europol

On Wednesday, the European Union law enforcement agency Europol released two reports urging the industry and policymakers to proactively address the threats posed by quantum computing. One report, titled "Quantum Computing and Cryptocurrency," written by Europol's European Cybercrime Centre, points out that cryptocurrency wallets are "the main exposure point for quantum threats." Wallets rely on private keys for authorized transactions and public keys for verification; a sufficiently powerful quantum computer could derive the private key from an exposed public key, allowing attackers to access funds without authorization, a moment often referred to as Q-Day. The report states that the hash functions used to link blocks and support mining are fundamentally resistant to quantum attacks.The report believes that cryptocurrency will not collapse due to quantum computing but recommends adopting "proactive defenses," including a phased transition to quantum-resistant cryptography and improving wallet security and key management. Wallets with public keys exposed on-chain cannot be remedied afterward, and the report states that the only solution is to migrate in advance. Glassnode estimated in May this year that 6.04 million BTC (30.2% of the issued supply) have exposed public keys. Upgrading Bitcoin also comes with costs: NIST standardized post-quantum signatures are 10 to 120 times larger than the ECDSA signatures currently used in Bitcoin, which could lead to block space overload and increased transaction fees. The report cites a 2024 study estimating that migrating all unspent transaction outputs would require at least 76 days of cumulative downtime.The second report, "Collect First, Decrypt Later," was completed in collaboration with Carlos III University of Madrid in Spain. It studies the behavior of attackers who collect encrypted data today and decrypt it in the future, finding risks in protocols such as TLS, SSH, and OpenPGP.

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

According to Bitcoin.com, the European Cybercrime Centre recently led a joint operation codenamed "Endgame," which was the result of collaboration among law enforcement agencies from Canada, Denmark, Germany, the Netherlands, and the United States.These agencies jointly targeted the network infrastructure that provided services to criminals, utilizing three key types of "cybercrime-as-a-service" (CaaS) malware: SocGholish, Amadey, and StealC, to collect victims' information and sensitive data.Law enforcement agencies took action against a total of 326 servers and 142 domain names, seizing illegal cryptocurrency worth approximately $47 million and recovering over 27 million stolen credentials.

According to market news, the European Cybercrime Centre, in collaboration with the U.S. Department of Justice and other agencies, has announced the dismantling of a malicious proxy service network named "SocksEscort" and the freezing of $3.5 million in cryptocurrency related to the case.The network is said to have compromised over 369,000 routers and IoT devices in 163 countries worldwide, providing users with over 35,000 proxies in recent years. The European Cybercrime Centre stated that 34 domain names and 23 servers were seized in operations across 7 countries, and payment platforms associated with the service are estimated to have received over $5.7 million in cryptocurrency. The investigation began in June 2025 and found that the infected devices were primarily used to facilitate criminal activities such as ransomware and DDoS attacks.The U.S. Department of Justice has charged that criminals used the proxy service to conceal their location and commit fraud, including bank and cryptocurrency account takeovers, citing multiple victim loss cases, including a New York cryptocurrency exchange customer who was scammed out of $1 million.

According to Cointelegraph, the FBI, Europol, and law enforcement agencies from 14 countries conducted a joint operation on March 3-4, successfully shutting down the cybercrime forum LeakBase. The forum had over 142,000 members and served as a platform for hackers to buy and sell stolen data and cybercrime tools.Law enforcement has seized user accounts, posts, credit details, private information, and IP logs as evidence, and executed search warrants and arrests in multiple countries. Notably, LeakBase's predecessor, Raidforums, was shut down in 2022 and had hosted leaked data containing personal information of approximately 272,000 users of the cryptocurrency wallet company Ledger. In recent years, data breaches in the cryptocurrency industry have continued to rise, including security incidents such as the hacking of Coinbase's internal systems.

According to market news, Coinbase, in collaboration with Microsoft, Europol, and more than ten other organizations, successfully shut down the phishing-as-a-service platform Tycoon 2FA and seized 330 related domains.Since its launch in August 2023, Tycoon has had approximately 2,000 users, operating over 24,000 domains, and sending tens of millions of fraudulent emails each month to over 500,000 businesses worldwide. It bypassed multi-factor authentication by stealing session cookies and tokens, primarily targeting email and online service accounts such as Microsoft 365, Outlook, and Gmail.In this operation, Coinbase assisted in tracking the cryptocurrency payments funding Tycoon’s operations and supported the civil lawsuit to seize the domains. The main developer has been identified as Saad Fridi, a Pakistani national.

According to Decrypt, the head of the European Financial and Economic Crime Centre (EFECC) of Europol warned this week that the methods of committing crimes using cryptocurrencies and blockchain are "becoming increasingly sophisticated."He pledged that Europol will continue to invest in supporting member states in conducting complex international investigations and called for the establishment of global standards and the provision of fair blockchain training to enhance cross-border investigations.

ChainCatcher news, a so-called reward of $50,000 from the European Union Agency for Law Enforcement Cooperation (Europol) to track down the administrators of the Russian ransomware gang Qilin, is actually just a Telegram scam. This false reward message has deceived several cybersecurity news outlets, leading them to mistakenly believe that Europol would pay a reward to anyone who could provide information about the two Qilin administrators, Haise and XORacle.It is claimed that these two are responsible for "coordinating affiliate organizations and overseeing ransomware activities," and Europol is seeking intelligence that could "directly lead to the identification or location of these administrators."However, Europol confirmed to Security Week that this so-called reward is actually a "scam," and the agency has never issued such a reward.

ChainCatcher news, according to Cryptoslate, Spanish law enforcement has teamed up with Europol to crack a large-scale transnational cryptocurrency money laundering case. The criminal organization laundered money for criminal groups in China and the Arab region through cryptocurrency transactions, with an amount involved exceeding 20 million euros.It is reported that the operation searched 14 locations and arrested 17 suspects, of which 15 have been detained pending trial. Law enforcement seized over 205,000 euros in cash, digital assets worth 183,000 euros, 18 luxury cars, and properties valued at approximately 2.5 million euros.

ChainCatcher news, according to Cointelegraph, the European Union Agency for Law Enforcement Cooperation (Europol) pointed out in a threat assessment report on serious and organized crime that artificial intelligence and cryptocurrency technologies play a significant role in enhancing the efficiency of crime.The law enforcement agency stated that criminal networks have demonstrated a rapid ability to adapt to new technologies. The report noted that the transformative nature of artificial intelligence makes it an extremely attractive tool in the eyes of criminals.The report stated that generative artificial intelligence "lowers the entry barrier for digital crime." The government agency indicated that artificial intelligence enables criminals to craft messages in multiple languages, allowing them to more precisely target victims globally. It also allows malicious actors to create malware and child sexual abuse materials.

ChainCatcher news, the European Police Organization collaborated with law enforcement agencies from six countries to dismantle an international drug trafficking group using cryptocurrency.The operation resulted in the arrest of 9 suspects. During the operation, valuable items including gold and luxury goods, €35,000 in cash, and €25 million in cryptocurrency were seized, amounting to $26.23 million. The total value of the seized assets was €27 million, equivalent to $28.33 million.

ChainCatcher message, data from Europol indicates that real estate, luxury goods, and cash-intensive businesses are the primary money laundering tools for major criminal networks in the EU, with cryptocurrency accounting for only a small proportion. Reports from Nasdaq and the U.S. Treasury show a significant disparity in the amount of illicit funds between traditional industries and the digital asset sector, with the latter representing only a small fraction of the total.