To avoid the unauthorised further transfers, the core team blocked the payment request option. Therefore, users are no longer able to accept incoming payment prompts. The incident was recognized as a social engineering attack, instead of a protocol failure. Therefore, hackers used fake payment requests rather than attacking the system vulnerabilities.

Fraudsters tracked the wallet balances of people on the blockchain to identify accounts with large amounts of Pi tokens. Also, they forwarded payment requests which looked normal or credible.

After the request was accepted by a user, the transfer was carried out instantly. In addition, this technique enabled the attackers to empty wallets without raising a technical security alert.

Most stolen tokens tracked by blockchain went into one wallet address, according to blockchain tracking data. Importantly, the wallet has been getting between 700,000 and 800,000 Pi tokens every month since July 2025. Transactional information showed that transfers in December had dramatically increased. This, therefore, in the opinion of the analysts, increased the operation as more users became transfer eligible.

Community Alerts Issued

Pi community moderators cautioned members against all unsolicited payments. Besides, they recommended verification by official means before authorising any wallet operation. Further examination indicates that the attackers spread stolen tokens on multiple wallets. Therefore, this method made tracking difficult and obscured the source of transactions.

One of the wallets found was marked by a Pi Network moderator as part of previous account unlocking scams. Also, it is reported that several addresses are coordinated. The freeze of payments comes after the recent network security improvements. It is noteworthy that Pi recently proposed two-factor authentication of mainnet wallet migrations in earlier years.

Its network further enhances its infrastructure as the network freeze progresses. Additionally, newer releases made the mainnet migration more efficient and enhanced verification. Pi Network added automated checks of identity in recent releases. Importantly, the changes were able to cut down manual reviews by half.

Node Software Improvements

The Pi Node supports the 0.5.4 update enhanced the performance of the desktop. Also, developers addressed the issue of the accuracy of calculating the rewards. The team also monitors wallet activity even when the suspension occurs. Therefore, the payment requests will not be activated until further security measures are implemented.

This article was originally published as Pi Network Holds Wallet Payments Following Scam that emptied Over 4.4M Tokens on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.