Key Notes
- A Hong Kong crypto exchange business lost more than HK$4 million after scammers hijacked an employee’s WhatsApp account and recreated its work group.
- Copied names and profile photos disguised a fake client instruction, while a later phone call revealed that the customer had never requested the transfer.
- Police recorded more than 150 WhatsApp account-hijacking cases with losses exceeding HK$15 million over two weeks, covering a broader category than crypto scams.
A Hong Kong cryptocurrency exchange business lost more than HK$4 million, roughly US$513,000, after scammers hijacked an employee’s WhatsApp account and recreated a work group to issue a fraudulent transaction request.
HK01 reported the case on October 16, citing Hong Kong police. The attackers copied the original group’s name, picture and participants’ displayed identities, making a new conversation appear to be the established channel between the employee, colleagues and clients.
The deception was discovered after the employee had sent cryptocurrency to the requested wallet. A subsequent call to the client established that no exchange instruction had been given.
A familiar group, with impostors inside
According to HK01’s account, the attackers first blocked the employee’s original work group and blacklisted its members. They then set up a replacement group using copied names and avatars, isolating the victim from genuine contacts while presenting an apparently familiar conversation.
Someone posing as a client representative requested a cryptocurrency exchange in the usual way. The employee transferred the assets first and then attempted to deduct the corresponding amount from the client’s account.
An insufficient balance prompted the employee to call the client. That check exposed the false instruction, and a closer inspection revealed an unfamiliar device linked to the employee’s WhatsApp account.
The report does not identify the company, specify the cryptocurrency transferred or disclose the receiving wallet address. It also does not explain how the attackers initially obtained access. The account takeover should therefore not be presented as a confirmed vulnerability in WhatsApp itself or a compromise of the company’s blockchain private keys.
Copied profiles did not reproduce every detail
A separate local report said police highlighted differences that could expose the imitation: the fake participants’ phone numbers did not match the genuine contacts, and the timestamps of conversation history could not be reproduced identically.
Those details distinguish copying the appearance of a group from gaining control of every person in it. A recognizable name or profile photo can be reused by an impostor without the original colleague or client participating in the new conversation.
For a business handling transfers, the case illustrates a gap between recognizing a communication channel and verifying a payment instruction. The eventual phone call identified the fraud; the operational safeguard is to make that independent check before releasing assets, using contact details already held by the business.
The two-week total covers a wider scam category
HK01 reported more than 150 WhatsApp account-hijacking cases over the previous two weeks, with aggregate losses exceeding HK$15 million, approximately US$1.9 million. That total covers the wider category of account-takeover scams, not 150 confirmed cryptocurrency-company losses or 150 identical cloned-group incidents.
Dollar conversions in this article are approximate, using HK$7.8 per US dollar. The HKMA framework keeps the Hong Kong dollar within a narrow band against the US dollar; the original reported losses are denominated in Hong Kong dollars.
Hong Kong police have also issued a separate account-hijacking warning describing fake verification prompts that persuade users to link an attacker’s device. That warning provides background on the risk; it does not establish the initial entry method in the cloned-group case.
WhatsApp’s own security guidance recommends checking linked devices regularly, disconnecting unfamiliar sessions and enabling two-step verification. Those controls help protect account access, while independently checking a transfer request addresses the separate question of whether the customer authorized it.
The impersonation theme also appears in CoinScreamer’s Ledger phishing coverage, where fake maintenance pages copy a familiar security process. Our Brooklyn investigation report examines another form of false authority: purported investment advisers and recovery services. These are separate cases, with no verified connection between their operators.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
