One Tap Short of Handing Over 0.4 BTC

8:12 a.m. on Tuesday, Apr 14, my phone lay face-up on a jar of peanut butter and I had already typed five of the six digits into a page I believed was my exchange account. One digit left. My thumb hung over the 7 while the kettle screamed behind me, and the whole $34,000 question came down to whether that thumb came down or didn't.

Those six digits were the last wall in front of 0.4 BTC, worth about $34,000 that week and equal to approximately 61 percent of everything I hold in crypto, plus the $6,000 of my sister's wedding money I had promised in March to keep growing. Every dollar I stage out of my high-yield savings to buy dips walks thru that same login too. One tap. That was the entire wall.

No antivirus caught this and no stroke of genius saved me either. A second buzz did. Twenty seconds after the fake page loaded, the genuine app fired a real push notification, and the twenty-second gap between those two buzzes, the gap where two codes existed at once, is the load-bearing detail of everything that follows, all the way down to a sender address ending in .top.

two buzzes, twenty seconds apart

The first buzz landed at 8:09 a.m. and slid down my screen as an email banner: new device login, Chrome on Windows 11, Lisbon, Portugal, tap here to secure your account. The second buzz arrived at 8:09:20, from the real app, asking me to approve a login attempt I had never began. Both alerts claimed to protect the same account. One of them wanted my morning. The other wanted my coins.

I wanna be honest about the five digits that came before the pause. They went in without a single conscious reckoned, pure muscle memory from a hundred prior approvals, and the page they went into was convincing down to the loading spinner and the kerning on the logo. Fatigue did the engineering. The crooks just supplied the timing.

the email that knew too much

The message had real seasoning: my correct email, the last four digits of an old phone number, a warning that my session would be "suspended within 24 hours" if I did not confirm the new device. It also arrived on a morning when I had already tapped approve on eleven legitimate 2FA prompts since March 1 without reading one of them closely. Eleven approvals, zero reads. That ratio is the vulnerability, and no audit ever scans for it.

By my own rough count I had been approving something security-related every nine waking hours that spring, across a work VPN, two banking apps, three delivery apps, and the exchange itself. Each prompt trains the thumb. Each tap teaches the brain that codes are chores instead of keys, which is precisely the lesson a phishing kit is built to cash in on.

a domain that ended in .top

The rescue was arithmetic, not bravery. Two codes on one screen, requested by two different senders, twenty seconds apart, can only mean somebody triggered both and only one of them is mine. The real prompt's code belonged to the real prompt. The fake page was fishing for the six digits that would retire the last wall around 0.4 BTC, and it nearly got them from a tired man standing next to a kettle. I closed the page and zeroed in on the sender line: support@secure-theexchange.top. The .top said everything.

47 minutes inside the phone tree

The support line kept me in queue for 47 minutes, long enough for the kettle to boil dry and for me to relocate to the kitchen floor with my back against the cabinets, and the agent who ultimately answered confirmed the shape of the thing. Zero successful logins from Lisbon. One failed attempt from an address already flagged in their system. My password had been sitting in a 2021 breach dump, refreshed and ready, free to anyone who wanted it. The 2FA code was the last toll booth, and the entire morning had been a construction project to get me to pay it voluntarily.

I asked her what would have happened if I had typed the sixth digit. She didn't hedge. A confirmed code means the session opens, the coins move within minutes, and reversibility is a word that applies to other asset classes, not to a ledger that happily files everything under final. My hands were still unsteady an hour later, which I mention cuz the physical side of these stories never makes it into the security guides.

a credit freeze before my second coffee

Whoever held that dump also held my email, my phone number, and a working password, so the risk was bigger than one exchange account, and I treated it that way before 10 a.m. Credit report pulled, freeze placed at both bureaus, monthly reminder set, all before my second coffee went cold. My credit score never blinked, the freeze costs nothing, and any crook trying to open a phone plan in my name now meets a locked door. Cheap insurance, that part. The exchange login got a fresh password the same hour, generated by hand, written into a paper notebook, never emailed to anybody.

the twenty-second gap, in slow motion

The mechanism deserves one clean paragraph, cuz seeing it plainly is what retired my thumb from automatic tapping. Crooks with a fresh password start a real login and let the exchange's own plumbing do the acting. The platform fires a genuine alert and a genuine code request. The fake email impersonates the alert and then offers a friendly page where you can "verify" yourself, and the code you type there is the harvest. Two buzzes, twenty seconds apart, both made of real parts. An unrequested code is not a notification anymore. For me it is a fire alarm now, and fire alarms get investigated before they get answered.

the drawer rule as of May 1

Since May 1 the routine is dumb on purpose. Codes get requested only from inside the app, by me, on a day I chose. Email warnings get ignored entirely, cuz anything real shows up in the app anyways. A note taped inside my desk drawer reads, in handwriting no phishing kit can forge: no code without a request. The jar is still on the counter. The 7 never got typed, my sister's September still has its $6,000, and 0.4 BTC sits behind a wall I ultimately understand, with dip money staged in high-yield savings and moved one slow, deliberate transfer at a time.