$282 million stolen from a single person, without breaking a single line of code
Listen to the audio version
The article on the Coldcard hack described a hardware wallet theft caused by a flaw in the code. An incident from January 10, 2026, more than twice as costly, shows the exact opposite: no code was broken, only a person convinced to do the work herself.
What happened
On January 10, 2026, around 23:00 UTC, a person lost about 2.05 million litecoins and 1,459 bitcoins, an amount valued at over $282 million at the time, according to independent blockchain investigator ZachXBT. This is the largest individual cryptocurrency theft recorded in 2026, surpassing the previous record for this kind of theft, $243 million stolen in August 2024.
A hardware wallet, but a victim convinced to authorize it herself
The victim held her funds on a hardware wallet, the strongest protection against a remote hack (see the dedicated article). According to available information, someone posing as technical support walked the victim through a supposed "recovery" procedure for her wallet, a social engineering manipulation (see the dedicated article) rather than a technical attack against the device itself. A hardware wallet's central promise, that the private key never leaves it, technically held up: nobody hacked the device remotely. The problem sat elsewhere, exactly as the article on crypto scams already pointed out: no legitimate support ever asks for a recovery phrase, or asks you to do anything that would let a third party act on a wallet, whatever reason is given.
Why the laundering went through Monero
Once the funds were stolen, the attacker quickly converted a large share of the stolen bitcoin and litecoin into Monero, through several instant-exchange platforms, before moving part of the remaining funds across several blockchains through a cross-chain bridge protocol. This choice isn't incidental: unlike Bitcoin, whose ledger stays fully public and viewable by anyone (see the article on blockchain), Monero is specifically designed to hide, by default, the sender, recipient, and amount of every transaction. Converting stolen funds into Monero makes their later path far harder for investigators to trace, one of the reasons this cryptocurrency comes up so often in laundering cases following a theft of this scale.
What this actually changes
This incident confirms, at an unusual scale, a lesson already repeated several times on this site: owning the strongest security tool there is protects nothing if its owner is convinced to bypass that protection themselves. No technical upgrade would have prevented this theft; only strictly following a reflex already stated several times here would have been enough: never follow instructions from unsolicited support, and verify their identity through a fully independent channel before doing anything at all to a wallet, whatever amount is at stake, and especially when that amount is considerable.