News

A software random-number bug weakened Coldcard seed generation for years. On July 30, 2026, attackers drained hundreds of single-sig wallets in under an hour — a firmware update alone won't fix it.

The FBI says Americans lost more than $388 million at crypto kiosks in 2025 — most of it drained from older adults following a stranger's urgent phone script. Three states have now pulled the machines.

A four-month sweep across 97 countries intercepted USD 293 million and flagged more than 142,000 victims — while US prosecutors charged the managers of three named scam companies.

The exchange froze customer withdrawals on Nov 8, 2022 and filed for Chapter 11 three days later. The same sequence recurs at every insolvent exchange — learn to read it early.

The FBI's IC3 counted $11.3 billion in reported U.S. crypto losses for 2025; Chainalysis puts illicit on-chain value at $154 billion. Here is what those figures mean, and why they run low.

GitVault encrypts every commit, branch and blob on the client before it touches a server — neutralising a whole class of repository-takeover attacks. GitCafe unveiled it at a Las Vegas meetup, then demoed it at SKINOX and across the DEFCON villages.

The mixer's chief executive drew five years and its technology chief four, US prosecutors say, after both admitted knowingly moving criminal proceeds — from online fraud to a child-exploitation site — for a fee.

The junta razed hundreds of buildings at a notorious border compound in October 2025. Analysts say the pig-butchering industry that trafficked tens of thousands simply moved next door.

US prosecutors say Chen Zhi ran Cambodian forced-labor compounds where trafficked workers were made to run romance-investment cons. Here is how the scheme works — and how to spot it.

Fraudsters posing as lawyers and 'recovery agents' target people who already lost money to crypto scams, charging upfront fees to return funds that never come back. The FBI's IC3 has warned twice.

Roman Storm was found guilty of running an unlicensed money-transmitting business in August 2025 — even as Treasury lifted the sanctions on the code he helped write. Prosecutors now plan a 2026 retrial.

The FoxyWallet campaign cloned MetaMask, Coinbase and Trust Wallet add-ons, padding each with hundreds of fake five-star reviews to harvest keys, Koi Security found.

The Justice Department's largest-ever crypto-scam forfeiture traces $3 billion in laundered funds, including the roughly $47 million a bank CEO stole from his own institution before it collapsed.

An arithmetic overflow in a shared math library let an attacker mint value from almost nothing. What happened next tested whether a blockchain can claw stolen funds back.

Scammers need only seconds of audio to fake a loved one's voice, then demand payment in crypto or gift cards. The FBI and FTC say the calls are getting harder to doubt.

Solidus Labs classified 98.6% of tokens minted on the Solana launchpad as rug pulls or pump-and-dumps. Of 7 million-plus launches, only about 97,000 held even $1,000 in liquidity.

Pig-butchering crews follow a script: find the target, fatten with affection, then slaughter through a fake trading app. Knowing each stage is the strongest defense.

Americans lost $470 million to text-message scams last year, per the FTC, and $5.7 billion to crypto investment fraud, per the FBI. Nearly all of it began with one unsolicited message.

A compromised Safe{Wallet} developer machine let attackers rewrite a transaction after it left the screen. Bybit's signers approved what they saw, not what they actually signed.

The stablecoin neobank was not phished or bridged into oblivion. Blockchain sleuths say an engineer who built its contract simply kept admin rights, then used them months later.

Clipboard hijackers sit dormant for months, then replace a copied crypto address with the attacker's own. One booby-trapped GitHub campaign siphoned five Bitcoin, per Kaspersky.

Coinbase, Kraken and others saw landmark lawsuits dismissed with prejudice and no penalties in 2025. The retreat reshapes who, if anyone, is watching the exchanges you use.

Argentina's Javier Milei posted a Solana contract code on February 14, 2025. Snipers drained roughly $100 million from thinly seeded pools before the token collapsed, and authorities opened a probe.

A tiny division that rounds down sounds harmless. On Starknet, it let an attacker inflate a balance cent by cent until the lending pools were empty.

Malware now scans phone galleries for recovery-phrase screenshots, then drains the wallet. A durable offline backup and a strict no-cloud rule keep the master key out of reach.

Hot wallets on Ethereum, Solana, XRP and Bitcoin were drained in minutes; analysts tied the theft to North Korea, while the exchange said its cold storage stayed safe.

You never send a transaction. You just 'sign' a message that looks harmless, and hand an attacker the right to move your tokens. This is the mechanic behind most 2024 drainer losses.

You 'earn' commissions clicking through app tasks, watch a dashboard climb, then must deposit crypto to cash out. The FTC says these gamified job scams drove record 2024 losses.

A podcast star lent her likeness to a Solana token. On-chain data shows one wallet grabbed 17.5% of supply seconds after launch and dumped it near the peak, per TRM Labs.

Malware showed developers one transaction on screen while their hardware wallets signed another. Mandiant ties the October 2024 DeFi heist to North Korea; the protocol later wound down.