19 August 2024. A single individual loses 4,064 BTC, around $243M at the time.
Every step was a conversation. The attackers presented as Google support, then as Gemini support. They built enough credibility to get him to reset two-factor authentication on his exchange account. Then they got him to install remote access software. From there they reached the keys and emptied the wallet, moving the proceeds through exchanges and swap services.
ZachXBT identified three suspects and passed his work to law enforcement. Indictments and arrests followed within weeks. Over $9M was frozen. The rest was not.
No exploit. No malware forced onto anything. No defect in any product he owned.
The decision point is worth being precise about, because "he should have known better" is the wrong reading and the useless one. He performed every damaging action himself, and each step was individually reasonable given what he believed when he took it. Resetting 2FA is a normal thing to do when support says your account is compromised. Installing a support tool is a normal thing to do when you are being helped.
The failure was that the attacker got to supply the context in which every decision was made. Once that is true, good decisions inside a false context produce a catastrophe just as efficiently as bad ones.
The last lesson gave you a list. This one exists because lists do not work, and pretending they do is how learners get hurt.
You now know the fifteen patterns. So did many of the people in this course's autopsies. The Genesis victim held a nine-figure position and had clearly thought about security. The Ferrari executive in F111-02 caught it, and the Arup finance worker who lost $25.6M was also suspicious and did not.
The gap between knowing and catching is what this lesson is about.
Why knowing is not enough
Recognition is an analytical act. It requires you to be standing outside the situation, comparing what you see against a stored pattern.
Attacks are engineered to prevent exactly that. They put you inside the situation, under time pressure, in an emotional state, with an authority figure supplying the frame. In that state you are not comparing anything against anything. You are reacting.
Victims consistently describe it afterwards as a fog. That fog is not a personal failing and it is not incidental. It is the product. Everything about the delivery is tuned to produce it.
Which means the defence cannot be "know more". Knowledge degrades under load. The defence has to be a procedure that runs without judgment, so that it still works on the day your judgment is the thing being attacked.
The four levers
Urgency. Something must happen now or you lose access, money, or safety. Urgency has exactly one function, which is to remove the interval in which you would have thought. A real institution can wait twenty minutes.
Authority. Support. A regulator. Your employer. The platform. Authority makes compliance feel like cooperation rather than a decision, and it transfers responsibility away from you, which is a relief you will not notice yourself accepting.
Social proof. Other people appear to believe it. Reviews, screenshots, comments, a friend already in. This is the cheapest signal to manufacture and the hardest to ignore, which is a bad combination.
Commitment and consistency. This is the one most people have never heard of and it is doing the heavy lifting in the autopsy. Nobody agrees to install remote access software cold. They agree to confirm their name. Then to confirm an email. Then to a small verification step. Then a slightly larger one. By the time the real request arrives, refusing it would mean contradicting a version of yourself you have been performing for forty minutes.
That is why long-running attacks work on careful people. Each individual step passes a reasonableness test. The sequence never gets tested at all.
If you notice any of these, the script is running.
"I need to handle this now." Manufactured urgency.
"I would look stupid if I missed this." Manufactured scarcity, aimed at your ego rather than your fear.
"I have already come this far." Commitment. This is the most dangerous of the three, because it feels like consistency, which feels like integrity.
None of these are conclusions. They are states. Noticing the state is the skill, and it is more reliable than trying to evaluate the claim while you are in it.
The asymmetry that justifies the pause
The objection to pausing is always the same: most urgent messages are legitimate, and stopping for all of them is unreasonable friction.
Test that.
Suppose you receive 100 messages in your life that create real pressure to act on money quickly. Suppose, generously to the objection, that 99 of them are completely legitimate.
Cost of pausing on all 100, at fifteen minutes each:
100 x 15 minutes = 1,500 minutes = 25 hours
Twenty-five hours, spread across a lifetime. Roughly twenty minutes a year.
Cost of not pausing on the one that was not legitimate: the position. In the autopsy above, $243M. For most readers, everything they hold.
Now put it as a rate. The pause has to prevent a total loss only once per hundred triggers to be worth it. Solve for the break-even probability at which pausing stops paying, using $50,000 as the amount at risk and valuing your time at $100 an hour:
Cost of the pause = 25 hours x $100 = $2,500 Break-even probability = $2,500 / $50,000 = 5 percent
So pausing pays for itself if more than 5 in 100 of these messages are attacks. Given that impersonation grew more than 1400 percent year on year, the honest estimate is not close to 5 percent, and every term in this calculation was set to favour the objection.
There is a second asymmetry underneath the arithmetic, and it is the more important one. The 99 legitimate situations are recoverable. You pause, you verify, you proceed, you lost fifteen minutes. The one attack is not recoverable. Expected value is the wrong frame when one branch is absorbing.
The two habits
Everything above resolves to two procedures. Both work without you being right about anything in the moment, which is the only property that matters.
The fifteen-minute pause. Any message involving typing a seed, signing something, clicking through to a wallet, or sending funds urgently: you stop. Fifteen minutes. Do something else entirely. Come back and act only if it still makes sense.
The mechanism is not that fifteen minutes gives you time to investigate. It is that it removes you from the frame the attacker built, and the frame does not survive your absence. Almost no real opportunity dies in fifteen minutes. Almost every attack does, because urgency was the only thing holding it together.
Tell one person. Before acting on anything unusual involving money, say it out loud to one trusted person.
This is the most underrated defence in this entire course and it is free. Every one of these attacks requires isolation, which is why moving you to direct messages is standard practice. Saying the sentence out loud to someone outside the frame usually collapses it before they even answer, because you hear how it sounds.
This happens to people who are careless, greedy, or not technical.
The evidence points the other way, and it is worth being direct about it because the belief is itself a vulnerability.
The Genesis victim held a nine-figure position. The LastPass victims in F106-05 were described by the researchers who found them as experienced, security-conscious investors showing none of the usual signs of compromise. The Arup employee was suspicious before the call. The Ferrari executive who caught it and the Arup employee who did not were doing the same job at the same level.
Confidence that you are not the type is not a protective factor. It is the thing that makes the pause feel unnecessary, and the pause is the protection. The people who get through this intact are not the ones who believe they cannot be fooled. They are the ones who assumed they could be and installed a procedure that does not care.
After the fact
One thing worth saying now rather than in F106-06, because it belongs to the psychology.
Falling for one of these is among the most isolating experiences a person can have. The shame is heavy and it is disproportionate, because the attack was engineered by professionals to defeat exactly the faculties the victim is now blaming themselves for.
That shame is also load-bearing for the attacker. It is what stops victims telling anyone, which is what keeps the same script working on the next person, and it is what makes the recovery scam in F106-06 so effective on people who will not ask a friend for help.
If it happens to you, the useful move is to talk about it early and factually. If it happens to someone you know, the useful move is not to explain what they should have done.
Attacks are built to put you in a state where recognition does not run, so knowing the list is not protection. They pull four levers: urgency, authority, social proof, and commitment, and commitment is why careful people agree to the last step after agreeing to nine reasonable ones. Because the loss branch is unrecoverable and the pause costs about twenty minutes a year, the arithmetic is not close. Install two procedures that work without judgment: pause fifteen minutes on anything urgent involving keys or funds, and say it out loud to one person before you act.