'Even smart people fall into the trap': The crypto scam fooling Israelis

There's a moment that haunts every crypto scam victim – a text message alert, an incoming call, an email notification. What seemed innocent seconds ago becomes a pipeline draining money, data, and sometimes entire lives. In recent months, Israeli police have logged dozens of crypto fraud complaints, from romance scams to multimillion-dollar thefts. In some cases, local criminals stand behind them; others operate from abroad; and most exploit the same human weakness: trust.

In many cases, it starts with a "romantic" approach. "There are periods when suddenly Tinder is flooded with profiles of Asian women," begins Yiftach Rotem, co-founder of cybersecurity firm Cyvore, opening a window into the dark world of crypto scams. "They're all verified with blue checkmarks, they all appear close to you, they're all supposedly here in Israel. You start texting, admittedly in English, and it's nice, it feels innocent, and very quickly she starts with the story about an uncle she's making money with from crypto. 'If it interests you, I can connect you with him.' It always gets there."

Rotem knows this moment well. Not because he fell for it – quite the opposite. And yet, even he sometimes finds himself sitting in front of his phone, wondering whether behind the verified profile on the innocent dating app, there really is someone genuine. "It's pathetic," he says. "People fall for this left and right. Hundreds of profiles, the same photos, different names, all verified, and many of them aren't even operated by human beings. Artificial intelligence conducts a conversation with you. It's easy."

And if the heartbreak generated by this type of scam wasn't enough, it also earned the colorful nickname "Pig Butchering" – a term that comes from China, where the method was born. Before butchering a pig, it's customary to fatten it, invest in it, and nurture it, so that at the moment of slaughter the profit will be greater. In other words, the scam isn't based on a momentary trick, but on creating a "real and warm" relationship with the victim. The scammer feeds them with love and hope – and then slaughters them financially. And the more virtual and anonymous our money becomes, the easier it is to slaughter us. They're looking for connection and support, and then you can relatively easily convince them to transfer funds, sometimes tens of thousands of shekels, to someone they've never met."

We set out to examine how new crime organizations operate in the virtual space, which Israelis fall for these scams, how one can be careful about them, what the police are doing (or not doing) about it, and whether it's even possible to trust a digital wallet. The stories we heard and the answers we received are not exactly reassuring, to put it mildly."

"Your family will be harmed"

It looked like a routine morning in a family apartment in Herzliya. A couple and two daughters. At 8:10 AM, the father, Guy (pseudonym), opened the door, and two men in black masks stormed at him. A hard kick to the chest, a push backward, and he was thrust into the apartment. A third man entered behind them, and before Guy understood what was happening, he was dragged to the safe room and seated on the floor facing the wall, his hands tied behind his back with a cable the uninvited guests found. The stunned Guy tried to raise his head. "If you look at us, we'll stab you," he heard a threatening voice, and immediately after felt a blow, and then another. The robbers beat him with kicks and fists mercilessly.

At some point, one of them approached him and called him by name. This was the moment fear took control of him – they know who he is. They know much more about him than he thought. And then one of them said a sentence no one wants to hear in their home: "We came to take money. We're from the Qaraja family." "What money?" Guy asked in bewilderment. What does he have to do with the Qaraja crime family, he thought to himself. He heard footsteps moving away, drawers opening and slamming, and then footsteps returning and approaching. Suddenly, he felt cold metal pressed against his neck.

The robbers demanded Guy transfer 500 bitcoins to them at knifepoint, worth more than 55 million dollars. Guy tried to say he doesn't have it. In response, they continued beating him, burst into rooms, and overturned their contents searching for the digital wallet. Meanwhile, Guy heard one of the intruders tell him in a heavy Arabic accent: "Let me get you out of this event alive. Transfer what you owe, and I'll make sure they don't kill you, but if you don't cooperate, I won't be able to stop the guys. Now open 'Exodus'."

Guy understood he had no choice. He gave in, opened the laptop, and brought up the Exodus app, the digital wallet where he kept his coins. They demanded the transfer code. When he hesitated, they threatened him: "If you don't hand over the code – we'll stab and kill you." He gave them the code trembling, and they started transferring coins from his digital wallet to their digital wallet – but the nerve-wracking event didn't end there, because the robbers received a phone call after which they became more violent. "The money didn't go through!" one of them hurled at Guy. This time, it cost him a stab wound in each leg.

The robbers transferred about 547,000 dollars in bitcoin from Guy's wallet to theirs, and another 42,000 dollars in USDT (a dollar-pegged stablecoin). Along the way, they removed a Rolex watch worth 189,800 shekels from his hand. Before they left, they demanded he transfer additional coins to them when they make contact, and threatened: "If you go to the police, your family will be harmed." Only after an hour and ten minutes of the nightmare did they leave the house.

Guy remained tied on the floor, blood dripping from his thigh and knee, alone in the house that until a moment ago was the safest place in the world. After they disappeared, the robbers continued transferring funds between different wallets and to trading platforms abroad to cover their tracks. Guy already thought the nightmare was behind him – except then the phone rang again. On the line was that familiar voice from the violent event, and this time he demanded the code for the "Trezor" wallet. Guy tried to explain that the wallet is empty, there's nothing there, but on the other side of the line, they weren't looking for explanations, but issued an ultimatum: 24 hours to transfer additional coins. And then came a threat that froze his blood: "Wherever you moved the wife and children, we're coming. Guy, understand, we're not leaving you."

Pig butchering

The next day, Israel Police already arrested Murad Mahajana, a 46-year-old Jaffa resident, and about two months ago, a severe indictment was filed against him at the Tel Aviv District Court. The police haven't managed to locate his crime partners to this day, but that doesn't mean they're not investing efforts in trying to combat the expanding phenomenon. At the National Cyber Unit, Lahav 433 (Israel's major crimes division), they're learning to identify criminals who have no name, only a blockchain address. Facing them stand criminals becoming more sophisticated at a dizzying pace, using artificial intelligence, and knowing the chance of getting caught is small. In this race, it seems the scammers are always one step ahead.

"We're basically crypto analysts," explains Master Sergeant Shmarit Reis, head of a department in the unit that tracks the money. "We deal with everything related to analyzing cryptographic wallets and identifying identities – who stands behind a cryptographic wallet? Who is the user?"

This isn't just a technical question. Analyzing cryptographic wallets is a real intelligence tool. "We work on two main axes," Master Sergeant Reis continues. "One is serious crime and organized crime, and the other is related to the security field of terror financing. Crime organizations are working hard on this. We see very large activity of crime organizations in the cryptographic world."

Alongside crime organizations, she points to another phenomenon harming ordinary citizens – illegal crypto trading on social media. "People look at the high interest rate and fall into the trap. The moment they decide to trade crypto with people they don't know, they enter a situation of real danger. In Israel, only five companies are allowed to trade in crypto. Everything you can see on Telegram or fabricated profiles on Instagram is not legal, and also dangerous."

Master Sergeant Reis lists several common crypto scams. The first is simple old fraud, where "it's not certain that whoever stands behind the user offering you a deal actually brings money in return," she says. The second is phishing: "The moment people know you have a digital wallet, they can send you a message impersonating a trading platform, request access to the account, and then take control of everything."

Another fraud format is what's called "social engineering": "People receive calls allegedly from a fictitious trading platform, where they're asked for permissions or passwords, and then they simply steal their money," Master Sergeant Reis explains. "Therefore, it's important to trade only in a place recognized by law."

 In the police, they call pig butchering "sextortion" – sexual extortion ending in cryptographic transfer by another name. "We ask the public not to pay," says Reis. "The moment you pay, you're exposed to continued extortion. It's recommended to consult with a family member before transferring money, and ask as many questions as possible. Knowledge is power."

Reis also mentions the "Russian scam" – a fraud method known worldwide. "This is a phenomenon we know very well, directed mainly at Russian speakers, often elderly people, who believe a representative of law enforcement is calling them. They show them a picture of a police officer and ask them to transfer money to a crypto wallet. It's very difficult to restore their trust after that."

Is the police even prepared to handle international incidents of this magnitude?

"Yes. Districts can now also analyze these events, but we need citizens to report and document, not to delete what happened out of shame. People are ashamed, think they're stupid for falling – but they're not alone, there are many more victims, and to understand the scope of the phenomenon we must have reporting."

Even if the chance of returning the money is low, the police, according to Reis, try to act: "When we identify a case gaining momentum, with large scopes, we elevate it to national units, but this can only happen if there are complaints."

In fact, crypto has become a money transfer system that bypasses regulation – exactly what criminals need. "A criminal who generates money through illegal means has two options: launder the money and deposit it in a bank, which isn't really possible without being asked where the money is from, or hold cash under the floor tiles, which is dangerous because it can be robbed and the police can seize it. Crypto allows him to hold illegal money without going through the regulator."

"I'm in high-tech. How didn't I identify it?"

On Monday, the Knesset Economics Committee held a session on the regulation of digital currency trading. MK Avi Maoz (Noam Party), who initiated the discussion on the subject, said Israel is lagging a generation behind what's happening in the world. MK Oded Forer (Yisrael Beiteinu Party) noted that no central player is leading the handling of the incident, and that banks are conducting a zero-risk policy. Banking Association representative Tibi Rabinowitz rejected the claim and accused the state of expecting banks to serve as gatekeepers against money laundering, terror financing, and tax evasion. MK Avigdor Lieberman summarized the issue and requested a return to discuss the Bank of Israel's draft new regulation.

But Michael (pseudonym) doesn't care about that. He's 64, divorced, doesn't believe this happened to him, and even less believes he'll get his money back. "I'm a high-tech person. Surely I'd know to identify fraud, but apparently the cobbler really does go barefoot," he says.

It started with a message he received a year ago. "One day, I got a text from someone who introduced herself as Lin, a woman of Chinese origin living in London. She sent me photos and messages, and didn't stop. Every morning 'good morning,' and in the evening, ten messages before she goes to sleep. From here to there, it developed."

Later came calls too – including, he says, a short video call (which turned out to be fake). As a high-tech person, Michael tried to verify his suitor's identity. "I tried to check with AI if the photos she sent me are circulating on the network. Every photo can be scanned today. I couldn't discover anything, so I continued. I went with the flow. When I told her I invest in the capital market, that's what brought me down. The moment she heard that, she apparently set a trap for me."

Pig butchering, sextortion, doesn't matter what you call it – Michael was trapped. "She told me, 'If you're already investing, I have a more interesting proposal,' and told me about an app that connects to a digital wallet, where you can buy crypto coins and receive returns on them. She explained it works like a loan. Crypto developers use the money, and I receive interest of 1%-5% per day in return."

Doesn't that sound too good to be true to you?

"Yes, I thought about it. So I started small: 100 dollars. What could happen? I saw that every day I receive about a dollar, and then I said to myself, 'let's check if it's possible to withdraw the money.' She allowed me to, so from my perspective, the circle closed. There's also interest, and you can withdraw to invest. I invested 6,500 dollars."

You know that's classic, right? Did you share the story with your circle?

"Yes. I have a friend who was next to me a moment before I transferred $20,000, and he told me, 'This is fraud, you're not doing this.' After it happened to me, I realized it happens a lot, even to smart, experienced people. Your eyes and brain are somehow turned off, and you don't see they're turning you around."

Here, the scam moves from the fattening stage to the slaughter stage. The scammers "freeze" the account and claim an action needs to be performed to "release" the funds – an action that always requires an additional deposit, fees, and taxes. In short, more money.

In Michael's case, "My balance in the digital wallet (which Michael didn't yet know was fake) stood at 30,000 dollars. And then she told me that to release the money, I need to deposit 50,000 dollars to reach VIP status. I told her, 'I'm earning 7,500 a day, lend me 20,000, and I'll return it within two days.' She agreed."

Michael deposited the money, and the moment the account reached 50,000 dollars, the scammers withdrew it. "Within ten minutes, I saw before my eyes the account zeroing out. I understood I was scammed. I contacted Israel Police and Interpol, handed over all the correspondence and photos, and even gave them the thief's phone number! I told them he's still answering, and it's possible to talk to him."

And yet, at Tel Aviv District Police, they decided to close the file for lack of evidence, and from Interpol, too, he didn't hear, but that didn't cause him to give up. "Today, I see in the thief's digital wallet my money, but I have no way to return it. I'm not optimistic I'll see the money. I estimate the chances at 50:50."

Anonymous crime

The personal scams, like those experienced firsthand by Michael and Guy, are only a small part of the picture. Last week culminated in one of the largest crypto fraud affairs in Israel. Recently, an indictment was filed at the District Court against brothers Eyal and Eran Sadeh and their brother-in-law Erez Fishler, who allegedly ran a sophisticated and prolonged scam. The indictment, filed by Attorney David Sit from the Tel Aviv District Attorney's Office, attributes to them offenses totaling about 20 million shekels.

Take, for example, the story of an orthodontist from Herzliya who treated Eran Sadeh and his family members. According to the indictment, from the moment it allegedly became known that the doctor possessed many Ethereum coins, they marked him as a target. The defendants began building trust, a critical element in fraud cases of this type. This included meetings at cafes in Tel Aviv and Herzliya, phone calls, and WhatsApp messages loaded with promises. They presented a company they owned that allegedly held a license in the digital currency field, except that, in reality, the license had expired in 2006.

And then came the offer: to invest the family's Ethereum coins in a huge crypto project that Telegram was supposedly about to launch. Fishler said he has a "special connection" at global Telegram, and an opportunity to purchase "under preferential terms." To convince the hesitant doctor, the scammers explained to him that the Ethereum would move to "cold wallets," secure ones not connected to the network, and that it wouldn't move from there without approval. The doctor began transferring amounts of money he believed were being invested in Telegram coins – and then, of course, the coins moved, and a lot.

After the money disappeared, the defendants didn't stop. They continued to build a false reality: wrote on WhatsApp that the deal was "closed," presented forged documents with imaginary returns, and even gave the family cash from time to time as an advance on expected profits. Thus, they convinced the unfortunate family to invest more and more. Only in early 2020 did the family members realize they had fallen victim to a prolonged, widespread, and meticulously planned scam. Over two years, four separate frauds were committed against them, all through false representations, forgeries, and the use of straw wallets. In total, the family lost almost 15 million shekels. The family crashed financially and mentally, according to the indictment.

In general, at the Cyber Department of the State Attorney's Office, headed by Attorney Asaf Shvit, they've recently been identifying an expanding trend of criminals using cryptocurrency to collect funds under the cloak of anonymity, both for theft and for money laundering and tax offenses. Among other things, the department will soon file an indictment against a suspect who sold access to pedophilic databases and sexual content in exchange for crypto.

Like electronic cash

"We encounter quite a few cases of criminals who anonymously advertise fictitious services of one kind or another, and so money won't be traced, they request payment in crypto," explains Attorney Shiri Rom, deputy department head. "Additionally, sometimes we see transfers from wallet to wallet, or conversions of the money to different currencies, splits and bridges, to distance law enforcement authorities from discovering the criminal. This trend doesn't skip over crime organizations, of course. The challenge in investigating offenses in this field is to remove anonymity and expose the criminal holding the crypto. Criminals identify this difficulty and act to exploit it to their benefit."

It seems they don't stop getting more sophisticated.

"True that the criminals' money collection methods are becoming more sophisticated with the use of digital currencies, but law enforcement authorities are also getting more sophisticated, thanks to technological means and international cooperation. Usually, we manage to reach the criminal, and of course, also the money. With the help of cooperation with tax authorities, we confiscate funds, even in those cases where not enough evidence was collected for criminal prosecution," says Attorney Rom.

According to Nir Hirschman, CEO of the Crypto Companies Forum, more than 160 companies in the crypto field operate in Israel today, employing thousands of workers and having already raised billions of dollars. "It's very important not to tarnish this field, which is a technological field," Hirschman requests. "Israelis are actually building the infrastructures of the global crypto world."

The connection between crypto and crime, he says, is less dramatic than it seems. "According to a report by Chainalysis (the world's leading blockchain analysis company), more than 98% of crypto activity is legitimate activity," he clarifies. "The problem isn't in crypto, but in trying to work on people. The same tricks of impersonation, phishing, pressure, and creating urgency also exist with banks, credit cards, and savings accounts. Crypto simply became another layer in this playground. Whoever tries to commit a crime using crypto, in most cases, gets caught."

Attorney Tzabar Shoali, who works in the field and assists with fund recovery in fraud cases, requests that you do not despair, even if you fell into the trap. "Most people think stolen crypto disappeared forever, but that's not always true," he explains. "In many cases, the funds are still sitting in the thief's wallet, and sometimes there's a possibility to freeze them. The problem is that most victims give up in advance. Important to remember: the decentralized financial world places great responsibility on individuals for their money and investments. A combination of caution and increased responsibility will ensure good protection of assets."

Tel Aviv District Police responded to Michael's case: "With receipt of the complaint, an investigation was opened, and when it wasn't possible to reach the suspect's identity, the investigation file was closed. As long as new information is received that can lead to development in the investigation, the matter will be handled accordingly."