Fake Cold Wallet Bought on Chinese TikTok Costs User $6.9M in Crypto

A crypto investor has lost nearly $7 million after purchasing what appeared to be a legitimate cold wallet through Douyin, the Chinese version of TikTok, only to discover the device was a sophisticated trap designed to steal digital assets.

近 5000万一夜蒸发！只因在抖音买了个“冷钱包”？血的教训！

一个深夜电话，让我毛骨悚然！关系很铁的朋友，刚经历了人生至暗时刻—— 他持有的价值近 5000万人民币的加密货币，被盗一空！…

The victim, described as a close friend of former Bitmain team member Hella, fell prey to what security experts call a “carefully designed hot trap” that compromised the wallet’s private key at the moment of creation.

Within hours of the theft being discovered, the stolen cryptocurrency had been laundered through Huiwang, a Cambodian-based network operated by the Huione Group that facilitates illicit financial activities, including crypto exchange services and darknet marketplace operations.

Criminals are now adopting a growing, dangerous trend where traditional phishing techniques are targeted at hardware wallets, which users trust implicitly for enhanced security features.

A SlowMist investigation revealed that the compromised wallet was marketed through Douyin’s e-commerce platform, Douyin Shop, which allows third-party sellers to offer various products, including cryptocurrency hardware.

Last night, We received an emergency report: a user lost $6.5M worth of crypto from a cold wallet.

The wallet was bought via Douyin (TikTok China), but the private key was compromised at creation — and funds were drained within hours.

Cold wallet ≠ Safe

Avoid “Factory… https://t.co/YDV4EgxD3a

The scammers exploited this legitimate marketplace to distribute devices that appeared factory-sealed and authentic, often advertising them at discounted prices to attract cost-conscious buyers.

Unlike software-based scams that rely on users making mistakes during transactions, this hardware compromise occurred at the fundamental level of private key generation.

When the victim initialized their new wallet, the pre-compromised device generated keys already known to the attackers. This created an illusion of security while providing criminals complete access to funds transferred to the wallet.

Within hours of the theft, the criminals had successfully moved the stolen cryptocurrency through multiple layers of obfuscation, making recovery virtually impossible.

This speed and efficiency suggest coordination between hardware scammers and money laundering networks. North Korea hackers are well known for these types of large-scale organized crimes.

North Korean cyber spies reportedly set up fake US firms to deploy malware targeting crypto developers, violating Treasury sanctions.#NorthKorea #CyberSecurity https://t.co/TvCmrspaep

Most recently, they executed a large-scale corporate social engineering campaign targeting crypto developers by conducting fake job interviews and infiltrating open-source software packages.

The cold wallet scam is just one facet of an expanding organized threat towards crypto users. Criminals are moving beyond traditional phishing emails and fake websites to compromise the very tools and devices that users trust for security.

Recent months have witnessed a surge in similar attacks, including the distribution of malware-infected Ledger Live applications targeting macOS users and the revelation that Chinese printer manufacturer Procolored had been distributing Bitcoin-stealing malware alongside official drivers, resulting in the theft of 9.3 BTC worth over $953,000.

The official driver provided by this printer carries a backdoor program. It will hijack the wallet address in the user's clipboard and replace it with the attacker's address: 1BQZKqdp2CV3QV5nUEsqSg1ygegLmqRygj

According to @MistTrack_io, the attacker has stolen 9.3086… https://t.co/DHCkEpHhuH pic.twitter.com/W1AnUpswLU

The Atomic macOS Stealer, discovered embedded across at least 2,800 compromised websites, was a convincing fake version of legitimate applications like Ledger Live, with authentic interfaces that trick users into revealing their seed phrases.

The increasing sophistication of these attacks has prompted major technology companies to take decisive action.

Microsoft recently collaborated with international law enforcement to disrupt the Lumma Stealer malware operation, seizing nearly 2,300 websites linked to the criminal infrastructure.

@Microsoft has taken legal and technical action to disrupt Lumma Stealer, a notorious malware responsible for information theft.#Microsoft #lummahttps://t.co/UCvErbFxTS

Notably, this latest crypto loss occurs against a backdrop of escalating crypto security threats, with CertiK’s May 2025 Security Report revealing over $302 million lost across Web3 through various attack vectors.

The report showed a dramatic 4,483% increase in losses from code vulnerabilities, totaling $229.6 million in May alone, while phishing attacks continued to plague the ecosystem with $47.6 million in losses.

The cold wallet scam represents a particularly insidious evolution in crypto crime. It exploits users’ trust in hardware security devices that are traditionally considered the gold standard for cryptocurrency storage.

The post Fake Cold Wallet Bought on Chinese TikTok Costs User $6.9M in Crypto appeared first on Cryptonews.