Hong Kong Reports 150 WhatsApp Hijacking Cases; Crypto Firm Loses HK$1M

Law enforcement authorities in Hong Kong have issued a warning following a sharp increase in social media security breaches involving WhatsApp account hijacking. Over the past two weeks, more than 150 cases have been reported, with cumulative financial damages exceeding HK$1 million. These sophisticated phishing attacks have increasingly targeted professionals within the digital asset industry, utilizing social engineering to facilitate unauthorized fund transfers.

Social Engineering Targets Virtual Currency Exchange

A significant portion of the total losses originated from a single high-profile incident involving a virtual currency exchange employee. Cybercriminals successfully hijacked the staff member's messaging account to orchestrate a complex fraudulent scheme. By harvesting data from authentic work environments, the attackers were able to mirror the professional identity of the victim.

• The scammers copied the official name and avatar of the employee.
• They extracted member information from legitimate corporate groups to build a fake communication channel.
• The perpetrators impersonated a verified customer to submit urgent exchange requests.
• The victim was deceived into transferring cryptocurrency assets to a designated external wallet controlled by the attackers.

This method of "whaling" or highly targeted phishing allows attackers to bypass traditional security protocols by exploiting the trust established within internal corporate communications.

Rising Financial Impact of Messaging Scams

The financial impact of these breaches has reached a critical threshold, with one company alone reporting losses exceeding HK$1 million. This trend highlights a growing vulnerability in the blockchain and fintech sectors, where rapid transactions often occur over instant messaging platforms.

Scammers then copied the name, avatar, and member information of the real work group, created a fake group, and impersonated a customer to submit exchange requests, luring the victim into transferring cryptocurrency to a designated wallet.

Security analysts suggest that the use of Multi-Factor Authentication (MFA) and the verification of transaction requests via secondary, non-messaging channels are essential steps to mitigate such risks. The Hong Kong authorities continue to investigate these cases as part of a broader effort to combat cybercrime and protect the local financial ecosystem from malicious actors.

The recent surge in account takeovers serves as a stark reminder for cryptocurrency service providers to reinforce their internal security policies. As digital assets remain a prime target for international criminal syndicates, maintaining rigorous verification standards for all off-chain communications is vital for the preservation of corporate and client capital.