steal

On-chain detective ZachXBT posted that U.S. threat actor Tiffany Milanovich participated in the theft of approximately $5 million in crypto assets by impersonating hardware wallet and centralized exchange customer service.Her methods included disguising as Bitcoin IRA email support, during one attack transferring about $1.2 million in BTC and ETH from the victim's Trezor wallet, and in another case stealing about $500,000 in BTC from a Coinbase account. Tiffany induced victims to hand over access to their funds under the guise of "customer service calls," later boasting about the stolen money on social media and Telegram groups, mocking victims with recordings, and collaborating with other threat actors to launder money using phishing panels and instant exchange services, with some of the stolen funds still dormant on-chain.The threat actor codenamed "Tiffany" is suspected of participating in multiple crypto asset thefts, gambling the stolen funds at crypto casinos. The platform Shuffle has frozen related accounts based on evidence submitted by ZachXBT; Tiffany previously shared a search and seizure warrant from Connecticut, dated before some of the incidents involved.ZachXBT has obtained chat logs, recordings, and on-chain evidence, anticipating that this individual may face further legal consequences. This threat actor is also linked to the John Daghita (Lick) case, who is suspected of stealing over $46 million in crypto assets from a U.S. government-seized wallet.

According to Cointelegraph, BTCPay Server has temporarily restricted public remote connections to Lightning Network nodes running the Lightning Network Daemon (LND) software after attackers exploited a serious vulnerability to obtain credentials and transfer funds.BTCPay stated that this restriction prevents external wallets like Zeus from connecting through the BTCPay Server domain. BTCPay mentioned that Lightning payments can continue, and they plan to restore remote access options when they deem it safe.

According to Livecoins, Brazil's Superior Court of Justice (STJ) rejected the release request of the suspect Luccas, maintaining his detention in São Paulo state. The case involves a large-scale fraud against the technology company C&M Software, with the suspect accused of illegally accessing the company's clearing system to steal approximately 813 million reais (about 160 million USD).The criminals dispersed the funds into nearly 300 fake bank accounts to increase tracking difficulty, and then exchanged the reais for BTC and USDT through multiple blockchains, attempting to cover up the illegal source of funds, constituting money laundering. The main attack occurred in June 2025, with the criminal organization having clearly defined roles (including transfer operators and cryptocurrency fund managers) and bribing internal company employees to assist in cracking the server passwords. The first-instance judge has ordered the arrest of the suspect and about 20 other individuals involved in the case, with the arrest warrant executed at the end of October.

According to the Financial Times in the UK, scammers are exploiting the new EU MiCA regulations to target users who are forced to withdraw assets from unlicensed crypto platforms after the licensing deadline. The fraudsters impersonate regulatory agencies and crypto exchanges to lure users into transferring funds to fake accounts.

According to Axios, despite AI labs offering huge salaries, top titles, and abundant computing resources to compete for top talent, the issue of talent loss remains prominent. Data shows that over 400 former Apple employees are currently working at OpenAI, and Apple has filed a lawsuit against OpenAI, accusing it of using Apple's internal code names to extract confidential information obtained from potential applicants.The latest case is that Lilian Weng, co-founder of Thinking Machines Lab, returned to OpenAI just days after leaving, where she will be responsible for recursive self-improvement research. She is the fourth co-founder to leave the lab in the past year. Meanwhile, Google has also seen two well-known researchers switch jobs recently—Noam Shazeer returned to OpenAI, and Nobel Prize-winning chemist John Jumper joined Anthropic. Meta is also facing the issue of high-priced talent rapidly leaving. Reports cite insiders saying that Anthropic CEO Dario Amodei has expressed concerns about the new trend of hiring talent "for money rather than mission."

An FBI agent, Patrick Yaroch, was arrested last Friday for allegedly stealing approximately $1 million in cryptocurrency from "hostile crypto accounts." According to the submitted affidavit, Yaroch is suspected of transferring the relevant assets starting from late 2024 or early 2025. Yaroch told investigators that he discovered some keys that allowed him to transfer funds from the digital wallet to himself. He expressed frustration at being unable to further prevent personnel related to "hostile nations" from using cryptocurrency and made about a dozen transfers.Department of Justice documents show that Yaroch admitted to a Department of Justice employee that he had "made some very bad decisions" regarding issues related to crypto wallets. In another interview with federal agents, he also acknowledged that he had "screwed up." Yaroch was previously a supervisory special agent in the FBI's Counterintelligence and Espionage Division and had earlier served in the FBI's Boston field office. The FBI terminated him on July 31. The investigation also indicated that Yaroch mixed personal funds with cryptocurrency assets and had used ChatGPT to inquire about how to handle these funds, including how to spend or invest $1 million and whether to leave the United States for a country in Europe.

According to Bloomberg, the Internal Revenue Service (IRS) has warned cryptocurrency holders that scammers are contacting some taxpayers by mailing fake letters in an attempt to steal their digital assets or personal data. The IRS stated that these letters may ask taxpayers to register for a so-called "Digital Asset Compliance Portal," which does not exist. The IRS also reminds users not to scan suspicious QR codes and not to answer or cooperate with calls requesting payment.While phishing and digital scams are not new in the cryptocurrency industry, sending fake IRS notices through physical mail seems to be a new scam tactic. Since the IRS has indeed sent letters related to digital assets to taxpayers in the past, and last year saw a surge in cryptocurrency tax filing notifications, many taxpayers are confused, which may lead scammers to exploit this familiarity for disguise. As the U.S. tax system requires taxpayers to disclose cryptocurrency activities on their tax returns, communication between the IRS and cryptocurrency holders has become more common. This also makes counterfeit tax notices more misleading. For cryptocurrency users, encountering "IRS letters" involving portal registration, QR code scanning, wallet connections, or payment requests should be treated with caution, and verification should be done through official channels.

Ethereum co-founder Vitalik Buterin published a new article introducing a novel cryptographic obfuscation technology called Diamond iO. This technology aims to address the extremely low efficiency of traditional indistinguishable obfuscation schemes, allowing programs to run while hiding internal logic and critical data. Although traditional iO technology possesses strong privacy protection capabilities, its operational costs are prohibitively high, making it nearly impractical. Diamond iO, by adopting more aggressive new cryptographic assumptions, enhances computational efficiency from "universe-level time consumption" to "planet-level time consumption," bringing it closer to practical application.Diamond iO is built on technologies such as Attribute-Based Encryption (ABE) and Fully Homomorphic Encryption (FHE). By encrypting programs, it allows users to execute the encrypted programs and obtain correct outputs without being able to view the internal code or hidden keys. This solution introduces a new input encoding mechanism and conditional decryption method, reducing computational complexity while ensuring the program logic remains hidden. Its core application scenarios include protecting programs that contain private keys, enabling secure software licensing, constructing trustless cryptographic services, and supporting blockchain and artificial intelligence systems with stronger privacy protection.However, Diamond iO is still in the early research stage, and its security relies on new cryptographic assumptions, including All-Product LWE and Evasive LWE, which require further research validation. At the same time, the technology still faces efficiency challenges such as high computational overhead and circuit depth limitations. Researchers believe that by optimizing underlying hash functions, improving homomorphic encryption schemes, and reducing security parameter requirements, Diamond iO is expected to become an important direction for advancing practical program obfuscation technology in the future.

According to South Korean media Daily NK, North Korean authorities arrested an elite hacker group on July 12, which is suspected of infiltrating the internal networks of the North Korean central bank and foreign trade bank, stealing national trade funds and laundering money through cryptocurrency. Sources say the group's leader is a veteran from the cyber warfare unit under the North Korean Reconnaissance General Bureau, who recruited talented IT graduates from Kim Chaek University of Technology and Pyongyang University of Science and Technology, using encrypted communications and wireless devices to commit crimes.They split the stolen funds into small amounts and transferred them to overseas cryptocurrency wallets, exchanged them for cash through intermediaries, and then converted them into dollars and other currencies in border areas. Pyongyang officials launched an investigation after discovering anomalies in foreign currency payment approvals and records of overseas IP access, ultimately raiding a safe house and arresting suspects who were laundering money, seizing equipment worth hundreds of thousands of dollars. This case has caused a stir among the elite and military circles in Pyongyang, with senior officials in the Reconnaissance General Bureau and the science and education sector worried about being implicated. North Korea has long been accused of stealing billions of dollars in cryptocurrency assets through hacker organizations like the Lazarus Group, but this incident rarely shows that its own financial system has also become a target of internal attacks.

According to Slow Fog monitoring, the decentralized finance protocol Lien Finance was attacked. The attacker exploited a smart contract vulnerability to mint uncollateralized bond tokens and stole approximately $542,000 USDC.Using this vulnerability, the attacker successfully minted new non-anomalous BondTokens without destroying the corresponding input bonds and exchanged USDC through a pre-authorized address, ultimately transferring about 542,144.63 USDC from the victim's address. Analysis indicates that this incident was essentially due to a validation flaw in the bond token exchange logic, allowing the attacker to bypass asset collateral constraints and mint unsupported assets.

On the day BitMEX announced its shutdown, BKX Services Inc. and David Namdar filed a class action lawsuit in the Southern District of New York Federal Court, accusing the platform of manipulating user forced liquidations and stealing Bitcoin collateral by using insider trading privileges and server freezing tactics. The plaintiffs claim a total loss of approximately 623 BTC, with BKX losing at least 305.81 BTC and Namdar losing over 316.85 BTC, seeking the return of Bitcoin and damages.The complaint states that BitMEX allowed clients to use up to 100 times leverage, while forcibly liquidating positions when the collateral value was still about twice the loss, with the remaining Bitcoin being included in the platform's insurance fund, allowing BitMEX to profit from it. This lawsuit traces back to relevant transactions starting from July 23, 2018, while a similar case from 2020 was voluntarily withdrawn on June 30, 2025.

Finance Minister Scott Bessent posted on the X platform, expressing support for open-source AI and the innovations it brings, but stated that open-source is not an excuse to arbitrarily infringe on U.S. intellectual property rights.If Chinese companies engage in secret, industrial-scale extraction attacks and cross the line into intellectual property theft, sanctions will be considered, and they will be placed on the entity list.

According to Bits.media, Kaspersky security researchers have discovered new malware OkoBot, which steals cryptocurrency wallet recovery phrases and credentials through about 20 modules. Attackers use ClickFix social engineering techniques to trick users into executing malicious commands and spread the malware through GitHub repositories disguised as legitimate tools like SQL Server Management Studio.OkoBot's modules include: SeedHunter, which injects into hardware wallets like Trezor and Ledger, displaying a fake interface when recovering recovery phrases; MC Keylogger, which records keyboard and clipboard activity; and OkoSpyware, which tracks wallet passwords and records window videos.Once attackers obtain the recovery phrases, they can gain complete control over the victim's cryptocurrency assets, making it nearly impossible to recover the funds. Kaspersky stated that OkoBot has been active for over a year, with most victims located in Brazil, Vietnam, Canada, Mexico, and Turkey. Attackers have also implemented geographical blocking on IP addresses from Russia and CIS countries.

The U.S. federal prosecutors have charged a 21-year-old Florida man, Zyaire Wilkins, accusing him of implanting malware to steal cryptocurrency assets in at least 8 games with accomplices between May 2024 and February 2026, spreading it through gaming platforms, resulting in approximately 8,000 devices being infected and about 80 cryptocurrency wallets being stolen, with the amount involved exceeding $220,000.The indictment documents show that the games involved include BlockBlasters, Chemia, Dashverse, DashFPS, Lampy, Lunara, PirateFi, and Tokenova. Some of these games had previously been removed from Steam due to security risks. Investigators stated that the suspect promoted these games through platforms such as Discord, Telegram, X, and LinkedIn, luring users to download and install them, after which the malware stole sensitive information from victims and siphoned off cryptocurrency wallet assets.The FBI indicated that law enforcement identified the suspect through on-chain fund flow analysis and digital payment records. The investigation found that his associated cryptocurrency wallet had purchased over 150 gift cards on the cryptocurrency gift card platform Bitrefill, including Uber Eats gift cards, ultimately helping investigators confirm his phone number and address. The case has now been filed in the U.S. District Court for the Western District of Washington.

According to FinanceFeeds, security researchers have discovered an information-stealing malware targeting macOS devices that is attacking cryptocurrency users. This malware can hijack Telegram Desktop sessions, steal passwords and wallet databases, further controlling user accounts and stealing digital assets. Currently affected wallets and applications include software wallets like Exodus, Atomic, Electrum, Wasabi, and Monero.The malware is capable of extracting sensitive information from macOS Keychain, Safari Cookies, Apple Notes, Telegram Desktop, and multiple cryptocurrency wallet-related databases, including login credentials, authenticated session files, wallet data, and browser extension information. Security analysis points out that the danger of this attack chain lies in its reliance not on a single wallet vulnerability, but on collecting various types of data from the device, linking device intrusion, account takeover, wallet cracking, and mnemonic phrase theft together. Among these, Telegram Desktop sessions have become a key target.Attackers can copy authenticated Telegram local session data and restore the login on another Mac device without needing to enter a phone number, verification code, or Telegram two-factor authentication password. This means that Telegram 2FA cannot provide complete protection in this attack scenario, as the attacker is not performing a new login but is exploiting an already trusted local session. For cryptocurrency users, the risks are further amplified. Since Telegram is widely used for exchange customer service, project communities, OTC trading, and wallet communication, once attackers gain access to user session permissions, they could impersonate the victim, read private chats, locate asset information, and even spread malicious links to contacts.

According to Protos, a gang in the UK disguised as police officers and created a fake police website, convincing cryptocurrency holders over the phone to transfer funds into so-called "safe accounts," stealing $5.4 million worth of cryptocurrency, and were sentenced this week. 23-year-old Hamza Bashir, 25-year-old Kevin Nwamma, and 29-year-old Anthony Ikenwe were sentenced to six years and nine months, eleven years, and eleven years in prison, respectively.The stolen funds were used to purchase luxury items, including a £60,000 car, vacation trips to Thailand and Japan, and products from brands such as Harrods, Hermès, Louis Vuitton, and Rolex. The police also discovered £500,000 in cash in a safe and determined that most of the stolen cryptocurrency had been converted into payment cards. Gang members also falsely reported their annual income, with one declaring only £444. The Metropolitan Police began investigating the gang after receiving reports from victims in January 2025.

According to the "Мошеловка" platform, scammers impersonate authorized brokers of the Moscow Exchange through social media, luring users to click phishing links under the pretext of "testing cryptocurrency trading channels," resulting in theft of funds and information. The Moscow Exchange emphasizes that all official trading must be conducted through licensed brokers, and there are no exclusive cryptocurrency purchasing channels for ordinary users.According to data from the Russian IT company "Shard," in 2025, Russian users are expected to lose approximately 234 million rubles due to cryptocurrency phishing, accounting for 62% of the total losses in cryptocurrency assets that year.

"On-chain detective" ZachXBT published a case analysis stating that in a cryptocurrency asset case involving an Indian scam gang, the relevant individuals reported the case to law enforcement after their assets were frozen, drawing attention. The incident began when a user sought help, claiming that approximately 5.73 BTC (about $475,000) was frozen on Changelly in March 2025.Subsequent on-chain analysis revealed that these funds could be traced back to multiple social engineering attacks and theft cases related to Bitcoin ATMs targeting U.S. users, with a total amount involved exceeding $1 million and several elderly victims. The investigation showed that the individual provided multiple changing explanations for the source of the funds, including "loan," "boss transfer," and "investment from 2014-2015," and there were significant contradictions in the evidence chain.More concerning is that this user had previously filed a police report in India in December 2025, attempting to recover the frozen funds (case number 3207-P/2025). Subsequent on-chain evidence collection and email data analysis indicated that they might be a "mule" for transferring funds, with some bank documents inconsistent with their identity information. ZachXBT noted that such cases demonstrate that social engineering attacks and cross-border fund transfers continue to occur and remind users to avoid interacting with funds from suspicious sources to prevent triggering compliance freezes or legal risks.

Microsoft's Threat Intelligence team has announced a Windows clipboard trojan threat that has been active since February 2026. This malware combines "worm-like propagation + clipboard hijacking + Tor anonymous communication" to target digital asset users for attacks.

The Microsoft Security Blog reported that the Microsoft security research team discovered a new type of cryptocurrency stealing Trojan named Crypto Clipper. This malware has been active since February 2026, primarily spreading through USB devices that infect Windows users with malicious .lnk shortcuts. Crypto Clipper has a built-in Tor client that connects to .onion hidden services via a local SOCKS5 proxy, enabling covert C2 communication. Its main functions include high-frequency monitoring of the clipboard, stealing mnemonic phrases and private keys, replacing cryptocurrency transfer addresses, capturing screenshots and uploading them, as well as receiving remote code execution commands.Microsoft stated that this malware has worm propagation capabilities, automatically hiding original documents on USB drives and generating malicious shortcuts with the same name, while also creating scheduled tasks for persistent control. Researchers detected it as Trojan:Win32/CryptoBandits.A and recommended that users disable autorun for removable devices, restrict script interpreter execution permissions, and closely monitor localhost:9050 Tor proxy traffic and abnormal clipboard access behaviors.