According to CoinMeta, a cybersecurity company Rapid7 exposed an encryption scam operation known as Operation Asterix. Researchers found that due to a configuration error, the attackers exposed a server containing approximately 885,000 phone numbers. This server also included tools for exchange account verification, phishing panels, automatic dialing scripts, and forged Trezor, Ledger, and Exodus wallet applications. The attackers first verified in bulk whether these phone numbers were associated with accounts on platforms such as Crypto.com and Kraken. For example, among 316,000 German phone numbers, they identified 43,066 Crypto.com accounts, with a hit rate of about 13.6%. Subsequently, the attackers targeted their victims by combining information such as names, emails, and regions, impersonating customer service via phishing emails and calls, and guiding users to install forged wallets and enter their mnemonic phrases. The relevant data was then transmitted externally through Telegram.