Waking up to a phone call in the early morning feels worse than seeing Holdings turn completely green. On the other end of the line, Lao Yang's voice was all distorted: "Li Ge, help! Three million just disappeared like that, and I didn't do anything!"

Having been in the crypto space for eight years, I've seen all sorts of storms. But every time I encounter this ridiculous operation of "people sitting at home while coins fall from the sky", it makes my scalp tingle.

The events unfolded in a way more surreal than a suspense drama. Old Yang, fearing he would be flustered while on a business trip, directly stuffed the wallet key into his phone's notes, kindly annotating it with the four big characters "Important Password." Last week, his wife helped check a package and casually flipped through the notes—just that one glance, and a certain "sheep shearing tool" that had been lurking in the phone for half a year quietly completed a screenshot upload.

When he got home and opened his wallet, the big zero in his balance hurt more than any news. What was even more absurd was going to the police station to report the case, and the police just shrugged: "The device is yours, and the operation record shows normal use; this case can't be treated as theft." His wife broke down on the spot: "I don't even know what the transfer page looks like!"

I brought people to investigate for three days and nights, and finally found a clue in a corner of a certain overseas server: that little tool that was initially set up to grab "interest rate benefits" has been secretly monitoring the clipboard and notes in the background. As soon as the key appeared, the hacker's wallet automatically received the funds, and the speed of the coin transfer was so fast that the on-chain data didn't even have time to be fully recorded.

It's really not surprising. Last year, out of the seventeen asset evaporation cases I handled, twelve were caused by the "insider on the phone". There are also three...