engineer

"On-chain detective" ZachXBT published a case analysis stating that in a cryptocurrency asset case involving an Indian scam gang, the relevant individuals reported the case to law enforcement after their assets were frozen, drawing attention. The incident began when a user sought help, claiming that approximately 5.73 BTC (about $475,000) was frozen on Changelly in March 2025.Subsequent on-chain analysis revealed that these funds could be traced back to multiple social engineering attacks and theft cases related to Bitcoin ATMs targeting U.S. users, with a total amount involved exceeding $1 million and several elderly victims. The investigation showed that the individual provided multiple changing explanations for the source of the funds, including "loan," "boss transfer," and "investment from 2014-2015," and there were significant contradictions in the evidence chain.More concerning is that this user had previously filed a police report in India in December 2025, attempting to recover the frozen funds (case number 3207-P/2025). Subsequent on-chain evidence collection and email data analysis indicated that they might be a "mule" for transferring funds, with some bank documents inconsistent with their identity information. ZachXBT noted that such cases demonstrate that social engineering attacks and cross-border fund transfers continue to occur and remind users to avoid interacting with funds from suspicious sources to prevent triggering compliance freezes or legal risks.

In mid-2026, multiple data points indicate that AI tools are generating significant hidden costs. A survey by Entelligence AI of 2,444 companies found that for every $1 spent on AI, $0.44 is used to fix vulnerabilities, $0.27 is spent on rewriting AI-generated code, and $0.11 is consumed by audit and merge delays.The 2026 report from Lightrun further notes that 43% of AI-generated code still requires manual debugging in production environments after passing quality checks, and no surveyed engineering leaders expressed complete trust in the AI outputs that have been deployed.On the infrastructure front, Oracle has accumulated approximately $108 billion in total debt and is raising another $50 billion in 2026 for AI data center construction, with free cash flow nearing negative $13 billion. Over $300 billion of its $553 billion backlog is concentrated in OpenAI, which incurred a loss of about $14 billion last year. In terms of talent, OKX CEO Stax Xu stated that AI agents have exposed employees who rely on impression management rather than outcome production while accelerating execution. The exchange has now incorporated AI proficiency into its employee evaluation system.

The prosecution materials released by the U.S. Attorney's Office for the Southern District of New York show that Google security engineer Michele Spagnuolo has been arrested and charged for allegedly using significant non-public information to bet on Google user search result-related markets on Polymarket.The prosecution materials state that Spagnuolo used Google internal tools to track the list of the most searched people in 2025 and transferred approximately 3.8 million USDC to a Polymarket address; his associated account AlphaRaccoon placed a bet that D4vd would become one of the most searched people in late November after accessing internal tools for several hours.The prosecution materials also state that AlphaRaccoon transferred 5 million USDC from the Polymarket account to a wallet and moved the funds through exchange services and privacy tools, with some of the funds ultimately entering an account at a payment processing institution in Italy. Spagnuolo is accused of profiting over 1.2 million dollars from the related transactions and currently faces charges of commodity fraud, telecommunications fraud, and money laundering.

"On-chain detective" ZachXBT stated that the hacker "Dritan Kapplani Jr" transferred approximately $2.59 million in assets, including 1.99 million DAI and 259 ETH. The related funds were transferred from address 0x4487...bba6 to address 0x67ec...125d, and the stolen funds are currently in a stagnant state.ZachXBT indicated that it released an investigation report on May 12, detailing the connections between Dritan Kapplani Jr and Trenton (Trent) Johnson in a social engineering theft case involving 185 bitcoins (approximately $13 million).

According to CoinDesk, Ripple announced on Monday that it will share its internal intelligence on North Korean hackers with the cryptocurrency industry threat intelligence sharing organization Crypto ISAC to help businesses identify coordinated infiltration actions.This move comes against the backdrop of a recent shift in attack patterns faced by the cryptocurrency industry. Ripple stated, "The strongest crypto security posture is a shared posture. A threat actor who has not passed a background check at one company may submit resumes to three other companies in the same week. Without shared intelligence, each company starts from scratch."

North Korean hackers had months of offline contact and infiltration with employees of Drift Protocol before launching one of the largest social engineering attacks in the history of the cryptocurrency industry, resulting in a loss of approximately $285 million.Data from blockchain security company TRM Labs shows that North Korean hackers have accounted for 76% of all cryptocurrency hacking losses in 2026 to date.

According to The Block, the Ethereum Name Service (ENS) gateway eth.limo experienced a DNS hijacking attack last Friday evening. The project released a post-incident analysis report on Saturday, tracing the attack back to a social engineering attack against the domain registrar EasyDNS.eth.limo stated that DNSSEC validation rejected the attackers' domain server changes, and no users have been found to be actually affected. In response to the recent breaches at the DNS level affecting crypto frontends, eth.limo plans to migrate to EasyDNS's stricter security services, which no longer support account recovery features.EasyDNS CEO Mark Jeftovic has publicly acknowledged the vulnerability, stating that this is the first successful social engineering attack against customers in its 28-year history.

According to the threat intelligence released by the SlowMist security team, its threat intelligence system MistEye has received community feedback regarding an active social engineering attack targeting cryptocurrency users.The attackers contact target users under the pretext of project collaboration, luring them to use a counterfeit "Harmony Voice" software (domain: harmony-voice[.]app) for so-called real-time translation, which is actually malware. SlowMist has synchronized the relevant threat intelligence (IOC) to its corporate clients.

CoW Swap tweeted that it has regained control of the cow.fi domain and has been operating normally on cow.finance for some time, and is currently gradually transitioning back to the original domain.The official statement indicated that the attacker deceived the DNS registrar with forged documents on April 14 to gain control of the cow.fi domain; the attacker deployed a highly realistic phishing website, implementing it in two phases: first, inducing users to sign malicious transactions through a wallet stealer, and then stealing mnemonic phrases and passwords through fake wallet pop-ups; this attack targeted the domain registrar and did not involve a breach of CoW Swap's own infrastructure or private keys. Affected users should use tools like Revoke.cash to revoke all authorizations and consider transferring funds to a new wallet.

The crypto wallet Zerion disclosed that North Korean hackers are using AI for long-term social engineering attacks, stealing approximately $100,000 from the company's hot wallet.Zerion confirmed that user funds, applications, and infrastructure were not affected, and has proactively disabled the web application as a precaution. Zerion also stated that the attackers obtained some session and credential information from team members who were logged in, as well as the private keys of the company's hot wallet, and pointed out that AI is changing the way cyber threats operate.

According to Business Insider, SpaceX executive Michael Nicolls pointed out in a memo sent to xAI employees that the company's training performance is "embarrassingly low" and clearly stated that xAI is "significantly behind" its competitors. Previous reports indicated that xAI is experiencing staff turnover and team adjustments.The memo announced an immediate reorganization of the engineering team, appointing several new leaders responsible for pre-training, post-training, infrastructure, and other modules. This move is part of a comprehensive reconstruction pushed by Elon Musk after SpaceX acquired xAI in February 2026, aimed at quickly catching up with competitors like OpenAI, Anthropic, and Google.

According to Bloomberg, the U.S. Commodity Futures Trading Commission (CFTC) announced that it has reached a settlement with former FTX engineering chief Nishad Singh regarding the FTX collapse. Under the settlement agreement, Singh must return $3.7 million in illegal gains, is banned from trading for five years, and cannot register with the CFTC for eight years. Given Singh's active cooperation in the investigation, the CFTC did not impose any additional monetary fines or compensation requirements.

According to on-chain analyst Yu Jin (@EmberCN), a Kraken user is suspected of falling victim to a social engineering attack, resulting in the theft of 8,662 ETH, worth approximately $18.19 million. The attacker then exchanged 878 ETH for 26.5 BTC using the cross-chain tool THORChain, and six hours later transferred all stolen assets (7,784 ETH + 26.5 BTC) to the HitBTC exchange.

According to ZachXBT, an unidentified Kraken user is suspected of losing approximately $18.2 million due to a social engineering scam.The address involved started transferring funds from Ethereum to Bitcoin through the SafePal wallet and THORChain about 45 minutes ago.

The head of Plasma engineering stated that they have joined Plasma and are leading the development of the flagship product Plasma One. They pointed out that as infrastructure such as account abstraction, rapid settlement, and crypto payment cards gradually improves, the usability of crypto products is significantly increasing.They believe that stablecoins, as a "new type of currency," possess characteristics such as globalization, permissionless access, and programmability, but the current user experience still lags behind traditional finance. Plasma One aims to bridge this gap and create a user experience similar to a new type of digital bank. Currently, Plasma One has entered the private testing phase, and the team is accelerating product iteration and plans to open early access.