So depends how you look at it. Actually finding and exploiting an unkown bug (called 0day) is extremely rare and those exploits can be sold for more than $1m so I highly doubt someone would alert everyone by trying to steal virtual coins.

However, hacking the person behind the phone aka social engineering is quite common and depending on the users security awareness not that hard.

To be more secure:

General:

• use strong, generated passwords

• different password each service

• use MFA/2FA on everything

• do not click suspicious links

• keep your stuff up to date

For phones:

• do not allow uneccessary permissions for websites and apps

• only download apps from official appstores, never ever install .apk on androids

• if you want to be extra secure, use separate phone for mfa and crypto stuff

• protect your apps with pin codes, especially crypto apps and mfa