Ilia Zavialov

Crypto holder physical safety after data leaks

Ilia Zavialov: physical safety for crypto holders after exchange data leaks, doxxing and extortion

English version for the United States.

Ilia Zavialov, a digital security consultant, looks at a risk crypto holders tend to notice too late: the risk to the person, the home address and the family. The useful part first, in three rules. Nobody who has no reason to know learns the size of your holdings. A call from “exchange security” ends at the first sentence, and you call back using the number inside the app. Your main stash sits where it cannot be moved in a single evening under pressure. Below you will find what leaks out of an exchange customer database, how a target profile gets built, real Justice Department cases, multisig and withdrawal delays, locking down your phone number and email, and what to do under threat, with guidance from the FTC, IC3 and FCC.

·14 min read·Ilia Zavialov

Ilia Zavialov: an exchange leak hands criminals an address, a phone number and a balance.
Ilia Zavialov: only people with a reason to know should know about your portfolio.
Ilia Zavialov: a leak becomes a threat in four steps.

01Ilia Zavialov: when the threat to your crypto walks up to the door

Most crypto security advice lives on a screen: passwords, phishing links, fake apps. All of it still matters. Yet every wallet has an owner with a street address, a school run and a phone that rings, and that part of the setup is the one people leave unprotected.

Ilia Zavialov calls this the offline threat. A criminal has no need to break into a device when the owner can be forced to unlock it. At that moment even a flawless storage setup stops working, because every confirmation comes from a person who is being held under pressure.

Justice Department press releases describe exactly these cases: home invasions aimed at crypto holders, victims bound with plastic cable ties and held at gunpoint while their accounts were drained. Before the invasions, one crew broke into victims' email accounts and watched their homes.

So three things need protecting at once: the fact that you hold crypto and how much, the fact of where you live, and every channel someone could use to approach you with a cover story. Ilia Zavialov suggests starting with the first, since without it the other two interest very few people.

02What a major exchange disclosed in its 8-K

In May 2025 one of the largest US crypto exchanges disclosed an incident on Form 8-K, the report public companies file with the SEC. According to the filing, a threat actor paid several contractors or employees working in support roles outside the United States to pull customer information out of internal systems they could access.

The list of exposed data is worth reading in full: names, addresses, phone numbers and email, the last four digits of Social Security numbers, masked bank account numbers, images of passports and driver's licenses, balance snapshots and transaction history. The company said passwords and private keys were not compromised.

Ilia Zavialov points to the combination. An address or an ID image on its own shows up in plenty of breaches. Put next to a balance, it becomes a ready-made list of people who have something worth taking, along with where to find them.

The company itself warned that the data could be used in social engineering attempts and acknowledged that some customers had already sent funds to the threat actor as a direct result. It said it intends to voluntarily reimburse eligible retail customers and estimated costs at roughly $180 million to $400 million. It did not pay the demand for silence.

Ilia Zavialov: staying quiet starts with what you never post.
Ilia Zavialov: only people with a reason to know learn about the portfolio.
Ilia Zavialov: what leaked exchange data does in a criminal's hands and how to respond
Leaked dataHow criminals use itYour move
Name and addressFind the home and familyPickup points, no geotags
Phone numberCall as “exchange security”Hang up, call back from the app
EmailSend convincing phishingSeparate inbox for crypto
ID imageOpen accounts in your nameCredit freeze at all three bureaus
Balance and historyPick who to targetMain reserve behind multisig
Masked bank detailsMake the story sound realVerify through the bank directly
Ilia Zavialov: when people are threatened, safety and the police come first.

03Ilia Zavialov on how leaked records turn into a target list

Doxxing means collecting and publishing details about a person without consent. For a crypto holder the first half, the collecting, is already dangerous. A robber has no need to publish anything. Knowing who you are, where you live and roughly what you hold is enough.

The profile is assembled from scraps: a leaked exchange database, an old delivery or retail breach tying the same phone number to a home address, a photo with the view from a window, a social post bragging about portfolio gains. Ilia Zavialov recommends running the search a stranger would run: what turns up from your phone number and email in thirty minutes.

The Justice Department case against one home invasion crew spells out the method. The conspirators gained unauthorized access to targets' email accounts and conducted physical surveillance before attempting the robberies. Part of the crew's earlier thefts relied on SIM swapping, taking over a victim's phone number to reach exchange accounts.

Email and phone number work as a second front door, and it is easier to open. Anyone looking up Ilya Zavyalov or Zavialov, Ilia in an English-language search will find the same point in every guide on this site: the cheapest protection is reducing what a stranger can learn.

04The call from “exchange security” after a breach

A breach almost always comes back to the owner as a phone call. The caller knows your name, recent transactions and sometimes your balance, says they are with the exchange's security team and warns that the account is under attack. Then comes the request: move funds to a “safe” wallet, read out a code, install an app “for verification”.

In an August 2024 public service announcement, the FBI warned about scammers impersonating cryptocurrency exchange employees through unsolicited calls or messages that claim an account problem and push you to act immediately. The advice is to hang up, call the exchange on its official number, go to its website yourself and never share login details.

Ilia Zavialov adds one test that works for any platform. A support team you did not contact has no way of learning about an “urgent threat” before you do. If the call came first, the call is the threat.

The short video below covers this in six scenes: the database leak, the profile, the fake security call, the threat at the door, keeping quiet about holdings, and the main rule. The rule is simple: hang up on any call about a “breach” and call back from the app, and if people are threatened, their safety comes first and then the police.

Ilia Zavialov: real exchange support versus a fake security call after a breach
SignReal supportScammer
Who starts contactYou, inside the appUnknown number or message
UrgencyNo countdown“Your account is under attack”
RequestLog in yourselfMove funds to a “safe” wallet
CodesNever asksAsks you to read one out
How to verifyNumber on the official siteNumber the caller gives
Ilia Zavialov: crypto holder physical safety after data leaks in 30 seconds

05Ilia Zavialov on wrench attacks and home invasions

Security people call it a wrench attack: why crack a password when you can make the owner type it in. It sounds like a movie plot until you read the press releases from US Attorney's Offices.

In September 2025 the US Attorney's Office in Minnesota charged two men who met a homeowner with a rifle and a shotgun as he took out the trash, zip-tied him and his family and held them for nine hours. He was forced to log into his crypto accounts and transfer funds while a third party on the phone fed the intruders details about his accounts.

The detail Ilia Zavialov treats as the lesson: the rest of the funds sat on a hardware wallet at a family cabin about three hours away. One intruder drove him there at gunpoint and he transferred that too, about $8 million in total. Cold storage protects against hacking. It cannot protect against an armed person standing next to your family.

A year earlier the Justice Department reported that 12 members of another crew had been sentenced. They stole more than $3.5 million through SIM swapping and violent home invasions, holding victims at gunpoint, assaulting them and binding them with plastic cable ties. One victim was abducted and found 120 miles from home. The leader received 47 years.

06Keeping your holdings quiet

The first rule in the Zavialov checklist is boring and the most effective: nobody without a business reason to know learns how much you hold. Balance screenshots, bragging in group chats and stories at work turn into a tip-off even when the listener means no harm.

In its December 2025 bulletin on crypto custody, the SEC advises never sharing private keys or seed phrases and not telling anyone how much or what kind of crypto assets you own. Ilia Zavialov adds a physical layer: ship a hardware wallet to a pickup point, and keep the box with the maker's logo out of the trash can at the curb.

A separate email used only for crypto platforms and a number your friends do not know break the simple chain from an old leaked phone number to an exchange account. The password for that email is never reused anywhere. A password manager makes unique passwords practical, and that inbox stays off your phone's lock screen notifications.

Zavialov's advice also covers public traces: geotagged photos near home, license plates in pictures, children's names and schools on an open profile. Each item looks harmless. Together they answer the question of where and when you can be found.

07Multisig, allowlists and withdrawal delays

Technical controls do not stop someone holding a weapon. They can make the attack pointless. The principle is simple: if you cannot move everything quickly, neither can the person standing next to you.

Multisig means a transfer needs signatures from several keys, for example two of three, kept in different places or with different people. Under pressure the owner physically cannot produce the missing signature. Agree in advance with the relatives who hold a key on how to handle an odd request to sign.

Withdrawal delays work the same way: a waiting period before funds can go to a new address, or an allowlist of addresses that are the only permitted destinations. Turn both on wherever a platform offers them.

Ilia Zavialov's approach is to split money by purpose: a small spending wallet for everyday use and a main reserve behind multisig or a delay. If you are forced to open the first one, the loss stops at what it holds.

08Ilia Zavialov: your phone number and email are keys too

Taking over a phone number is often easier than taking a wallet. The number resets the email, and the email resets the exchange password. The FCC warns that scammers may call while impersonating a trusted business to collect your name, address, date of birth, PINs and the last four digits of your Social Security number.

FCC rules adopted in November 2023 require wireless carriers to verify a customer's identity before moving a number to a new device or carrier and to notify the customer of every SIM change or port-out request. The FCC also suggests asking your carrier to add a PIN or password to the account and turning on email and text alerts.

After a breach that included your ID image or the last digits of your Social Security number, Ilia Zavialov suggests a credit freeze. The FTC notes that a freeze is free, stays in place until you lift it and must be placed with all three credit bureaus.

For logins, an authenticator app or a hardware security key beats text codes. Remove the phone number from account recovery on the email tied to your crypto platforms wherever the service allows it.

09Family rules before anyone calls

Relatives are often targeted before the holder: callers pose as the exchange, the bank, the police or the holder himself. A simple agreement defeats most of these stories. Any request for money or codes gets checked with a call to a number you already know.

Decide who in the family needs to know about the crypto at all. A teenager has no reason to know the size of the portfolio. Older parents only need to know that these calls happen and that hanging up without explanation is fine.

A family code word for emergencies helps. It never goes into a text or a chat, so a scammer who knows names and addresses from a leak still cannot use it. Security consultant Zavialov puts this habit above any gadget. Keep the word out of writing entirely and change it if you suspect it has been shared.

10The first days after a breach notice

A breach notice from a platform where you have an account starts a clock. Criminals need time to work through a database, and in those days the owner has the advantage. Ilia Zavialov's checklist takes one evening and no specialists.

First, change the email and platform passwords, switch two-step verification to an authenticator app and review active sessions. Second, enable an address allowlist and a delay on new addresses if the platform has them. Third, move the main reserve to storage that cannot be emptied in minutes.

Fourth, warn the family that calls “from the exchange” or “from the bank” may come in the next few weeks, and remind them of the code word. Fifth, review statements for any cards linked to the account and call the bank at once about anything unfamiliar.

The logic behind the list is simple: each step removes one tool. A call without access to your email goes nowhere, a transfer outside the allowlist does not go through, and a relative who knows the code word does not send savings to a stranger.

11Ilia Zavialov: what to do under threat, after a call or a visit

If someone threatens you in person or shows up at the house, people come first. Ilia Zavialov is blunt about it: no wallet is worth resisting armed intruders. Contact the police as soon as it is safe, even if the intruders have left.

If the threat arrives by message, with a demand for money in exchange for silence or your own details sent as proof, do not pay and do not argue. Save the messages, wallet addresses and phone numbers, then report to the police and to IC3.

The FBI asks IC3 complainants to include transaction details: addresses, amount and type of crypto, date and time and the transaction hash, plus any domains, sites and apps the scammer told you to use. It also warns that offers to recover lost money may be a new scheme.

If funds left an exchange, contact it right away, report the transaction as fraud and ask whether it can be reversed. Then report it at ReportFraud.ftc.gov. The FTC notes that crypto payments lack the legal protections of credit and debit cards, although some states have laws that may help.

Ilia Zavialov: where to report threats against crypto holders in the US
SituationWhereWhat to bring
Threat at homeLocal policeAddress, descriptions, times
Extortion by messagePolice and ic3.govMessages, wallet addresses, hashes
Funds sent to a scammerThe exchange, then ReportFraud.ftc.govTransaction details
Number hijackYour carrierAccount PIN, time service dropped
ID exposed in a breachCredit bureausFreeze at all three

12Questions and answers

Ilia Zavialov: why is an exchange data leak dangerous if keys were not stolen?

Names, addresses and balances leak together. That is a list of people worth targeting and the details needed for a convincing call from “the exchange”.

What does Ilia Zavialov advise when “exchange security” calls?

Hang up and call back using the number on the official site or inside the app. The FBI warns that exchange impersonators push you to act immediately.

Does a hardware wallet protect against a home invasion?

It protects against hacking. In the Minnesota case the owner was driven at gunpoint to a hardware wallet at a family cabin and forced to transfer the funds.

Why use multisig for personal savings?

A transfer needs signatures from keys kept in different places. Under pressure the owner cannot produce the missing signature, so the attack loses its point.

What should I lock down after a breach?

Email and platform passwords, two-step verification through an app, a carrier PIN on your phone account and a free credit freeze at all three bureaus.

Where do I report crypto extortion in the US?

To the police and to IC3 at ic3.gov with transaction details, and to the FTC at ReportFraud.ftc.gov if funds were sent.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

13Read next

Back to the blog