Skip to content
Case Study · CW-2026-0445 · Seed-phrase wallet-drainer phishing

A Fake ‘Wallet Sync’ From GlobalSignalsFX Emptied a Wallet in Minutes: AUD 124,000

A Melbourne business owner was told by ‘support’ at GlobalSignalsFX that he needed to ‘sync’ his wallet by entering his recovery phrase to release a withdrawal. Within minutes the wallet was empty. Here is the trace — and the hard limits on recovery.

MethodFake ‘wallet sync’ requesting recovery phrase
Reported lossAUD 124,000 (ETH + ERC-20)
TimelineMinutes
Recovered55% recovered
OutcomePartial recovery

How the scam unfolded

He had funds tied up on GlobalSignalsFX and chased a stalled withdrawal. A live-chat ‘agent’ told him to ‘verify and sync’ his external wallet by entering his 12-word recovery phrase into a ‘secure validation’ field so the platform could ‘match’ his address.

Where it went wrong

A recovery phrase is the wallet. The moment he entered it, attackers imported his wallet and swept the ETH and every ERC-20 token to a drainer address in a rapid sequence of transactions. The ‘withdrawal’ was never coming.

“I thought I was talking to my platform’s support. I didn’t send anything anywhere — I just typed in my words. That was all it took.”— James, Melbourne, AU

How the recovery worked

  1. 1
    Documented the drain. We reconstructed the full sweep — every token, every transaction, every destination.
  2. 2
    Traced to consolidation. The tokens were swapped to ETH and consolidated; part went to a mixer, part toward exchanges.
  3. 3
    Targeted the reachable deposit. Two consolidation wallets deposited to centralized exchanges with compliance processes.
  4. 4
    Filed for freezes. We submitted the trace and report; both exchanges froze the linked balances.
  5. 5
    Recovered the frozen portions. After review, those balances were returned — 55% of the loss.
Recovered for the client55%

Seed-phrase drains are immediate and usually devastating. Here, two branches reached cooperating exchanges before cash-out, so more than half came back; the mixed portion was lost.

Warning signs to remember

  • Any site, person or ‘support agent’ asking for your recovery/seed phrase — no legitimate party ever needs it.
  • A ‘sync,’ ‘validate’ or ‘verify’ step that asks you to type your 12 or 24 words.
  • A platform support chat that wants access to your external wallet.
  • Urgency from a ‘live agent’ while a withdrawal is ‘pending.’
What you can learn
  • Your recovery phrase should never be typed into any website, app or chat — ever.
  • No legitimate platform can ‘sync’ or ‘match’ your external wallet using your phrase.
  • If a withdrawal stalls, that is a red flag in itself — not a reason to hand over more access.

Think this has happened to you?

If you’ve lost crypto to an operator like this, the first hours matter. Our team will review your case and tell you honestly what can and can’t be recovered — at no upfront cost.

Talk to a recovery specialist →
Disclaimer: Cryptowledge provides digital-asset investigative and recovery-assistance services. Past case outcomes do not guarantee future recovery. Recovery is not possible in every case and depends on the specific circumstances, transaction path, and cooperation of third parties. Cryptowledge is not a law firm, financial advisor, or regulated financial institution and does not provide legal, tax, or investment advice. All consultations are confidential. © 2026 Cryptowledge. All rights reserved.