cybercrime

Tổ chức Cảnh sát Hình sự Quốc tế cho biết, Chiến dịch Serengeti III diễn ra từ ngày 29 tháng 6 đến 31 tháng 8 năm 2026 tại 21 quốc gia, đã bắt giữ 1462 nghi phạm, triệt phá 10,909 mạng lưới độc hại và thu hồi hơn 105 triệu đô la Mỹ tiền bất hợp pháp. Cuộc điều tra cũng xác nhận có 65,929 nạn nhân bị tấn công bởi các băng nhóm tội phạm mạng, với tổng thiệt hại vượt quá 385 triệu đô la Mỹ.Chiến dịch lần này tập trung vào việc chống lại lừa đảo trực tuyến, phần mềm tống tiền, xâm nhập email thương mại, lừa đảo trực tuyến và tống tiền kỹ thuật số. Trong các vụ án cụ thể, cảnh sát Uganda đã triệt phá hai băng nhóm lừa đảo xuyên quốc gia và bắt giữ 365 người nước ngoài; Angola đã phát hiện hai trung tâm khai thác tiền điện tử bất hợp pháp, bắt giữ 9 người và tịch thu hơn 2000 máy khai thác; Nigeria có một vụ án khác liên quan đến hơn 2.4 triệu đô la Mỹ nghi ngờ là tài sản tội phạm, trong đó một lượng lớn tiền đã được rửa tiền thông qua giao dịch tiền điện tử.

The National Police of Ukraine and the Internal Security Department conducted a joint operation, arresting a suspect in the Transcarpathian region who is alleged to be involved in an international cybercrime gang. This gang is implicated in fraud and money laundering cases exceeding $100 million targeting the United States and Europe, and had previously been listed as an international wanted person by the FBI.The suspect was found in possession of forged identity documents and had even fabricated a death certificate to conceal their whereabouts. The gang deployed malware to steal personal and corporate data, subsequently extorting victims for ransom. Money laundering methods included purchasing real estate and using relatives' names to obscure the flow of funds. Authorities seized approximately $11 million in assets, including cash, real estate, vehicles, and about $3 million worth of cryptocurrency, and also apprehended two co-defendants. The suspect faces charges of document forgery and money laundering.

A 27-year-old German hacker, Noah Christopher, was arrested in Bangkok, Thailand, facing up to 74 arrest warrants for cyber crimes in Europe.Investigations show that this individual is suspected of developing and operating a ransomware platform and a "cybercrime-as-a-service" (CaaS) system between 2021 and 2025, including providing distributed denial-of-service (DDoS) attack tools (such as Fluxstress and Neldowner), assisting global clients in launching cyber attacks and charging fees, with related ransom payments involving cryptocurrencies and other digital assets, constituting transnational cybercrime activities. His visa has been revoked, and he is currently detained awaiting extradition to Germany.

According to DL News, the Ertzaintza police in Spain's Basque Country stated that cryptocurrency-related crimes in the region are on the rise, with a total of 541 related cases investigated in 2025, which are still under investigation.The police have been equipped with specialized tools to monitor cryptocurrency transactions across multiple blockchain networks and have formed a cybercrime department consisting of 26 detectives dedicated to combating crimes such as crypto fraud and hacking. The cases under investigation include 13 suspected cases of crypto fraud, 2 suspected cases of crypto money laundering, as well as tax evasion and illegal purchases of goods and services.The police warned that scammers impersonate friends and family on social media platforms like Instagram to provide investment advice, tricking victims into installing applications that allow remote control, thereby stealing cryptocurrency wallets and bank accounts.

According to Cointelegraph, the FBI, Europol, and law enforcement agencies from 14 countries conducted a joint operation on March 3-4, successfully shutting down the cybercrime forum LeakBase. The forum had over 142,000 members and served as a platform for hackers to buy and sell stolen data and cybercrime tools.Law enforcement has seized user accounts, posts, credit details, private information, and IP logs as evidence, and executed search warrants and arrests in multiple countries. Notably, LeakBase's predecessor, Raidforums, was shut down in 2022 and had hosted leaked data containing personal information of approximately 272,000 users of the cryptocurrency wallet company Ledger. In recent years, data breaches in the cryptocurrency industry have continued to rise, including security incidents such as the hacking of Coinbase's internal systems.

The Ministry of Public Security has announced that it has drafted the "Cyber Crime Prevention Law (Draft for Comments)" and is now publicly soliciting opinions from society, with the deadline for feedback set for March 2, 2026. The content includes: no individual or organization shall knowingly harbor, transfer, acquire, sell on behalf of others, or conceal or disguise funds, data, or virtual property obtained from others' online illegal activities.No individual or organization shall knowingly use funds obtained from others' illegal activities to provide capital flow services using virtual currency or other online virtual property for others.

According to China News Service, Hong Kong hosted the annual meeting of the International Criminal Police Organization's Cybercrime Expert Group for the first time. The meeting covered various topics including online extortion, artificial intelligence, and virtual asset tracking. Chief Superintendent Chow Man-ming of the Hong Kong Police Force noted the emerging trends in crimes related to virtual assets and established a virtual asset intelligence task force last year as a public-private partnership to jointly address technological challenges.The Hong Kong police have also developed a virtual asset tracking system that visualizes the virtual asset investigation process and fully supports investigators.

On Monday night, three masked men broke into a residence in Manosque, France, threatening a woman with a gun and stealing a USB drive containing her partner's cryptocurrency data. According to the French newspaper Le Parisien, the incident occurred at a home on Cherry Path in the Alpes-de-Haute-Provence region.The attackers threatened the victim with a handgun and slapped her before fleeing the scene with the USB drive. It is reported that the victim was unharmed and managed to escape and call the police within minutes. Local police have opened an investigation, and the case has been handed over to the local criminal investigation department and the national police regional headquarters. Last year, security company Casa's Chief Technology Officer Jameson Lopp recorded over 70 violent attacks related to cryptocurrency in its public database, with France becoming a hotspot for such violent crimes in Europe, with more than 14 related cases.Cybercrime consultant David Sehyeon told Decrypt, "The baseline level of criminal activity in France is relatively high, and the cryptocurrency wealth held by entrepreneurs, traders, and public figures is quite visible. Coupled with the growth of local expertise in digital assets, these factors together create a breeding ground for more speculative and organized cryptocurrency-related crime."

Indian police have arrested a former Coinbase customer service representative in Hyderabad, who is suspected of being involved in the insider data breach incident disclosed by Coinbase in May of this year. This is the first known arrest in the case, confirmed by Coinbase CEO Brian Armstrong.The incident dates back to December 2024, and investigations show that cybercriminals obtained access to internal systems by bribing overseas customer service personnel, stealing sensitive information from 69,461 users, including names, addresses, phone numbers, emails, and government-issued identification documents. Coinbase stated that the attackers attempted to extort $20 million, which the company refused to pay, instead establishing a reward program of the same amount to track down and apprehend those involved.In its Q2 financial report, Coinbase disclosed that the incident has resulted in $307 million in related expenses, covering user compensation, legal fees, and security upgrade costs. Additionally, Coinbase is currently facing a class-action lawsuit from shareholders, alleging that it failed to disclose the incident in a timely manner, misleading investors. Coinbase stated that it will continue to cooperate with international law enforcement agencies in the investigation, suggesting that further arrests may follow.

Recently, according to market news, analyst Emmett Gallic monitored that Aleksey Bilyuchenko, who has been accused by the U.S. Department of Justice of being a Mt. Gox hacker, has deposited 1,300 BTC (worth approximately $114 million) into an unknown trading platform in the past 7 days. This series of addresses still holds 4,100 BTC (worth $360 million). They have sold a total of 2,300 BTC.Public information shows that Aleksey Bilyuchenko has been operating BTC-e, a notorious trading platform, with Alexander Vinnik since 2011, which has been accused of laundering money for global cybercriminals, including ransomware, identity theft, and drug trafficking.BTC-e was shut down by law enforcement in 2017. The U.S. Department of Justice has accused him of hacking Mt. Gox (then the world's largest Bitcoin exchange) with Aleksandr Verner since 2011, stealing approximately 647,000 bitcoins (leading to the bankruptcy of Mt. Gox). They have been charged with conspiracy to launder money and using part of the proceeds to operate BTC-e.

According to market news, the U.S. Department of Justice revealed that the Federal Bureau of Investigation (FBI) has teamed up with European law enforcement agencies to dismantle a multinational money laundering platform that primarily provided cryptocurrency cash-out services to cybercriminals. The platform, named E-Note, was operated by a Russian citizen and has handled over $70 million in illegal funds since 2017, including assets extorted or stolen from victims in the United States.The U.S. Attorney's Office for the Eastern District of Michigan announced the indictment of 39-year-old Russian citizen Mykhalio Petrovich Chudnovets, charging him with conspiracy to commit money laundering. It is alleged that since 2010, the suspect has assisted cybercrime groups in transferring criminal proceeds across borders and converting cryptocurrency into cash through the E-Note payment processing service he controlled. Law enforcement agencies have seized his servers, mobile applications, and related domain names. If convicted, he faces a maximum of 20 years in prison.

The European Union (EU) law enforcement agency Europol announced on Monday that a coordinated law enforcement operation conducted in Zurich has successfully dismantled the cryptocurrency mixing service Cryptomixer, which was allegedly used by cybercriminals to launder illegal bitcoins.The operation was jointly carried out by the Swiss and German police in collaboration with Europol, resulting in the seizure of three servers, the domain name Cryptomixer.io, bitcoins worth over 25 million euros (approximately 29 million dollars), and more than 12 terabytes of data. Officials stated that since 2016, Cryptomixer has assisted in laundering over 1.3 billion euros worth of bitcoins. Its longer settlement window and random fund distribution patterns made it an ideal tool for concealing criminal proceeds.

According to Decrypt, European law enforcement successfully shut down the cryptocurrency mixing service Cryptomixer, which has laundered over $1.4 billion in Bitcoin since 2016.The operation was carried out by German and Swiss law enforcement agencies with the support of Europol and Eurojust in Zurich, Switzerland, resulting in the seizure of three servers, 12 TB of data, and over $27 million in cryptocurrency, as well as the confiscation of the domain cryptomixer.io.Reports indicate that Cryptomixer provided laundering services for ransomware gangs, dark web markets, and underground forums, helping criminals obscure the origins of illegal proceeds from drug trafficking, arms dealing, ransomware attacks, and payment card fraud. Cybercrime consultant David Sehyeon Baek stated that the mixer operated for nearly a decade and handled large sums of money, highlighting its significant position in the underground market.

A South Korean court has sentenced a man to prison for creating a fake securities trading platform and laundering his $4.2 million in illegal proceeds through cryptocurrency.According to market reports, the operator of this fake platform copied the trademark and data of a "well-known" securities company in an attempt to make the scam appear more legitimate. The case was heard in the Gwangju District Court's criminal division, where presiding Judge Kim Young-kyu noted that the platform defrauded a total of 116 victims. Judge Kim ultimately sentenced the man to 8 years in prison. The court hearing revealed that a 41-year-old accomplice helped him convert $2.9 million from investors into cryptocurrency multiple times through company accounts and private wallets to complete the money laundering process. This case highlights the surge in criminal activities within the cryptocurrency industry. According to FBI data, reported losses from cryptocurrency investment scams exceeded $5.8 billion in 2024. Statistics from DefiLlama show that cybercriminals stole over $2.4 billion in 2025 through hacking and exploiting vulnerabilities, which is double the amount in 2024. Additionally, the so-called "pig butchering" scams stole $4 billion in 2024, with Chainalysis data indicating a surge in related cases.

According to Decrypt, Indonesian authorities have arrested a local hacker who is suspected of exploiting a security vulnerability in the deposit system of the trading platform Markets.com to steal $398,000 worth of cryptocurrency.The arrested suspect has only been identified as HS and was detained on Saturday in Bandung, West Java. It is reported that the hacker exploited an anomaly in the Markets.com system, which would generate a USDT balance based on any deposit amount entered by the attacker, lacking proper backend verification. Police stated that HS created four fake accounts by scraping Indonesian national ID information from public websites. Authorities seized a laptop, a mobile phone, CPU equipment, ATM cards, a 152-square-meter shop in Bandung, and a cold wallet containing 266,801 USDT, valued at approximately $4.2 million. The suspect faces charges of cybercrime and anti-money laundering laws, which could result in a maximum sentence of 15 years in prison and a $900,000 fine.

The U.S. Department of Justice announced on Tuesday that 45-year-old California resident Kunal Mehta (nicknamed "Shrek") has pleaded guilty to participating in a theft case involving $263 million in cryptocurrency. Mehta admitted to violating the Racketeer Influenced and Corrupt Organizations Act (RICO) and assisting in laundering at least $25 million.According to the Department of Justice, Mehta is the eighth member of a 13-person cybercrime gang to plead guilty, which has been operating since October 2023, stealing cryptocurrency from victims across the United States through social engineering and hacking techniques. Prosecutors stated that Mehta served as the "money launderer" in the gang, providing laundering services to convert cryptocurrency into cash and had delivered a suitcase containing about $500,000 in cash to co-conspirators.The stolen funds were used to purchase nightclub expenses, luxury cars, watches, jewelry, designer handbags, and rental properties in Los Angeles and Miami. The seized assets in the case include 28 luxury cars, among which are 7 Lamborghinis, 3 Ferraris, 1 Rolls Royce, and 1 McLaren.

Brazilian Federal Deputy Chrisóstomo de Moura has proposed a bill aimed at granting courts the power to freeze or confiscate cryptocurrency assets of suspects in cybercrime.The bill allows judges to take preventive measures, either proactively or at the request of prosecutors, when dealing with fraud crimes, including freezing cryptocurrency wallets and traditional financial assets. The deputy stated that these preventive measures would help protect society and provide a strong tool for combating fraud. The bill also proposes the establishment of a "National Fraud Victims Compensation Fund" to provide immediate assistance to victims, addressing the slow process of civil compensation. Additionally, the deputy calls for harsher penalties for cybercriminals, including preventive detention and restrictions on citizens' access to cryptocurrency trading platforms used for criminal activities. The bill is currently under review by the committee, and it is expected to take some time to complete the final analysis.

According to Caixin, the fight against and governance of cybercrime has become a global challenge.The eighth national criminal trial work conference emphasized the importance of maintaining cybersecurity and proposed specific requirements from three aspects: focusing on new issues such as the disposal of virtual currencies involved in cases, obscene performances in online live broadcasts, jurisdiction over cybercrime cases, and the certification of electronic data collection, further improving judicial rules, standardizing judgment criteria, and promoting lawful and civilized internet usage; severely cracking down on cross-border online gambling crimes in accordance with the law, holding criminally liable the online platforms that provide services for overseas gambling and disseminate harmful information related to gambling, and cooperating with relevant departments to rectify the online gambling promotion chain; increasing efforts to combat upstream illegal activities in the black and gray industries that infringe on citizens' personal information, strictly punishing "insiders" in the industry, applying employment bans according to the law, and promoting the enforcement of regulatory responsibilities on internet platforms.

According to Decrypt, the Australian Federal Police have warned that scammers are exploiting the Australian national cybercrime reporting system ReportCyber by submitting false reports using stolen personal information, and then impersonating Australian Federal Police officers to call victims and steal their digital assets.The scam is highly deceptive, as criminals verify information in a plausible manner and act quickly to create a sense of urgency. They illegally obtain email addresses, phone numbers, and other information, using the system's rules that allow third parties to report on behalf of others to gain trust. Some victims received calls from "police" informing them that they were involved in a cryptocurrency data breach, and were given what appeared to be an official reference number. After seeing a report that matched the one submitted by the scammers, they almost fell for it.Subsequently, a second caller impersonated a platform, using the same reference number to induce a transfer. Fortunately, the victim realized in time and hung up the phone. Police stated that in similar cases, scammers often spoof numbers and remind the public to remain vigilant, recognize scams, and protect their assets.

According to the official account of the Dinghai Court in Zhoushan, Zhejiang, the Dinghai Court has concluded a case involving the assistance of information network criminal activities related to Tether (USDT). Several defendants registered multiple "business accounts" on a foreign virtual currency platform, profiting through profit-sharing and buying low and selling high on Tether, while being aware that upstream transactions might involve illegal activities. They still assisted in transferring funds related to crimes such as telecom fraud, cumulatively helping to settle over 5 million yuan related to information network criminal activities. This was considered "serious circumstances," and they were sentenced to fixed-term imprisonment and fines according to the law. The seized illicit funds of 877,000 yuan were returned to the victims.