steal

According to Law360, the cryptocurrency asset theft case involving Uranium Finance has begun trial in the U.S. District Court for the Southern District of New York.Prosecutors allege that Maryland cybersecurity consultant Jonathan Spalletta exploited a vulnerability in the protocol's smart contract to launch an attack in 2021, during which approximately $53.3 million was transferred from 26 liquidity pools in a second attack, leading to the protocol ceasing operations. The statements related to this are allegations by the prosecution and not a conclusion of guilt.

According to Decrypt, the UK's Crown Prosecution Service obtained a confiscation order under the Proceeds of Crime Act 2002, requiring 44-year-old Paul Chowles, a former officer of the National Crime Agency (NCA) from Bristol, to repay £1,810,678.93, approximately $2.4 million.This amount is related to the 50 bitcoins he stole, which were worth about £60,000, or approximately $77,000, when he took them in 2017. Of the 50 bitcoins, 30 have been recovered, and the Crown Prosecution Service attributes the difference between the two amounts to the appreciation of bitcoin since 2017.Chowles was involved in the NCA's investigation of the dark web market Silk Road 2, responsible for analyzing and extracting cryptocurrency from the devices involved. In May 2017, he transferred 50 bitcoins from Thomas White's reserve wallet over two days, splitting them into smaller amounts and transferring them through the bitcoin mixing service Bitcoin Fog, and cashed out a total of £144,580 through 279 transactions using Cryptopay and Wirex debit cards.For years, this theft was attributed to White, who has always denied it, and by the end of 2021, the missing bitcoins were listed as untraceable. In 2022, devices containing private keys were found during a search of Chowles' residence, and the Merseyside police, with the assistance of Chainalysis, traced the flow of funds.

According to the Star newspaper, police in the central region of Perak, in collaboration with the National Energy Company (TNB), launched an operation in Seri Iskandar to dismantle an illegal cryptocurrency mining site and arrested two local men.The individuals involved are suspected of illegally connecting wires to power Bitcoin mining machines. Police seized 30 Bitcoin mining machines, routers, desktop switches, and a roll of wire at the scene. The case is being investigated under Section 427 of the Penal Code and Section 37(1) of the Electricity Supply Act 1990.Police emphasized that stealing electricity for mining is not only illegal but can also cause significant losses to the power company and pose a fire risk.

Slow Fog's Yuxian posted on platform X, stating that systems prior to iOS version 27 are being exploited by certain black and gray market groups to steal encrypted wallets from iPhone users.It reminds users to promptly update their iPhone, iPad, Mac, and other devices to the latest version, to be cautious when installing apps from unknown sources, and to be careful when opening unknown links through Safari and in-app browsers.

The Chief Information Security Officer of the blockchain security company SlowMist, 23pds, stated that attackers are exploiting the Darksword vulnerability to bypass iOS security mechanisms through Safari, gaining control of devices and extracting private keys and other data from self-hosted cryptocurrency wallets. This vulnerability has been used in attacks targeting users in Saudi Arabia, Turkey, Malaysia, and Ukraine. The Google Threat Intelligence Group previously disclosed that Darksword initially only affected iOS versions 18.4 to 18.7.23pds noted that attackers have adapted it to iOS 26.5, but this assessment has not yet been officially verified. Attacks typically begin with social engineering, where users click on malicious links sent via social media or messaging applications, potentially granting Root access to the device and extracting wallet data. Users should promptly update their mobile systems and avoid visiting website links sent by strangers; additionally, three investors have lost nearly 1.8 million dollars in Bitcoin due to downloading fake wallet applications from the official Apple App Store and have filed a lawsuit against Apple.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

Radix Foundation released an incident report stating that attackers exploited a previously undiscovered vulnerability in Radix Engine to extract assets from a third-party vault without the owner's authorization, and then sold them across chains to networks such as Ethereum, BNB Chain, and Solana via Hyperlane.The vulnerability originated from a code compilation in June 2023, and an independent security audit conducted by Zellic in August 2024 also did not identify the issue. About 3 hours after the incident occurred, Radix validators proactively took offline enough staked shares to prevent the network from reaching consensus, thereby stopping further exploitation of the vulnerability; affected assets included ETH, WBTC, USDT, USDC, BNB, and SOL.Radix stated that the vulnerability has been fixed and has undergone independent review and testing, and the network recovery is currently being advanced.

Cybersecurity company Hudson Rock disclosed that the Reddit verified account of the streaming service HBO Max was hijacked earlier this month and deployed 108 malicious ads within approximately 48 hours. These ads used a non-existent HBO Max native macOS application as bait, luring users to open Terminal or PowerShell and paste malicious commands, a technique known as ClickFix.Researchers named this operation PasteSwitch, and its delivery system adapts based on the visitor's device and the advertised software. Observed Mac payloads include MacSync and Atomic macOS (AMOS) information-stealing trojans, targeting browser credentials, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. The malware also utilized Binance Smart Chain contracts as variable C2 address delivery points and was associated with a cryptocurrency clipboard hijacker that replaces clipboard wallet addresses.According to Malwarebytes, Reddit administrators have suspended the related ads and initiated a security investigation following reports. The report did not specify how the account was compromised or the number of victims, nor was there evidence found that the HBO Max streaming service itself was breached. The ClickFix technique has previously been used multiple times in attacks targeting cryptocurrency users, including approximately 2,000 compromised WordPress sites and malicious activities disguised as CAPTCHA.

According to Reuters, Mexican authorities discovered an illegal cryptocurrency mining operation in a remote mountainous building in Tehuacán, Puebla, where 300 GPUs, 80 medium-voltage terminals, and 8 satellite antennas were found on-site. Authorities are investigating whether the operation is stealing electricity from a nearby hydroelectric power station.This is the fourth similar crypto farm discovered in the area since early last year, with three others found near a hydroelectric power station in northern Puebla last year. Local residents reported that the noise from the equipment can be heard from a kilometer away. Mexican security analyst David Saucedo stated that drug trafficking groups seem to have reached a new level of sophistication, as establishing such operations requires technical expertise and support from well-funded groups.Chainalysis Latin America expert Caio Motta pointed out that such operations are usually located in areas with extremely low electricity prices or within the reach of organized crime to steal electricity and establish large-scale mining infrastructure.

According to Decrypt, the Mexican federal prosecutor, in conjunction with the Navy and Puebla state police, conducted a raid on a property in the remote mountainous area of Tlaola, Puebla, seizing approximately 300 cryptocurrency mining machines, as well as transformers, medium-voltage terminals, and satellite internet antennas.The investigation revealed that the mining operation illegally tapped into the grid of the Nuevo Necaxa hydroelectric power station, and authorities have filed charges for "theft of electricity." Currently, forensic accountants are tracing the source of the hardware funding, and money laundering suspicions have not been ruled out. Data from the Mexican Federal Electricity Commission shows that from January to July 2024, non-technical electricity losses reached up to 6,346 gigawatt-hours, valued at approximately 13.8 billion pesos (about 817 million USD).

According to the Slow Fog Security Team, they have detected an attack activity disguised as a free VPS service, specifically targeting iPhone Safari browsers running iOS versions 18.4 to 18.6.2.The attackers exploited six vulnerabilities codenamed DarkSword to form a complete attack chain, covering aspects such as WebKit remote code execution, sandbox escape, and kernel read/write, allowing them to obtain App container files and keychain data without user awareness, and to record keyboard inputs when wallets like imToken, TokenPocket, or TronLink are in the foreground.The Slow Fog team stated that the aforementioned six vulnerabilities have now been patched by Apple, and the current attack belongs to the reuse of n-day vulnerability chains. Simply visiting a malicious page does not directly prove that mnemonic phrases or private keys have been stolen; confirmation still requires device forensics. iOS/iPadOS users are advised to upgrade their systems to version 18.7.3 or 26.3 and above as soon as possible.

According to Cointelegraph, cybersecurity company Morphisec has revealed that a counterfeit desktop application disguised as "Claude Opus 5 Free Desktop" from Anthropic is being used to spread the Windows malware RevStealer. This software can steal data from over 50 types of cryptocurrency wallets, while also collecting sensitive information such as browser passwords, cookies, VPN configurations, message logs, and screenshots.RevStealer has anti-detection mechanisms that perform environmental checks on the target device before execution; if it detects characteristics of a debugging or virtual environment, it will stop running. In addition, Russian cybersecurity company Kaspersky has also disclosed another new malware framework targeting cryptocurrency investors called OkoBot, which can harvest wallet files, inject malicious extensions, and capture wallet application windows to steal assets.

According to security company Huntress, hackers are spreading theft malware to cryptocurrency users by forging Google Docs files, hosting malicious files on GitHub, and impersonating Claude.ai pages. Attackers disguise themselves as senior employees of CoinDesk on the social platform X, luring victims to open Google Docs documents containing malicious code under the pretext of inviting them to an online meeting, thereby guiding users to install the malicious program themselves.Mac users face the threat of Atomic macOS Stealer (AMOS), which can steal browser passwords, cryptocurrency wallet data, and Telegram files; Windows users are pushed fake Google API Connector updates, which, once installed, implant NetSupport RAT and a counterfeit Ledger hardware wallet application. Additionally, hackers are placing false advertisements on search engines like Bing, enticing users to visit counterfeit Claude.ai pages and execute malicious commands. The related malware MacSync and SectopRAT can steal cookies, saved passwords, recovery phrases, and payment card information.Security company Socket also discovered 16 malicious extensions targeting Chrome and Edge, capable of emptying EVM, Solana, and Tron wallet assets.

Numa Lunah, co-founder of the crypto project Refi Hub, stated that he was hacked after installing a transcription application using a download link provided in the Claude chat window. The link pointed to a counterfeit website and bundled malware that attempted to steal all information from his device upon execution. Numa Lunah mentioned that he cleared and reinstalled the affected laptop and found no sensitive information leaked.Subsequently, he discovered a contaminated Claude Code skill file SKILL.md in his backup, which disguised itself as a style guide written by him and contained instructions to re-download the malware and steal credentials every time it was loaded. Microsoft Defender Experts had warned that attackers had shifted from search engine optimization poisoning to large language model response poisoning, with related tactics including recommending download links controlled by attackers, AI brand impersonation installers, and contaminated code libraries and proxy skills. Crypto industry practitioners may hold irrevocable credentials such as mnemonic phrases, private key files, hot wallet JSON, exchange API keys with withdrawal permissions, and deployer keys.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

According to a report by Decrypt, security company Socket released research results linking 77 Firefox extensions to what it calls a "wallet theft factory," with 40 confirmed to have malicious behavior.These extensions disguise themselves as Web3 products like OKX, Rabby Wallet, and TronLink, tricking users into importing wallets through fake wallet interfaces or using modified real wallet code to steal mnemonic phrases and private keys as users input them. Mozilla's signature records show that this activity lasted from March 9 to August 3, and multiple extensions were still online at the time of Socket's report.About half of the extensions displayed realistic wallet interfaces and prompted users to import existing wallets, thereby intercepting the inputted mnemonic phrases or private keys; another 13 were modified versions of Rabby that sent account data stored in wallets to external servers while functioning normally; and 5 specifically collected saved credentials and clipboard content.Additionally, 37 extensions disguised themselves as password generators, dark mode toggles, VPNs, currency converters, and note-taking tools, but actually ran sports score applications sharing the same hardcoded credentials. Nine confirmed malicious extensions were initially released as score applications for sports like football and basketball, with subsequent updates replacing them with wallet theft code.Socket named this activity the "wallet theft factory," but cautioned that it has not confirmed whether all extensions are controlled by the same operator. The Socket team stated that any user who has entered mnemonic phrases or private keys into these extensions should consider it a "permanent leak" and immediately transfer funds to a new wallet, as uninstalling the extensions cannot undo the mnemonic phrases sent elsewhere.

According to CoinDesk, the Internal Revenue Service (IRS) has issued a warning that a sophisticated email phishing campaign targeting U.S. cryptocurrency holders is spreading. Attackers are impersonating official tax letters to lure users into scanning malicious QR codes to steal cryptocurrency wallet credentials and private keys.It is reported that attackers are sending paper letters impersonating the IRS, creating a sense of urgency under the guise of "tax compliance" and "account verification," and including QR codes in the letters. Once users scan the code, they may be directed to a counterfeit website, leading to the leakage of wallet login information, recovery phrases, or private keys, resulting in the theft of digital assets.The IRS reminds taxpayers that official agencies will not request users to provide cryptocurrency wallet private keys, recovery phrases, or perform similar "wallet verification" operations through unofficial channels. Cryptocurrency holders should be vigilant against any suspicious emails and letters that request scanning QR codes, connecting wallets, or submitting sensitive information.As the number of cryptocurrency asset holders grows, social engineering attacks targeting digital wallets continue to increase, and regulatory and security agencies are strengthening warnings against related fraudulent activities.

According to Decrypt, the U.S. Department of Justice has filed charges against 17 hackers allegedly affiliated with Iran's Mabna Institute, accusing them of participating in years-long cyber attack activities, including the 2017 breach of U.S. cable network HBO, where they stole data and demanded approximately $6 million in ransom paid in Bitcoin. Prosecutors claim that the organization conducted hacking attacks on behalf of the Iranian Islamic Revolutionary Guard Corps and other Iranian government clients, targeting hundreds of universities, businesses, and government agencies worldwide, stealing at least 31.5 TB of academic data and intellectual property.The organization also targeted over 100,000 professor accounts, breaching about 8,000 accounts across 144 U.S. universities and 178 foreign universities. The U.S. State Department is offering a reward of up to $10 million for information leading to the whereabouts of five of the defendants. In recent months, the U.S. Treasury has imposed sanctions on several Iranian cryptocurrency exchanges and frozen over $131 million in cryptocurrency assets related to the Iranian central bank and the Revolutionary Guard.

According to Decrypt, security company Bitdefender has warned that the newly released Hollywood blockbuster "The Odyssey" has been embedded with Lumma Stealer information-stealing malware by attackers, who are attempting to steal users' cryptocurrency wallets, passwords, and browser data through fake movie files.Bitdefender revealed that the malicious files began spreading within days of the film's release, with attackers disguising them as high-definition WEBRip or Blu-ray version resources and using names similar to legitimate torrent files to entice users to download. In reality, these files are not videos but Windows executable programs that, when run, will infect the device. Attackers often replace the file icons to make them look like VLC player or video files, while also taking advantage of Windows' default setting to hide file extensions, reducing users' ability to recognize the risk.Once executed, Lumma Stealer will collect saved passwords, payment information, autofill data, remote desktop credentials, and sensitive information including cryptocurrency wallets. Additionally, the malware will steal authentication cookies, allowing attackers to potentially bypass some account protections even if the user has enabled multi-factor authentication (MFA).