Trader Frogman Says Attackers Stole Over $4 Million at TOKEN2049

Crypto trader Frogman reports that attackers stole more than $4 million in tokens from two of his main wallets during the TOKEN2049 conference in Singapore. He said the theft spanned nine token types and that his own monitoring points to a wider campaign aimed at conference attendees rather than an isolated incident.

Frogman described the operation as a layered social-engineering effort built around network access. According to his account, attackers deployed fake wireless networks that imitated legitimate connections at hotels, airports and the event venue itself. Attendees connecting to these lookalike hotspots exposed their devices to interception.

What tactics did the attackers use?

The trader outlined three distinct methods in the campaign:

• Fake Wi-Fi networks spoofing known hotspots at hotels, airports and the TOKEN2049 venue
• Phishing pages designed to harvest credentials and device data
• Malicious application updates that delivered malware onto victims' devices

The goal, he said, was not a single dramatic breach but the gradual collection of device data that could then be used to reach funds held in hot wallets. That distinction matters for operational risk: hot wallets, by design, keep private keys internet-connected, and any compromise of the underlying device extends directly to the funds.

A $4 million loss across nine token types from two wallets implies broad token diversity in internet-connected storage. Frogman did not detail the split between the affected assets, and his figures have not been independently verified against on-chain records at the time of reporting.

Have victims gone to the authorities?

People affected by related incidents have filed reports with the Singapore police, according to Frogman's account. Singapore's police force has not, in the material available, confirmed the number of reports, the scope of the investigation or any suspects identified. The absence of official confirmation is standard at this stage, but it means the full scale of the campaign remains an open question rather than an established fact.

Conference-season targeting is not new, but the reported mechanics here are specific. Spoofed infrastructure at hotels and airports extends the attack surface well beyond the venue itself, meaning attendees who never connected at the event could still have been exposed in the days around it. Frogman's claim of a wider campaign rests on his own monitoring; no third-party analysis has yet corroborated how many wallets or victims are involved.

For institutions and frequent conference-goers, the operational lesson is straightforward. Hardware-isolated key storage, avoidance of open wireless networks in favor of personal hotspots, and skepticism toward unsolicited app updates during travel weeks reduce the specific vectors described. None of these measures is novel, yet the reported loss suggests they were absent where they mattered.

What comes next?

The practical question now is whether Singaporean police confirm the reports and whether on-chain analysts trace the drained funds to identifiable wallets. Until either happens, the $4 million figure stands on the word of one trader, whose monitoring was thorough enough to detect the pattern but not yet enough to attribute it.