Singapore police have issued a public warning to cryptocurrency users after hackers exploited compromised email accounts to target holders of digital assets, Yahoo News reported.

The advisory puts a named law enforcement authority — the Singapore Police Force — behind a growing pattern of crypto-related compromise that begins not on-chain but in the inbox. Attackers who gain control of a victim's email account can use that access to reach exchange credentials, password-reset flows, two-factor authentication backups and correspondence containing wallet-related documents.

The police warning underscores a shift in operational risk for retail and institutional crypto holders alike. Attackers no longer need to break exchange security or find flaws in wallet software. Instead, they compromise a single upstream point of failure — the email account — and harvest whatever access it unlocks.

Singapore has positioned itself as one of Asia's most closely regulated digital-asset hubs, with the Monetary Authority of Singapore licensing exchanges and payment providers under the Payment Services Act. A police advisory aimed specifically at crypto users signals that authorities see email-account takeover as a material threat vector within that framework, rather than an isolated consumer issue.

For users, the operational consequences are direct. An email account linked to an exchange registration can expose password-reset chains. Archive folders and old correspondence frequently contain identity documents, recovery phrases shared in error, or statements revealing which platforms a victim uses — enough information for an attacker to mount a targeted follow-on campaign.

The police guidance follows a familiar hierarchy of controls: enable two-factor authentication on email accounts, avoid reusing passwords across exchange and email logins, and treat any unexpected password-reset notification or login alert as a potential compromise in progress rather than a routine message.

The warning also carries implications for the custodial chain. Where an attacker controls email access, exchange-level security measures such as withdrawal whitelists and address confirmation links can be turned against the user, since confirmation messages route to the very inbox the attacker now controls.

Singapore authorities have repeatedly encouraged victims of crypto fraud to report incidents early, a practice that affects whether stolen funds can be traced before they move through mixers or cross-chain bridges. Users who suspect an email compromise are advised to secure the account first, then audit linked exchange and wallet services for unauthorized activity.

The advisory arrives as email-account takeover remains one of the most common initial access techniques reported across the financial sector, and as crypto holders continue to represent a high-value target for exactly this class of attack.