A fake security warning flashed across crypto wallets, sending users scrambling to protect their funds. Instead, the alert delivered them straight to thieves who drained roughly $2.