$7M Lost by Crypto Investor Who Bought Discounted Cold Wallet

News Flash! Buying a bargain-basement crypto cold wallet from a dodgy website or a social media marketplace may not be a great financial decision.

A Chinese crypto investor learnt this lesson the hard way after losing almost US$7 million (AUD$10.7m) worth of crypto assets as a result of buying a discounted, and compromised, cold wallet through Douyin, the Chinese version of TikTok. Douyin has a marketplace where users can buy and sell products, similar to Facebook Marketplace.

Blockchain security firm, SlowMist, said the wallet’s private key was “compromised at creation” and the user’s US$6.5 million in digital assets were “drained within hours.”

SlowMist warned its followers that simply using a cold wallet doesn’t necessarily mean their digital assets are safe, cautioning against buying discounted wallets through unofficial channels:  

Avoid ‘Factory sealed’ or ‘Discounted cold wallets’ — 99% are tampered.

SlowMist, blockchain security firm

Related: US–China Tariffs Shake Markets as Australian Analysts Weigh In on “Handshake Agreement”

Crypto Assets “Evaporated” Overnight

A Chinese X/Twitter user who goes by the handle Hella claimed the victim was a close friend who’d contacted him the previous night to inform him of the theft. In his post, (translated from Mandarin to English using Google Translate) Hella said:

Nearly 50 million evaporated overnight! Just because I bought a ‘cold wallet’ on Douyin? A bloody lesson! A late night phone call gave me chills! A close friend of mine had just experienced the darkest moment of his life – nearly 50 million RMB worth of cryptocurrency he held was stolen!

Chinese Twitter user Hella

Hella described the theft as a “carefully designed hot trap”, adding that the stolen assets were “washed away through Huiwang within a few hours”. According to Hella, the stolen assets were traced to Huiwang by SlowMist after the victim contacted the blockchain security firm for help recovering their assets.

Huiwang, also known as Huione Group, is a Cambodian-based group of companies which offers a variety of services including payment processing, largely servicing the scamster and fraudster markets. The conglomerate has a rich history of being widely used by cybercriminals for money laundering. Earlier this year the US Treasury Department sought to blacklist Huione Group from the US financial system over concerns surrounding its facilitation of cybercrime.

SlowMist’s chief information security officer, posting on X / Twitter under the handle 23pds, reiterated the risks of buying cold wallets through unofficial channels: “Purchase of cold wallets must be done through official channels!” 23pds said. 

Don’t gamble your entire fortune on a ‘wallet’ that’s a few hundred bucks cheaper — that’s not saving money, it’s throwing your life away!

SlowMist chief information security officer

Aussie Crypto Users Not Immune From Scams

While this particular scam hit a Chinese investor, Aussies are also very much at risk.

In April, the Federal Court ruled that the Australian Securities and Investments Commission (ASIC) could proceed with its plan to shut down 95 companies engaged in crypto and romance scams known colloquially as ‘pig butchering’.

Related: Crypto ATM Scams Rip Off Aussies: Seniors Bear the Brunt

ASIC’s Deputy Chair, Sarah Court, said eliminating the risk posed by these dodgy companies is very difficult and urged Aussies to continue to be on the look out for these kinds of scams:

These scams are like hydras: you shut down one and two more take its place. That’s why we’re warning consumers that the threat of scams and identity fraud remains high. We remind consumers to be vigilant.

ASIC’s Deputy Chair, Sarah Court