fake

According to the Dutch police (politie.nl), the police in eastern Netherlands arrested two men suspected of using counterfeit EURC cryptocurrency to purchase multiple Rolex watches on the second-hand platform Marktplaats. The victims discovered that the tokens they received were counterfeit and worthless after the payment was made.After the case was exposed on the television program "Plaats Delict," the police identified the suspects through viewer reports. The two men are a 24-year-old male from Geleen and a 45-year-old male from Leiden. During the search, firearms and drugs were found at the residence of the former, who has been detained for 14 days; the latter has been released but remains a suspect in the case. The police remind the public to be cautious with cryptocurrency payments and to avoid using unfamiliar payment methods.

According to Forbes, a warning jointly issued by multiple agencies including the Federal Bureau of Investigation (FBI) and the National Police Agency (NPA) of Japan indicates that the North Korea-linked hacker group WaterPlum (also known as Contagious Interview) will launch attacks on global IT developers from December 2025 to July 2026 by disguising itself as companies in the AI, cryptocurrency, or NFT sectors and offering fake job positions.Attackers contact job seekers on social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or programming tests. They successfully infected over 30,000 devices, covering more than 100 countries and regions, and stole data from over 7,000 cryptocurrency wallets. Related funds of at least $10.71 million have flowed into wallets controlled by the attackers.

A former bank executive was recently sentenced for forging documents to fraudulently obtain over 1.6 billion Hong Kong dollars in illegal loans, and using the funds to purchase Bitcoin and conduct cryptocurrency bribery.

On September 14, blockchain intelligence company TRM Labs released a report revealing that fake YouTube tutorials lured 224 victims into deploying and funding malicious smart contracts under the guise of building AI-based crypto arbitrage bots, resulting in the theft of 274.6 ETH. TRM identified a total of 234 contracts deployed by the victims, with funds ultimately flowing into six collection addresses controlled by the operators. The stolen ETH was worth approximately $517,000 at the time of the transfer, with a median loss of 1 ETH per incident.Unlike common wallet theft attacks, this scam did not involve phishing links, spoofed domains, or malicious authorization prompts. Victims chose the tutorials themselves, copied the code, deployed the contracts, and funded them from their own wallets, with each step authorized by the victims themselves. As a result, wallet security warnings and phishing blacklists could not be triggered. TRM discovered nine nearly identical YouTube tutorials disguised as different creators, using AI-generated virtual hosts and voiceovers, promising to build fully automated crypto trading bots with Claude, and guiding victims to a compiler website controlled by the operators, some of which mimicked the commonly used Remix development environment.In one variant analyzed by TRM, a backend script would discard the source code pasted by the victims and retrieve another contract from the operator's server, with the clean code displayed on the screen never being on-chain. The replaced contract accepted deposits and transferred any balance over 0.05 ETH to the operators when the victims pressed Start or Withdraw, with no arbitrage logic or AI functionality included in the contract.

Recently, Ethereum Classic experienced a social engineering incident involving the Core-Geth client. The unreviewed ethereumclassic/core-geth v1.13.0 was released on September 14 and was promoted as a security update. A few mining pool nodes temporarily switched to this version but have since reverted to the long-term maintained etclabscore/core-geth v1.12.23.This unreviewed version modified key logic such as chain selection and node discovery, posing a potential risk of network split; the incident did not result in block loss, chain reorganization, fund loss, or service interruption.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.

According to Cointelegraph, cybersecurity company Morphisec has revealed that a counterfeit desktop application disguised as "Claude Opus 5 Free Desktop" from Anthropic is being used to spread the Windows malware RevStealer. This software can steal data from over 50 types of cryptocurrency wallets, while also collecting sensitive information such as browser passwords, cookies, VPN configurations, message logs, and screenshots.RevStealer has anti-detection mechanisms that perform environmental checks on the target device before execution; if it detects characteristics of a debugging or virtual environment, it will stop running. In addition, Russian cybersecurity company Kaspersky has also disclosed another new malware framework targeting cryptocurrency investors called OkoBot, which can harvest wallet files, inject malicious extensions, and capture wallet application windows to steal assets.

New York state officials warn that AI-generated content and fake cryptocurrency projects are making investment scams more deceptive. Investment scam losses exceed $8 billion, a 38% increase from 2024, with 144,041 consumers reporting losses, and the median loss per incident is $10,560. AI can be used to clone voices, forge videos, impersonate financial professionals, and create social media advertisements.New York Attorney General Letitia James has warned that scammers attract investors through deepfake endorsements of celebrities, fake cryptocurrencies, pump-and-dump schemes, and fraudulent trading platforms. Some fake platforms display forged account balances, earnings, and transaction records, allowing victims to withdraw small amounts to build trust, and then request additional funds or fees. New York state officials advise consumers to verify the identity of promoters, companies, and investment projects, and confirm the destination of funds. According to the FBI, reported losses from cybercrime amount to $20.877 billion, with complaints involving cryptocurrency losses totaling $11.37 billion. Common signs of scams include promises of high returns, unsolicited investment opportunities, high-pressure sales tactics, and projects lacking clear documentation.

Bitcoin News posted on platform X that the IRS has reminded cryptocurrency holders that they may recently receive fake official letters mailed by scammers, directing recipients to visit a fraudulent "Digital Asset Compliance Portal."The letter contains a QR code, which, when scanned, redirects to a fake IRS website that may request personal information, wallet information, exchange account credentials, or other sensitive data.The IRS stated that it does not operate a platform called "Digital Asset Compliance Portal" and has not sent out these letters. Reports indicate that Coinbase and DarkTower have traced the infrastructure behind this activity to a recently registered domain hosted in Romania. If you receive such letters, do not scan the QR code or provide any information.

According to Bitcoin.com, the Australian Securities and Investments Commission (ASIC) disclosed that in the fiscal year 2026, over 19,400 online scams were removed (a year-on-year increase of 182%), among which cryptocurrency investment scam platforms reached 3,106, an increase of about 30% compared to the previous fiscal year.ASIC pointed out that scam groups are heavily leveraging generative AI technology to build a systematic fraud ecosystem: by using deepfake videos of well-known figures such as Australian Prime Minister Albanese and financial commentators to promote fake cryptocurrency trading robots, while simultaneously creating counterfeit media websites, AI-generated comments, and fake profit dashboards to lure victims into continuously increasing their investments, with funds ultimately flowing to overseas criminal groups. Just from the impersonation of high-profile individuals alone, the related losses have exceeded 7.4 million Australian dollars.

According to CNA, the Singapore Police Force (SPF) and the Cyber Security Agency of Singapore (CSA) reported that a cryptocurrency scam involving fake job postings and compromised software systems resulted in losses of $11.8 million.The scam group impersonated cryptocurrency company recruiters on LinkedIn, used forged domain names to send emails, conducted video interviews, and induced victims to download malware on company devices to complete "technical tests," thereby stealing session tokens, bypassing multi-factor authentication, and ultimately transferring cryptocurrency.

According to Cointelegraph, Mauro Eldritch, the founder of cybersecurity company BCA LTD, and Heiner García, a network threat intelligence analyst at Telefónica Tech, jointly established a fake cryptocurrency startup "Ballena Azul," successfully luring suspected North Korean IT workers to work in a controlled virtual desktop environment for up to five weeks while monitoring their behavior throughout.Investigations show that the external servers used by the workers are linked to North Korean cyber operations that previously distributed malware such as InvisibleFerret, BeaverTail, and OtterCookie; the workers also heavily relied on ChatGPT for programming assistance and Google Gemini to forge identity documents. Researchers pointed out that North Korean IT workers obtained remote jobs by faking U.S. identities, with their earnings ultimately flowing into Pyongyang's weapons of mass destruction programs. According to the U.S. Treasury Department, such programs are expected to generate nearly $800 million for North Korea in 2024.

Binance New Zealand recently issued a security warning, reminding local users to be aware of the frequent SMS phishing scams that have emerged recently. Scammers impersonate Binance officials, using the lure of free cryptocurrency or event tickets, and falsely claim in the messages that their activities have been approved by the New Zealand Financial Markets Authority (FMA).Binance advises users not to click on any links in such messages and not to connect their wallets to suspicious platforms. Users can verify the authenticity of relevant contact information and websites through Binance's official verification tool "Binance Verify" to prevent asset loss.

According to Com Feed monitoring, a fake Wasabi Wallet application has appeared on the Apple App Store, resulting in a user losing approximately 6 bitcoins.This is the 27th fake wallet application listed in the Apple Store this year. ChainCatcher reminds readers to be cautious in distinguishing the Wasabi Wallet application.

According to the Procuratorial Daily, an employee of a company in Shenzhen, under the pressure of over 400,000 yuan in online loans, stole the company's core research and development materials and disguised himself as an overseas hacker, demanding a ransom of 0.88 bitcoins and 90,000 USDT from the company. He was ultimately sentenced to three years and three months in prison for attempted extortion and fined 10,000 yuan.

The on-chain financial innovation experimental project TokenWorks tweeted that the initial release phase of Fake World Assets has ended, and the tokens have been distributed to participants. External purchases will open at 3:00 AM Beijing time on August 5.In addition, 50% of the future protocol fees originally belonging to TokenWorks will be redirected to a buyback mechanism. 70% of the tokens obtained from the buyback will be allocated to buyers, 10% to depositors, and 20% for burning. The additional purchase fee has been reduced from 5% to 2.5%, and the depositor bidding has increased from 85% to 90%. The purchase function will be suspended from 9:00 PM to 12:00 AM on August 4 to allow depositors to withdraw.

According to The Block, the Hong Kong police stated that a local insurance practitioner fell victim to a fraudulent cryptocurrency investment romance scam, with total losses exceeding 26 million Hong Kong dollars, approximately 3.3 million US dollars.

According to Bloomberg, the Internal Revenue Service (IRS) has warned cryptocurrency holders that scammers are contacting some taxpayers by mailing fake letters in an attempt to steal their digital assets or personal data. The IRS stated that these letters may ask taxpayers to register for a so-called "Digital Asset Compliance Portal," which does not exist. The IRS also reminds users not to scan suspicious QR codes and not to answer or cooperate with calls requesting payment.While phishing and digital scams are not new in the cryptocurrency industry, sending fake IRS notices through physical mail seems to be a new scam tactic. Since the IRS has indeed sent letters related to digital assets to taxpayers in the past, and last year saw a surge in cryptocurrency tax filing notifications, many taxpayers are confused, which may lead scammers to exploit this familiarity for disguise. As the U.S. tax system requires taxpayers to disclose cryptocurrency activities on their tax returns, communication between the IRS and cryptocurrency holders has become more common. This also makes counterfeit tax notices more misleading. For cryptocurrency users, encountering "IRS letters" involving portal registration, QR code scanning, wallet connections, or payment requests should be treated with caution, and verification should be done through official channels.

According to DefiLlama data, the Ethereum chain random NFT acquisition protocol Fake World Assets, developed by the two-person team Token Works, surpassed the daily revenue of Collector Crypt on Solana within four days of its relaunch on July 20.On July 25, the peak daily revenue reached $447,604, with total fees of $1.6 million, and approximately 90,000 transactions including about 35,000 draws, with a trading volume of around 2,000 ETH. After that, activity declined, with revenue in the past 24 hours dropping to $167,869, ranking second in daily revenue among Ethereum protocols, only behind Sky ($464,303), and ahead of Aave ($105,282) and Uniswap ($76,028).In this protocol, depositors list NFTs along with their pledged ETH collateral (similar to Uniswap V2 trading pairs), where the collateral determines the weight of each NFT and provides depositors with irrevocable continuous bids to reacquire the NFT. Anyone can pay the acquisition price generated by the liquidity pool to obtain a randomly selected NFT.The pool has accumulated over 1,500 NFTs including CryptoPunks, with randomness provided by Chainlink VRF. The token emission incentives expire 15 days after launch, and daily fees have decreased by about half from their peak. Collector Crypt on Solana remains the leader in this sector, with users spending over $209 million on its card packs in June alone.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.