According to PANews, a report by SecureList reveals that stolen cryptocurrency accounts are being sold on the dark web for an average price of $105. These accounts are typically obtained through phishing attacks, with prices ranging from $60 to $400 depending on factors such as account age, balance, payment method linkage, and two-factor authentication status. The stolen data is primarily leaked from phishing pages via three channels: email, Telegram bots, or uploads to admin panels. Telegram is favored by attackers for its real-time capabilities, disposability, and difficulty in tracing. More organized attacks utilize admin panel frameworks for real-time statistics, automatic credential verification, and data management.

The stolen data, which includes exchange login information, wallet access, and fiat currency accounts, is either sold immediately or enters a resale pipeline. Middlemen purchase the data in bulk, verify and organize it, and then resell it on dark web forums or Telegram channels to fraudsters. The report highlights that from January to September 2025, 88.5% of phishing attacks targeted account credential theft.