toward Bitcoin as the primary institutional gateway for spot exposure.

What to watch next: whether ETF inflows hold after the catalyst

The immediate question for readers is whether the Wednesday surge was a one-off reaction to Treasury headlines and renewed regulatory urgency—or the start of a more sustained inflow trend. With Bitcoin and Ether both sharply higher and ETF inflows reaching notable multi-month highs, investors will likely watch subsequent daily flow prints, changes in yields and the dollar, and any tangible movement around US crypto policy discussions.

Cybersecurity firm Rapid7 unveiled a new cryptocurrency phishing campaign known as Operation Asterix, targeting roughly 885,000 phone numbers from several countries to steal cryptocurrency investors’ assets.

The phishing campaign led to 5,576 accounts matched to users on crypto exchange Binance, which were queued for attack, while the recovered logs also showed fake emails impersonating Crypto.com, according to a Monday report by Rapid7.

Of the 885,000 phone numbers, the largest file included 316,002 German mobile numbers, with additional directories covering Hong Kong, Bulgaria, the UK, the US, Canadian fintech companies and additional Ledger-related lists. 

Phishing attacks and social engineering scams drove the majority of the crypto industry’s losses in the first quarter of the year, accounting for $306 million out of the total $482 million lost, according to blockchain security company Hacken.

As part of the Asterix phishing campaign detailed by Rapid7 analysts Anna Sirokova and Jan Recinsky, attackers drove victims to fake apps impersonating Ledger, Trezor, and Exodus, seeking to steal their seed phrases. Attackers reached out to victims through fake support emails and phone inquiries.

Operation Aseterix kill chain from acquisition to exfiltration. Source: Rapid7.

Cointelegraph has contacted the analysts for further comment on what they found regarding target filtering, hardware wallet spoofing and self-custody vulnerabilities. We will update this article when they reply.

Earlier in August, wallet provider Trezor reported a breach of personal data affecting about 14,000 users through its shipping provider, ShipMonk.  

In July, a crypto investor lost nearly $1 million after signing a malicious phishing token approval transaction on Ethereum. 

In November 2023, a fake Ledger Live app on the Microsoft Store resulted in the theft of $588,000 across 38 transactions. 

Related: DefiLlama delayed mobile launch over phishing apps on Apple Store, founder says

Asterix phishing campaign boasts 13% “hit rate” 

Attackers matched 43,066 accounts to cryptocurrency users with exchange accounts, validated from the larger German dataset of over 316,000 phone numbers, meaning that the campaign has a “hit rate” of approximately 13.6%, according to Rapid7. 

The report also identified a checker for Kraken, which sought to bulk-validate phone numbers against accounts from the cryptocurrency exchange. The cybersecurity company said that the recovered artifacts showed that artificial intelligence tools were used as a significant part of the phishing campaign.

Phishing attacks are a long-standing headwind for the crypto industry, as they enable attackers to exploit human behavior rather than the code of a protocol. 

On May 25, onchain analyst “b-block” warned that scammers used Google to deploy malicious phishing ads impersonating decentralized exchange Uniswap, reportedly stealing more than $400,000 from victims. 

Leading crypto industry figures, including Binance co-founder Changpeng Zhao, have previously called for better wallet security measures to avoid phishing scams, after an investor lost $50 million in an address poisoning scam in December 2025.  

Magazine: How a ‘Wrong Number’ message turned into a $3.4M crypto scam