fake

According to the New Straits Times citing Bernama, Malaysian police dismantled a gang suspected of conducting romance scams and fraudulent cryptocurrency exchange schemes in Malacca on November 4, arresting 13 suspects aged between 24 and 36.The police stated that the gang contacted Chinese victims through applications such as Telegram, QQ, and Soul, luring them into transferring money to participate in fake cryptocurrency transactions with promises of emotional relationships and high returns. They began operating at the location involved about three months ago. The total losses incurred by the victims are still under investigation, and the police have seized 12 laptops, 1 desktop computer, and 26 mobile phones among other devices.

The preliminary investigation report on the security incident released by Binance on October 29 shows that the attack began with a fake recruitment. According to the report, in September, a Binance software engineer was contacted by someone impersonating a project director through a legitimate job platform. After undergoing a fake HR video interview and a fake CEO second interview, the engineer was asked to download a homework code repository on their work computer, which contained a zero-day Trojan that bypassed endpoint protection. The attackers then used the compromised device and an internal AI tool to control the computers of two other wallet engineers, stealing deployment credentials, and ultimately executed a malicious script on October 29 to transfer approximately $6.3 billion. Binance stated that it has frozen or intercepted about $2.85 billion and has compensated 98% of the affected assets.This method is almost identical to the March 2022 theft of the Axie Infinity sidechain Ronin cross-chain bridge. At that time, the North Korean hacker group Lazarus contacted a senior engineer at developer Sky Mavis through LinkedIn for a high-paying position. After several rounds of interviews, they sent an offer file containing a Trojan, which allowed them to control the private keys of the validation nodes, stealing approximately $625 million. The Binance report also noted that this year, 57 suspected cyberattacks related to North Korea have been detected and intercepted, with methods including fake interviews, malware disguised as popular development tools, tampered software packages, and browser plugins, among others.

According to a report by Reuters, Binance stated that hackers used fake job interview attacks to compromise employee devices and steal cryptocurrency.

Solana ecosystem wallet and exchange Backpack issued a security alert, warning users to be cautious of fraudulent airdrop activities disguised as tokenized stocks.Backpack stated that scammers may reference real token addresses to make related activities appear legitimate, thereby enticing users to participate. The company advises users to refer to its official Solana minting directory and verify the token addresses before proceeding.

Binance co-founder Zhao Changpeng stated that a circulating chat screenshot showing him attempting to contact Pauly is fake, and he cannot verify other related claims.Zhao Changpeng referenced a post by X user TuanX regarding whether the Binance theft incident had been predicted in advance. The post mentioned several unverified prediction claims, as well as a screenshot allegedly showing Zhao Changpeng asking about and trying to contact Pauly.Zhao Changpeng stated that screenshots and videos are easy to forge and expressed skepticism about the claims regarding predictive abilities.

According to a report released by Microsoft Threat Intelligence on the 29th, North Korean hacker groups are using artificial intelligence to accelerate cyberattacks on South Korean users, expanding from customized phishing documents, fake recruitment, and identity disguise to malicious code development and software supply chain attacks. Microsoft assessed the AI adoption levels of eight North Korean-related hacker organizations: three have reached the highest "Operational Maturity" stage at level four, integrating AI into their daily attack processes; four are in the "Acceleration" stage, and one is in the "Expansion" stage.The report states that organized groups customized and generated over 100 PDF bait documents targeting different objectives between August and September this year, with instances of producing dozens of documents in just a few minutes. From June 8 to 12 this year, there were also cases of using three disguised companies to initiate fake recruitment invitations to professionals in AI, blockchain, and cybersecurity. Additionally, Microsoft analyzed that North Korean hackers might use AI programming tools like Cursor to assist in code generation, debugging, and evading detection; the North Korean Reconnaissance General Bureau's "Onyx Sleet" (referred to as Andariel by South Korea) and "Pearl Sleet" have been using the open-source AI penetration testing framework ARTEX in real operations since late October. Microsoft believes that while these organizations have enhanced their attack speed and efficiency with AI, they have not yet entered a fully autonomous attack phase and recommends that companies strengthen identity verification for job applicants, phishing protection, and malicious code detection.

According to Caixin, the storage chip manufacturer Changxin Technology issued a reminder on the 29th, stating that the company has recently discovered that illegal individuals and unauthorized intermediary organizations are falsely using the names "Changxin Technology," "Changxin Group," and "Changxin Storage" to spread false recruitment information on online platforms.Changxin Technology reminds everyone not to download unknown software, not to click on unfamiliar links, and not to provide personal sensitive information to unofficial personnel; do not participate in activities that require payment or tasks to obtain job opportunities; do not trust false promises spread by unofficial social media accounts, as well as fabricated job locations and salaries.

Slow Fog's Yu Xian posted on platform X, stating that Slow Fog's MistEye global threat intelligence hunting has discovered over 1,500 DarkSword phishing sites deployed across the internet, involving e-commerce, fake Binance, fake OKX, fake wallets, gaming, and cryptocurrency exchange businesses.

The South Korean cryptocurrency exchange Upbit announced that it has recently discovered that criminals are impersonating the GIWA blockchain project, spreading false information about the mainnet launch and digital asset issuance, and inducing users to transfer assets.Upbit stated that GIWA is an Ethereum Layer 2 network being developed by its parent company Dunamu, which is currently only running a testnet, and the mainnet is still in the development and preparation stage, with no official launch time announced yet. Upbit reminds users to be cautious of unverified information regarding the mainnet launch, token issuance, and investment, and not to trust unofficial channels that request the purchase of digital assets, transfers, or wallet connections. Project progress should be based on information released by the official GIWA website and official social media.

Apple Inc. announced the expansion of App Store review rules to include the regulation of AI-generated non-consensual intimate images. The platform had previously banned pornographic content, and the new rules require developers to proactively prevent and remove AI-generated deepfake content. If effective action is not taken, applications containing such violations will be forcibly removed from the store.The updated Clause 1.2 specifically mentions applications that create AI content and names controversial products such as Grok. Previously, users complained that Grok, a product of xAI, was used to create nude and sexually suggestive deepfake images. Earlier this year, Apple warned xAI that if such content continued to spread, Grok would be removed from the App Store; subsequently, xAI implemented safety measures, and the updated version was approved.The newly added Clause 2.5.19 targets so-called "bait-and-switch" tactics, stating that if developers hide new features or modules outside of the submitted review version, especially harmful features like "de-clothing" that are activated only after approval, they may be removed from both the App Store and the Apple Developer Program. Updates to Section 5 will also extend the ban on applications promoting human trafficking or child exploitation to alternative application distribution channels. Apple stated that when developers violate these guidelines, the related applications will be removed, and the developer's eligibility will be terminated.

The identity project World, co-founded by OpenAI CEO Sam Altman, announced the launch of a World ID verification product suite aimed at banks and financial institutions, marking the first industry-specific version of the identity protocol. World co-founder Alex Blania unveiled the product at the Money20/20 conference. The suite integrates three existing products, and World claims it can help institutions guard against deepfake fraud and AI-driven identity theft, covering scenarios such as customer accounts, employee workflows, and AI agents.Specifically, the World ID app is an identity wallet used to store and present what World refers to as user Proofs. World ID for Zoom allows call participants to confirm that the other party is a real person and not a deepfake; this feature has officially launched after a limited testing phase that began in April. World’s main developer, Tools for Humanity, has also joined Zoom's Independent Software Vendor Exchange Program. World ID for Agents, also known as AgentKit, allows users to delegate Proofs to AI agents, which present them to third-party platforms.World stated that it is collaborating with OpenExchange, Bain Capital, VanEck Funds, and Outtake as design partners to explore how its technology can support banks and financial services, but did not disclose specific bank names or pricing for the product. A press release cited a Deloitte forecast predicting that by 2027, AI-related fraud losses in the U.S. could reach $40 billion, up from approximately $12.3 billion in 2023. World claims that over 18 million people currently hold Proof of Human. Last month, World also launched the World Money self-custody app, supporting stablecoin payments in over 150 countries; in July, World Foundation raised $52.5 million through a WLD token sale, with a lock-up period of one year.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

Security researcher @cyberscrilla discovered that a fake Ledger website and application appeared at the top of Google search results, aiming to trick users into revealing their 24-word recovery phrase. Reportedly, Google data shows that the website had over 1 million visits in the past 30 days.Previously, cybersecurity company Zscaler found in a September investigation that malicious Google ads were impersonating Ledger and redirecting users to a fake wallet verification page. Currently, Ledger is investigating a suspected wallet theft case involving Southeast Asian dealer CryptoBilis, with an estimated amount of $86 million involved.

Hardware wallet manufacturer Ledger has once again experienced a security incident today, with third-party security agencies estimating the losses to be close to 90 million USD. Ledger is investigating the financial losses related to devices sold by its Southeast Asian authorized distributor CryptoBilis and has requested the distributor to suspend sales and shipments, advising users who purchased devices through this channel in the past 90 days to exercise caution or transfer their assets. The cause of the incident has not yet been definitively confirmed, but it is suspected to involve supply chain or device tampering risks.Major historical attacks and financial loss incidents related to Ledger include:In 2018, early hardware and supply chain research vulnerabilities emerged. Security researchers demonstrated the possibility of tampering with the Nano S before it left the factory, as well as issues such as MCU bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger gradually released security announcements and completed fixes, with related issues mostly being research-level vulnerabilities or requiring physical contact with the device to exploit.In 2020, Ledger experienced a massive customer data leak. Attackers obtained e-commerce and marketing databases through third-party API keys and vulnerabilities related to Shopify, exposing over 1 million email addresses and approximately 272,000 to 292,000 detailed customer records, including names, addresses, and phone numbers. The hardware and private keys were not affected, but this incident triggered long-term phishing, social engineering, and counterfeit official letter scams.In December 2023, the Ledger Connect Kit suffered a supply chain attack. After a former employee fell victim to a phishing attack, their NPMJS account was compromised, and attackers released a malicious version of the Connect Kit, injecting malicious code into DApps that relied on the library, enticing users to sign fraudulent transactions. The active window of the attack was about 2 hours, with losses estimated between 480,000 to 600,000 USD. The hardware and Ledger Live itself were not directly breached.In January 2026, third-party Global-e order data was leaked. The payment and logistics partner's system suffered unauthorized access, exposing some Ledger.com order-related information, including names, addresses, and contact details. Ledger's own systems and private keys were not affected, but the phishing risk rose again.In April 2026, counterfeit Ledger Live application scams appeared on the App Store. The counterfeit application was listed for about a week, tricking users into entering their recovery phrases, with over 50 victims losing approximately 9.5 million USD across multiple blockchains. Apple subsequently removed it, and Ledger emphasized that it would never ask for 24-word recovery phrases.In August 2026, Ledger disclosed vulnerabilities related to Ethereum application signatures, including command interleaving causing display content to be out of sync with signature parameters, and Clear-signing bypass issues. The vulnerabilities required malicious hosts to cooperate, and Ledger stated that there was no evidence of actual user exploitation; related issues have been fixed in the new version.On October 9, 2026, a large-scale wallet draining incident related to the CryptoBilis distributor occurred, with estimated losses close to 90 million USD. Ledger is investigating, and the incident is suspected to involve supply chain or device tampering attacks targeting a single channel. The official sales have been suspended, and affected users are advised to migrate their assets.

Mr. Li Yi, a Douyin user, posted a video on social media stating that on June 10 of this year, he downloaded a fake wallet from the official Huawei store, which led to the exposure of his mnemonic phrase and the theft of 177,473 USDT.According to his description, the hacker changed the permissions of his wallet address to multi-signature, and then implemented a secondary scam under the pretext of unlocking it for spending money. After the victim transferred funds, all USDT in the address was transferred away.Mr. Li Yi claimed that after he released the video exposing the app, the download volume of the app in the official store plummeted. The hacker repeatedly gathered internet trolls to report his video, causing it to be forcibly taken down, and privately attempted to negotiate a conditional agreement to delete the video.He also stated that after conducting a private investigation, he learned that the scam app had five servers set up in Hong Kong, paying to have the app listed in the Huawei official store and to boost its ranking, causing a large number of victims to download it first in searches. Due to relevant bans in mainland China, related wallet apps cannot be normally launched in the store, so any app that cannot be launched but does exist in the store may be a counterfeit scam app.

DyorSwap officially announced that the so-called "GIWA Mainnet" identified by the team earlier is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

DyorSwap officially announced that the so-called "GIWA mainnet" previously identified by the team is actually a fake chain set up by scammers. This fake network used the correct GIWA chain ID (9134), making it appear legitimate during the initial verification phase. The team also identified several suspicious messages and individuals within the related community that may be connected to this incident. The announcement stated that significant losses have occurred due to this fraudulent cross-chain bridge.DyorSwap stated that it is taking three immediate actions: first, contacting a professional security team to conduct further on-chain tracking and investigate the involved addresses, transactions, and fund flows; second, preserving all relevant evidence, including chat records, RPC information, cross-chain bridge addresses, and on-chain transactions; third, preparing to use treasury funds to compensate affected users, with eligibility criteria, loss verification processes, compensation scope, and detailed plans to be announced after the investigation and verification processes are completed.DyorSwap emphasized that until further notice, users should not use any unofficial GIWA mainnet RPCs, cross-chain bridges, or contracts, and should not send funds to any related addresses. The official team deeply apologizes to every affected user in this incident and states that subsequent updates will be released as soon as possible.

White House officials stated that reports regarding the Trump administration considering a ban on diesel exports are "fake news." Previously, there were market rumors that the U.S. might implement a 90-day restriction on diesel exports, causing U.S. ultra-low sulfur diesel futures to drop more than 7% at one point, while European diesel futures rose over 7% due to supply concerns.

According to the Dutch police (politie.nl), the police in eastern Netherlands arrested two men suspected of using counterfeit EURC cryptocurrency to purchase multiple Rolex watches on the second-hand platform Marktplaats. The victims discovered that the tokens they received were counterfeit and worthless after the payment was made.After the case was exposed on the television program "Plaats Delict," the police identified the suspects through viewer reports. The two men are a 24-year-old male from Geleen and a 45-year-old male from Leiden. During the search, firearms and drugs were found at the residence of the former, who has been detained for 14 days; the latter has been released but remains a suspect in the case. The police remind the public to be cautious with cryptocurrency payments and to avoid using unfamiliar payment methods.