- Trending
- Comments
- Latest
The suspected Crypto wallet hack came to light when the victim noticed that digital assets had been transferred without his knowledge or authorization.
The man reportedly discovered the missing cryptocurrency at approximately 1 p.m. on Friday, October 9, while in Teluk Intan, Perak. Although Bernama identified him as 38 years old, a separate report by The Star gave his age as 39. Authorities have not publicly clarified the discrepancy.
Police have withheld the victim’s identity and have not disclosed which cryptocurrencies were stolen, the type of wallet involved or the blockchain network used to process the transfers.
Perak police chief Mohd Alwi Zainal Abidin provided an initial explanation of the transaction activity, stating: “Preliminary investigation found that the transaction involved the transfer of crypto assets through a blockchain network.”
The statement confirms that cryptocurrency transfers were identified during the preliminary investigation, but it does not establish how the perpetrator gained access to the assets.
Several scenarios remain possible, including phishing, stolen passwords, compromised recovery phrases, malicious software or unauthorized access through a cryptocurrency service. However, none of these methods has been confirmed in connection with the Malaysian case.
It is also unclear whether the victim used a self-custody wallet, a hardware wallet or an account associated with a cryptocurrency exchange. These distinctions matter because the security mechanisms, recovery options and investigative procedures can differ substantially between wallet types.
The RM12.47 million figure represents the reported value of the missing assets. Police have not released a transaction-by-transaction breakdown or identified the individual cryptocurrencies involved.
Authorities are investigating the incident under Section 420 of Malaysia’s Penal Code, which addresses cheating and dishonestly inducing the delivery of property. The investigation remains ongoing, and no individual has been publicly identified as responsible for the suspected theft.
Following the victim’s complaint, Perak police enlisted assistance from the cryptocurrency unit within the Bukit Aman Commercial Crime Investigation Department.
The specialist team is helping investigators examine the movement of the missing assets across the relevant blockchain network. The objective is to establish where the cryptocurrency went after leaving the victim’s wallet and determine whether any transactions can be connected to identifiable individuals or services.
Malaysia’s public broadcaster RTM also reported on October 10 that the cryptocurrency unit was assisting with the investigation.
Blockchain records can provide investigators with transaction histories, including transfers between wallet addresses. Depending on the network, these records may be publicly accessible and can help investigators follow the movement of digital assets.
However, tracing cryptocurrency does not automatically reveal the identity of the person controlling a particular wallet. Investigators may need additional evidence from cryptocurrency exchanges, service providers or other entities to connect wallet addresses with real-world identities.
In this case, police have not released wallet addresses, transaction identification numbers or details of cryptocurrency exchanges that may have received the missing funds.
Authorities have also not confirmed whether the assets were moved through additional wallets, converted into other cryptocurrencies or transferred to platforms where they could potentially be frozen.
No recovery, seizure or freezing of the missing assets has been announced.
The suspected Crypto wallet hack is being investigated under Section 420 of the Penal Code, which carries potential penalties of imprisonment ranging from one to 10 years, whipping and a fine, according to the reports. These penalties apply to individuals convicted of the relevant offense; they do not establish that a crime has been conclusively attributed to any particular person in this case.
As of the latest reported police statements on October 10, investigators had not announced any arrests, formal charges or court proceedings connected to the incident.
Alongside the investigation, Perak police issued cybersecurity advice aimed at helping cryptocurrency holders protect their digital assets from unauthorized access.
Mohd Alwi urged users to exercise caution when opening suspicious links and to avoid sharing sensitive wallet information with other people. According to an October 10 report by Utusan Malaysia, the police chief specifically warned cryptocurrency holders to protect their recovery phrases, private keys and passwords.
A recovery phrase is a sequence of words that can restore access to a cryptocurrency wallet. If another person obtains it, that individual may be able to control the wallet and transfer its assets without needing the original device.
Private keys serve a related purpose by authorizing transactions involving cryptocurrency held at an address. Anyone who gains control of the relevant private key may be able to move the associated assets, depending on the wallet’s security arrangements.
The police advice included several practical precautions: regularly checking transaction histories, reviewing applications connected to wallets and separating wallets used for long-term storage from those used for everyday transactions.
Users who suspect their devices have been compromised were advised to stop using the affected devices, preserve digital evidence, contact relevant service providers through official channels and report the incident to the police.
These recommendations are general preventive measures. Authorities have not established that phishing, malicious software or the exposure of recovery information caused the suspected Crypto wallet hack in Teluk Intan.
The incident nevertheless highlights the importance of protecting wallet credentials and verifying transaction requests before authorizing them. Cryptocurrency transfers can be difficult to reverse once they have been confirmed on a blockchain, particularly when the recipient cannot be identified or contacted.
A separate security investigation published on October 5 examined malicious USDG wallet approvals associated with a wallet-draining scheme. Security firm Salus found that malicious permit signatures could authorize spending and enable transfers within the same blockchain transaction.
That incident illustrates one way attackers may exploit transaction permissions, but investigators have not linked it to the Malaysian case. The two incidents remain separate, and the technical circumstances of the Teluk Intan theft are still unknown.
The suspected Crypto wallet hack in Malaysia comes amid other reported incidents involving unauthorized cryptocurrency transfers and compromised digital asset wallets.
In July 2026, payment services company Triple-A disclosed that attackers had gained unauthorized access to company-owned cryptocurrency wallets. The company confirmed that digital assets had been stolen but stated that customer funds were not affected.
Blockchain investigators initially estimated the losses at approximately $11.8 million. Triple-A said it was working with cybersecurity specialists and Singapore police to investigate the incident and trace the missing cryptocurrency.
Another reported incident in July involved an Ethereum wallet user who allegedly lost nearly $1 million after approving a malicious transaction. The case was associated with a fraudulent authorization that allowed cryptocurrency to be transferred from the affected wallet.
Although these incidents demonstrate the range of risks facing digital asset holders, neither establishes how the Malaysian victim’s funds disappeared.
Malaysia has also been investigating other suspected financial crime operations involving digital payment services. On October 2, Bernama reported that Perak police had arrested 13 people suspected of operating a payment network using Alipay accounts to move proceeds from online gambling scams.
The suspects, comprising five Malaysians and eight Myanmar nationals, were arrested during raids conducted on September 28. Police alleged that the group recruited individuals to provide personal information for opening payment accounts that were subsequently used to process suspected criminal proceeds.
That investigation is separate from the cryptocurrency theft reported in Teluk Intan and should not be interpreted as evidence of a connection between the cases.
For the reported RM12.47 million loss, the Bukit Aman cryptocurrency unit continues to assist Perak investigators in tracing the transactions and examining the movement of the missing digital assets.
The latest available police statements did not identify a suspect, establish the method of unauthorized access or provide a timeline for recovering the funds.
Until investigators release further findings, the Crypto wallet hack remains a suspected theft under investigation rather than a case in which the perpetrator or technical cause has been conclusively established.
The outcome may depend on whether investigators can follow the cryptocurrency to identifiable services or individuals and obtain sufficient evidence to establish who controlled the transactions.
For cryptocurrency users, the case reinforces the importance of safeguarding recovery phrases and private keys, checking wallet activity regularly and treating unexpected requests for account information or transaction approval with caution.
Copyright © 2025 - The Bit Gazette.
