A user posts publicly (on social media or a forum) about a problem with an exchange or wallet. A scammer monitoring for exactly these posts replies quickly, posing as official support and offering to help — often using an account styled to look like the real company.
The "support agent" moves the conversation to direct messages, then asks for account credentials, a seed phrase, or remote access to the victim's device, framing it as necessary to diagnose or fix the issue.
Once they have what they need, they drain the account or wallet directly. Some variants instead talk the victim through making a transaction themselves, disguised as a "test" or "verification" transfer.