involved

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

NEAR Intents released a security notice confirming that it has encountered an attack. Preliminary investigations indicate that the vulnerability originated from a defect in the interaction between the Omni deposit and withdrawal infrastructure and contracts. The contract vulnerability has been fixed, and core services are expected to be restored within 1 hour, with a commitment to fully compensate for the damaged assets.NEAR Intents stated that deposit and withdrawal services for multiple public chains, including BSC, Polygon, and TON, will be additionally suspended for about 12 hours. The relevant cases have been reported, and on-chain tracking has begun.Subsequently, on-chain detective ZachXBT indicated that NEAR Intents' BSC hot wallet experienced multiple abnormal outflows of funds, with the stolen funds transferred to KuCoin and further cross-chain to the Bitcoin network. The amount involved has exceeded 3.8 million USD.

Recently, the Beijing Shijingshan police successfully intercepted a new type of cross-border telecom fraud case, freezing 780,000 yuan in involved funds and returning it to the victims. In this case, 53-year-old Mr. Liu received a fraudulent call from abroad while accompanying his child studying overseas. The scammer impersonated domestic police, fabricated false allegations of money laundering, and induced him to urgently request money transfers from his family in China.The funds were subsequently transferred into the accounts of two other Chinese students studying abroad. Upon investigation, it was found that these three individuals were all victims of the same fraud gang, exhibiting characteristics of "multiple scams in one case, with victims serving as money laundering tools for each other." The scammers first transferred funds into the accounts of some victims, then coerced them into exchanging for U currency to assist in the transfer, which was highly concealed and involved complex cross-border links. The police successfully "awakened" the victims through patient persuasion, preventing greater losses.

The U.S. Commodity Futures Trading Commission (CFTC) has filed a lawsuit against Cash FX Group S.A. and its CEO Huascar Jose Lopez Castillo, The Conversion Pros Inc. and its CEO Ronald Pope, Justin Halladay, accusing the aforementioned defendants of operating a multi-level marketing Ponzi scheme that raised over $950 million from the public, including in the United States, claiming it was for retail foreign exchange contract trading.The CFTC stated that the defendants falsely claimed that funds were traded by professional traders, proprietary algorithms, and AI, promising returns of up to 15% per week; in reality, Cash FX conducted only a small amount of foreign exchange trading, and almost all participant funds were misappropriated, paying fictitious trading profits to other participants using funds from new participants, while paying millions of dollars to the defendants. The CFTC claimed that Cash FX also provided participants with false account statements to maintain the illusion of high trading returns, resulting in participants losing at least $406 million. The CFTC is seeking to order the defendants to pay restitution, recover illegal profits, pay civil monetary penalties, and impose trading and registration bans as well as permanent injunctions.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

According to CriptoNoticias, the Spanish Civil Guard and National Police have respectively cracked down on two cryptocurrency-related criminal cases, capturing or identifying a total of 48 individuals involved.Among them, one Ponzi scheme resulted in losses of approximately 327,000 euros for 113 investors; another criminal network implemented fraud through phishing, fake rental advertisements, and other methods, converting illegal gains into cryptocurrency to evade tracking, causing losses exceeding 430,000 euros.

According to Onchain Lens monitoring, an attack cluster transferred approximately 1.54 million dollars' worth of FET from Fetch AI's token converter on Ethereum.The cluster also received approximately 452,000 dollars in newly minted NTX from Nunet Global deployers. As of now, the total confirmed amount involved is approximately 2.01 million dollars.

The Cyber Investigation Department of the Gangwon Special Self-Governing Province Police Agency in South Korea has identified 26 Polymarket users by analyzing public blockchain transaction records and on-chain open-source intelligence, and has filed cases against them for suspected illegal gambling. Among them, 18 have been referred to the prosecution, with a total bet amount of 12.7 million USD, and the highest single user bet reaching 4.1 million USD.The police launched a preliminary investigation in March and began filing cases against the involved individuals in May; the South Korean Communications Commission only ordered the blocking of Polymarket on August 18, and the transactions under investigation occurred while the platform was still accessible. The police are advancing the investigation based on Article 246 of the South Korean Criminal Code.

The police of the United Arab Emirates and Sweden arrested 7 suspects involved in an international money laundering network. Investigators stated that tracking the cryptocurrency transactions of this network revealed its connections to organized crime and contract killings. According to the UAE News Agency citing the Ministry of Interior, the leader of the network is a Swedish citizen who had previously fled Sweden and was wanted by Interpol with a red notice, ultimately being captured in the UAE. Additionally, 6 other suspects were arrested simultaneously in Sweden, and all 7 have been charged.The Ministry of Interior stated that the network processed approximately 70 million Swedish kronor (about 7.1 million USD) in criminal cash proceeds over 10 months and transferred it to other criminal entities while using cryptocurrency to "transfer and move the value of these funds." Tracking cryptocurrency transactions and analyzing digital evidence helped investigators uncover the financial links between this network and other criminal activities, including organized crime and contract killings.Abdulaziz Al Ahmad, the Director of the Federal Criminal Police of the UAE Ministry of Interior, stated that the country will continue to track criminal networks and cut off their sources of funding. Anders Wiberg, head of the International Department of the Swedish Police, said that cooperation with the UAE was a key factor in the successful resolution of this case. Both countries launched simultaneous arrest operations after intelligence sharing and direct security coordination. Previously, Sweden had requested the police to increase efforts to seize illegal digital assets, as the issue of gangs using social media and encrypted applications to recruit paid killers has become increasingly serious.

On-chain detective ZachXBT posted that the wallet address associated with 7zarc has received 4,870 ETH (approximately 15 million USD), with the funds originating from addresses related to the Raidparty project's approximately 70 million USD "exit scam." Subsequently, this portion of ETH was transferred to recharge addresses of several centralized exchanges.ZachXBT pointed out that 7zarc disappeared from public view in 2022 and only became active again in September 2026. Based on this, he publicly questioned the need for an explanation regarding the flow of the related funds.

According to Cointelegraph, Tether's stablecoin USDT was involved in a failed oil deal in Venezuela, resulting in a loss of approximately $230 million for Polish state-owned energy giant Orlen.The transaction took place at the end of 2023, when Venezuela's state oil company PDVSA began requiring payments in USDT to evade U.S. financial sanctions. In November 2023, Samer Awad, a former executive of Orlen's trading subsidiary Orlen Trading Switzerland, led the procurement of 6 million barrels of Venezuelan crude oil from PDVSA. On December 4, Orlen transferred a $230 million advance payment to Dubai seller Hannon International Middle East, which exchanged USDT through multiple cryptocurrency brokers and intermediaries. However, most of the funds went missing during the transfers, and Orlen only received about $29 million worth of crude oil before terminating the contract.The flow of funds shows that Hannon exchanged $400,000 in commission for $80 million in USDT and transferred $135 million to Horizon Global, claiming to have only received $85 million in USDT. In January 2024, Hannon employees delivered two USB drives containing $60 million and $50 million in USDT to brokers in Caracas. In January 2025, the Warsaw regional prosecutor's office announced an investigation into the related oil contracts, involving losses of approximately $378 million.

Some criminal gangs use "free credit card repayment" as bait to lure ordinary people into providing credit card and identity information. They then launder illegal funds from overseas gambling, telecom fraud, and other activities by fabricating consumption and other means, and subsequently contact currency dealers to exchange for virtual currency to transfer abroad.

Whale Alert stated that the dormant transactions activated yesterday involved addresses that mined 50 BTC in Bitcoin blocks 43361, 43452, 43647, 43680, 43765, 43855, and 43871. Whale Alert indicated that, according to its research, the aforementioned blocks were not mined by Satoshi Nakamoto.

The Hong Kong Securities and Futures Commission has listed Star Bridge Capital, Star Bridge Capital Group, SBCFX, Star Bridge Capital Group, Star Bridge Capital Pty Limited, and Topical Wealth International Ltd as unlicensed companies, prohibiting them from engaging in any regulated activities in Hong Kong or actively promoting their services to the public in Hong Kong (whether within or outside Hong Kong).Previously, it was reported that Star Bridge Capital experienced an abnormal liquidation incident in London gold trading, and after the incident, the Hong Kong office of the platform was empty. Due to some funds being deposited through USDT stablecoin, tracking the funds has become more difficult. The Hong Kong police have accepted the case and temporarily classified it as fraud, but no arrests have been made yet.

The Shanghai Public Security Bureau reported the investigation and resolution of a major underground money laundering case involving cross-border currency exchange using virtual currency, arresting more than 70 criminal suspects, with the amount involved exceeding 20 billion yuan.

According to Bitcoin.com, Tomáš Jiříkovský, the main suspect and programmer in a major cryptocurrency money laundering case in the Czech Republic, has sent signals that he may cooperate with the police investigation after the latest detention hearing at the Brno city court. The prosecution stated that he has not yet provided detailed testimony but has changed his previous stance of complete non-cooperation.Jiříkovský is accused of operating a dark web platform and laundering criminal proceeds, with the prosecution seeking a maximum sentence of 20 years in prison and asset forfeiture. The court decided to continue his detention on the grounds of flight risk and the possibility that he may still control some undisclosed involved cryptocurrency assets. The core of the case revolves around a donation of approximately $44 million in Bitcoin that he provided to the Czech Ministry of Justice: he had proposed to give 30% of a seized cryptocurrency wallet to the government in exchange for assistance in unlocking the wallet.

According to Caixin, a large number of mainland and Hong Kong investors participated in the Hong Kong IPO "new share subscription" through ZD Group, and the related funds cannot be redeemed on time. The Hong Kong police stated that as of August 17, 24 investors have reported the case, which has been treated as "fraud" and is being followed up by the Wan Chai District Major Crime Unit, with no arrests made yet.Previously, several investors were informed that the bank accounts of entities associated with ZD Group had been frozen, resulting in the inability to redeem funds, with the scale of involvement reaching the billion Hong Kong dollar level, some of which are cross-border investment funds from the mainland to Hong Kong.

After the Coldcard hardware wallet firmware vulnerability was exploited, approximately 2,100 bitcoins were stolen, resulting in a loss of nearly $130 million. On-chain data shows that long-term holders transferred about 233,000 bitcoins from their wallets in the days before and after the incident, worth approximately $15 billion.Casa CEO Nick Neuman stated that some of the transferred funds came from Coldcard users migrating to multi-signature wallets, and Ledger and Trezor users also took similar measures after the incident. During the same period, about 22,000 bitcoins were transferred to exchanges. Coinkite has requested that users who generated recovery phrases using firmware versions 4.1 to 4.1.9 consider the related wallets compromised and immediately migrate to new recovery phrases. The aforementioned versions cover from March 2021 to July 2026.

According to Livecoins, Brazil's Superior Court of Justice (STJ) rejected the release request of the suspect Luccas, maintaining his detention in São Paulo state. The case involves a large-scale fraud against the technology company C&M Software, with the suspect accused of illegally accessing the company's clearing system to steal approximately 813 million reais (about 160 million USD).The criminals dispersed the funds into nearly 300 fake bank accounts to increase tracking difficulty, and then exchanged the reais for BTC and USDT through multiple blockchains, attempting to cover up the illegal source of funds, constituting money laundering. The main attack occurred in June 2025, with the criminal organization having clearly defined roles (including transfer operators and cryptocurrency fund managers) and bribing internal company employees to assist in cracking the server passwords. The first-instance judge has ordered the arrest of the suspect and about 20 other individuals involved in the case, with the arrest warrant executed at the end of October.

The Federal Security Service of the Russian Federation (FSB) conducted raids on 9 unregistered cryptocurrency trading service providers in Moscow, claiming they were suspected of transferring funds obtained from fraud abroad through cryptocurrency assets, and detained more than 20 employees at the Moscow International Business Center.The FSB stated that these exchanges converted stolen funds from Russian telephone scam victims into cryptocurrency and transferred them to accounts they referred to as Ukrainian processing parties. The operation was carried out jointly by the FSB and the Russian Ministry of Internal Affairs. The Russian Ministry of Internal Affairs has initiated a criminal investigation into large-scale fraud, which under Russian law can carry a maximum sentence of 10 years in prison. The FSB stated that it is continuing to identify victims and assess potential compensation.