Singapore's exchange raids stop looking like incident response

The Singapore Police Force and the Cyber Security Agency of Singapore have issued a joint advisory on crypto scams built on fake job offers and compromised software systems, putting losses at roughly $11.8 million, or S$15.1 million ^[1]. The figure is not the interesting part; the delivery mechanism behind the response is, because police have now run three joint operations with crypto exchanges inside about four months ^{[15][8][9][10]}.

The advisory covers two quite different attacks. The retail version starts with a social media advertisement for an online job or an investment return, after which someone posing as a guide walks the victim through opening a crypto account and buying tokens; the payout never arrives, and some targets are talked into surrendering login details or a seed phrase ^[7]. The enterprise version, as described by Decrypt, is a supply-chain compromise wearing a recruiter's clothes: an approach on LinkedIn, a move to email from a spoofed domain, several Google Meet interviews with the interviewer's camera off ^[2], then a coding assessment on a spoofed site completed on a company-issued laptop, which installed malware ^[3]. The malware captured a session token, which represents an already-authenticated session and so walked past multi-factor authentication into the victim's Bitbucket account ^[4]. From there the attackers altered the employer's systems, reached internal servers and harvested credentials used to get around transaction limits and approval checks ^[5]. The agencies name no company, no destination for the funds, and no attacker ^[6].

The operational cadence is where this stops being a warning notice. From March 16 to April 15, police blocked about S$2.86 million with Coinbase and Upbit, interrupting more than 90 cases in which victims had already started sending funds ^[8]. A six-week follow-on from April 16 to May 31 stopped more than S$4.2 million with seven firms, including Coinbase, Coinhako, Gemini, Independent Reserve, OKX and StraitsX ^[9]. June added more than S$2.9 million and contact with over 130 people flagged by exchanges ^[10]. That is roughly S$9.96 million blocked across the three ^[18], about two-thirds the size of the single fake-job loss the advisory describes ^[17] and about 5 per cent of the S$182.2 million Singapore lost to crypto-linked scams in 2025 ^[19]. Chainalysis and TRM Labs supplied the tracing tools to the Anti-Scam Centre and Cyber Investigation Branch for all three ^[11], and in June the SPF passed blockchain intelligence to the FBI and the New South Wales Police cybercrime squad ^[12]. Same tooling, same partners, escalating scope: that is a standing process, not a task force.

The backdrop is a market where headline numbers are improving unevenly. Total scam and cybercrime cases fell 24.8 per cent to 41,974 in 2025 and losses fell to S$913.1 million from about S$1.1 billion ^[14], but crypto was still about a fifth of the total ^[13], and average loss per case rose roughly 10 per cent, to about S$21,800 ^[20]. Fewer victims, each worth more.

For operators, the corporate half of the advisory is the actionable half: secure API keys and internal credentials, harden MFA, watch for unfamiliar devices, and on suspected compromise isolate systems, revoke active sessions and reset credentials ^[16]. Two things to watch. Whether the seven-firm April operation becomes the floor for participation rather than a high-water mark, and whether any exchange that declines to share customer signals gets named. Note also that Cryptopolitan dates these operations to 2026 while the loss baseline is 2025 ^[15][13]; the year labelling in secondary coverage is worth checking against the SPF's own releases.