Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Crypto Scam. Show all posts

DOJ Disrupts Major Myanmar-Based Scam Targeting TickMill Users

 


Taking action to demonstrate the United States' commitment to combating transnational cyber-fraud networks, the Department of Justice has announced a decisive seizure of tickmilleas.com, a domain allegedly used by a sophisticated cryptocurrency investment scam originating in Burma, as a decisive step to underscore its intensifying campaign against cyber-fraud networks. 

Investigators have determined that the site, linked to the notorious Tai Chang scam compound, a hub favored by Burmese groups previously designated by the U.S Treasury for connections to Chinese organized crime and large-scale Southeast Asian scam operations, was intentionally crafted to lure foreign investors with fabricated promises of high returns, based on fabricated information provided to the investigators. A further manipulation took place to induce the victim to download fraudulent mobile applications that were part of the scheme's broader ecosystem. 

Law enforcement authorities have already taken coordinated actions that led to the removal of malicious apps from major app stores and the eradication of more than 2,000 scam-related accounts across Meta platforms as a result of coordinated actions. A renewed global alert has also been issued by Interpol, warning that such criminal activities are rapidly on the rise due to the rapidly developing use of technology and, in some cases, trafficking of forced labor in order to sustain these criminal enterprises. 

Using a counterfeit platform, the scammers deceived their victims into transferring their savings, and they usually presented fabricated dashboards that showed handsome, albeit fictional, gains from their investments, using the counterfeit platform. 

A number of victims reported seeing supposed deposits that were entered by the criminals themselves, according to the FBI. This was done in order to create the appearance that the money would be in a good position and to encourage further contributions. Even though the domains were registered only in early November 2025, investigators have already identified multiple individuals who have been induced to contribute cryptocurrency to the scam in recent weeks. 

Additionally, users were directed to download mobile applications which were alleged to be related to the platform through the website, prompting the FBI to alert both Google and Apple; some of the fraudulent apps have since been removed from the market. As the domain has been seized, visitors are met with an official law enforcement notice, eschewing what once looked like an impressive facade for an international fraud operation.

As the FBI San Diego Field Office continues its investigations, as well as the newly formed Scam Center Strike Force, it has been revealed that the seized domain was not an isolated fraud, but rather an extension of a scam infrastructure in Southeast Asia which is well-entrenched in the digital world. Tickmilleas.com, a website that sells pig meat and related products, was identified by authorities as having been built inside the Tai Chang compound in Burma, a fortified enclave located on the Thai-Myanmar border known for violent enforcement tactics, coerced labor, and large-scale "pig butchering" schemes. 

Associated with the Democratic Karen Benevolent Army, this compound has become a central engine within a multibillion dollar fraud economy, which targets Americans through sophisticated cryptocurrency investment traps that are disguised as professional trading platforms operated by affiliates of the Democratic Karen Benevolent Army, as well as broader Chinese transnational crime syndicates.

In order to be convincing to the victims, the website which was taken down by U.S. officials was designed as a convincing imitation of the legitimate TickMill trading service. It was decorated with fake trading dashboards, staged deposits, and fraudulent mobile applications aimed at luring victims deeper into the con. The investigators noted that there was a high degree of trafficking among the individuals working for the scam, as they were forced to engage in scripted interactions that were meant to reassure victims and extract increasing amounts of money from them. 

Despite the domain having been active for just a short time, federal agents were able to quickly map its infrastructure, identify the investors who had been deceived, and cut off the digital channels used for siphoning funds within minutes of its activeness. There had been three successful domain seizures linked to Tai Chang within the past few weeks, with the rapid intervention marking the third in the region—a sign that the U.S. efforts are becoming more aggressive, and the criminal networks operating around the region are experiencing a greater degree of disruption.

These operations are part of a broader criminal ecosystem known as pig butchering, which is a long-con scam in which perpetrators build trust with victims before stealing from them their savings. Officials from the U.S. estimate that these types of fraud schemes are draining approximately $9 to $10 billion from Americans every year, underscoring both their scale and sophistication in the way they are developed and executed. 

However, the human cost of such fraud schemes goes far beyond financial loss. Human rights groups, investigators, and experts have all repeatedly gathered evidence that a substantial number of these scam centers' staff members are trafficking victims who have been coerced, threatened, and violently forced into participating. As a result of the expansion of scam compounds across parts of Southeast Asia, it is reportedly estimated that they account for a substantial share of the country's economic output as well. 

According to the FBI's Internet Crime Complaint Center, there were more than 41,000 reports of cryptocurrency investment fraud in 2024, involving losses of over $5.8 billion, but investigators believe that the actual numbers don't even come close to the true damages, as many victims are too embarrassed or scared to come forward. 

A growing number of cross-border fraud networks are being uncovered by U.S. authorities. Officials are warning the public to be vigilant against platforms that promise effortless returns or encourage the download of unfamiliar apps - tactics that have been repeatedly used in these types of schemes. Experts note that if early skepticism, independent verification, and prompt reporting are utilized, they can significantly reduce the reach of such criminal organizations. 

Despite the fact that tickmilleas.com has been dismantled, investigators stress the importance of sustained international cooperation and ensuring that consumers remain informed in order to disrupt the larger ecosystem that provides the basis for these schemes to flourish.

Massive NPM Supply-Chain Attack Reaches Millions, Nets Hackers Less Than $1,000

 

The largest supply-chain attack in NPM ecosystem history impacted approximately 10% of cloud environments after attackers compromised maintainer Josh Junon's account through a phishing campaign, yet generated minimal profits for the perpetrators. 

The attack began when Junon fell victim to a password reset phishing lure, allowing threat actors to access his NPM account and push malicious updates to highly popular packages including chalk and debug-js, which collectively receive over 2.6 billion weekly downloads. The attackers embedded cryptocurrency-stealing malware that redirected Ethereum and Solana transactions to attacker-controlled wallets.

The compromise's reach was staggering, with Wiz security researchers finding that the targeted packages served as fundamental building blocks in 99% of cloud environments. During the two-hour window before discovery and removal, the malicious packages were downloaded by roughly 10% of cloud environments, demonstrating the rapid propagation potential of supply-chain attacks. 

Despite the massive scale and widespread impact, the attackers' financial gains were surprisingly modest. Security Alliance analysis revealed the malicious code specifically targeted browser environments, hooking cryptocurrency signing requests to perform crypto-jacking operations. The attackers managed to steal only five cents worth of ETH and $20 of an obscure memecoin initially.

Socket researchers later expanded the investigation, discovering the same phishing campaign had compromised DuckDB's maintainer account with identical crypto-stealing code. Their comprehensive analysis traced total profits across all attacker wallets to approximately $429 in Ethereum, $46 in Solana, and small amounts in Bitcoin, Tron, Bitcoin Cash, and Litecoin, totaling roughly $600 . 

The limited payload targeting only cryptocurrency transactions likely prevented a more catastrophic security incident. Attackers could have deployed reverse shells, facilitated lateral network movement, or installed destructive malware given their privileged access . 

 
While companies invested significant hours in cleanup, rebuilding, and security auditing following the incident, the actual security implications remained minimal. The attacker wallets containing substantial amounts have been flagged by security services, further limiting the perpetrators' ability to convert or utilize their meager gains. 

This incident highlights both the vulnerability of open-source ecosystems to social engineering attacks and the potential for widespread impact even when financial motivation proves unsuccessful.

North Korean Hackers Target Crypto Professionals With Info-Stealing Malware

 

North Korean hackers are tricking crypto experts into attending elaborate phoney job interviews in order to access their data and install sophisticated malware on their devices. 

Cisco Talos disclosed earlier this week that a new Python-based remote access trojan called "PylangGhost" links malware to a North Korean hacking group dubbed "Famous Chollima," also known as "Wagemole.” "Based on the advertised positions, it is clear that the Famous Chollima is broadly targeting individuals with previous experience in cryptocurrency and blockchain technologies," the researchers explained. 

The effort uses fake employment sites that mimic reputable businesses like Coinbase, Robinhood, and Uniswap to recruit blockchain and crypto experts in India. The scam begins with bogus recruiters guiding job seekers to skill-testing websites, where they submit personal information and answer technical questions. 

Following completion of the assessments, candidates are directed to allow camera access for a video interview, and then urged to copy and execute malicious commands masked as video driver installations. 

Dileep Kumar H V, director of Digital South Trust, told Decrypt that to combat these scams, "India must mandate cybersecurity audits for blockchain firms and monitor fake job portals.” “CERT-In should issue red alerts, while MEITY and NCIIPC must strengthen global coordination on cross-border cybercrime,” he stated, calling for “stronger legal provisions” under the IT Act and “digital awareness campaigns.” 

The recently identified PylangGhost malware has the ability to harvest session cookies and passwords from more than 80 browser extensions, including well-known crypto wallets and password managers like Metamask, 1Password, NordPass, and Phantom. The Trojan runs remote commands from command-and-control servers and gains continuous access to compromised systems. 

This most recent operation fits in with North Korea's larger trend of cybercrime with a crypto focus, which includes the infamous Lazarus Group, which has been involved in some of the biggest heists in the industry. The regime is now focussing on individual professionals to obtain intelligence and possibly infiltrate crypto organisations from within, in addition to stealing money straight from exchanges. 

With campaigns like "Contagious Interview" and "DeceptiveDevelopment," the gang has been launching hiring-based attacks since at least 2023. These attacks have targeted cryptocurrency developers on platforms like GitHub, Upwork, and CryptoJobsList.

Crypto Scammers Are Targeting AI Trade Bots

 

The blockchain security company CertiK disclosed how a new generation of scammers is changing their tactics to target automated trading bots in the wake of the LIBRA meme currency fiasco, in which insiders were given advanced information of the launch procedures.

Kang Li, the chief security officer at CertiK, told Decrypt last week at Consensus in Hong Kong that some smart contracts are intentionally made to target the snipers.

The observations follow Hayden Davis's description of such ventures as a "zero-sum game" in which only a few have power. Davis is the self-described "launch strategist" for LIBRA and other celebrity meme coins.

Even at the top, all of it is extractive to some degree—none of it has value, Davis stated in an interview with Coffeezilla's Stephen Findeisen last Sunday. He explained how "professional snipers" are involved in meme coin launches, front-running a token and loading up to buy in before a launch is made public.

Smart contract sniping is a technique in which bots watch on-chain activity for newly issued tokens and execute deals before human traders can react. These bots use on-chain technology and are trained to execute trades as soon as liquidity becomes available. According to Li, a new breed of shrewd fraudsters is creating fake tokens with hidden "backdoors" that appear secure to AI-powered trading bots trained to identify security issues. 

Although these artificial intelligence trading bots "are not dumb" and examine tokens "to see if you have any clear rug-proofing function there," Li noted that scammers have exploited this as a bait-and-switch tactic. 

Following the launch of a token, the scammers "immediately promote [this] in all the AI trading community," and "once they have a few buys, they rug pull it," Li added. 

Li refutes the notion that blockchain security is unnecessary for meme coins and pump-and-dump operations, claiming that the actual risks are in who controls the token, price manipulation, and the history of those behind it. These scams are taking place on a "massive scale," potentially resulting in losses of "tens of millions of dollars," according to Li. With no fear of legal repercussions, scammers 'simply keep destroying' trading bots, taking advantage of a victim.

New Crypto Threat: Transaction Simulation Spoofing Leads to $460,000 Ethereum Theft

 


Cybercriminals are employing a sophisticated technique called “transaction simulation spoofing” to steal cryptocurrency, with a recent attack resulting in the theft of 143.45 Ethereum (ETH), valued at nearly $460,000. This exploit, identified by blockchain security platform ScamSniffer, targets vulnerabilities within the transaction simulation features of modern Web3 wallets—tools designed to protect users from malicious and fraudulent transactions.
 
How the Attack Works

Transaction simulation is a security feature that allows users to preview the outcome of a blockchain transaction before approving and executing it. This function helps users verify transaction details, such as:
  • The amount of cryptocurrency being sent or received.
  • Applicable gas (transaction) fees.
  • Changes to on-chain data resulting from the transaction.
Attackers exploit this feature by directing victims to a fraudulent website disguised as a legitimate platform. On this site, users are prompted to interact with a seemingly harmless “Claim” function. The simulation preview misleadingly shows that the user will receive a small amount of ETH. However, due to the brief time gap between simulation and actual execution, attackers manipulate the on-chain contract state, altering the transaction’s behavior. When the user approves the transaction based on the simulation, they unknowingly authorize the transfer of their entire cryptocurrency balance to the attacker’s wallet. ScamSniffer reported a real-world example where a victim signed the deceptive transaction just 30 seconds after the contract state was modified, leading to the loss of 143.45 ETH.


“This new attack vector represents a significant evolution in phishing techniques,” stated ScamSniffer. “Instead of relying on basic deception, attackers are now exploiting trusted wallet features that users depend on for security. This advanced method makes detection much more difficult.”

Mitigation Strategies for Wallet Developers

To counteract such threats, ScamSniffer recommends several security improvements for Web3 wallets:
  • Limit Simulation Refresh Rates: Align refresh rates with blockchain block times to reduce the window for manipulation.
  • Mandatory Simulation Refresh: Force wallets to refresh simulation results before executing critical actions.
  • Expiration Warnings: Implement alerts that notify users when simulation results become outdated.

Precautions for Crypto Holders

For cryptocurrency users, this incident highlights the risks of fully trusting wallet transaction simulations. To enhance security, users should:
  • Exercise caution with “free claim” offers on unfamiliar websites.
  • Only interact with verified and trusted decentralized applications (dApps).
  • Regularly review wallet permissions and revoke access to suspicious platforms.
As phishing tactics grow more sophisticated, staying vigilant and adopting secure practices is crucial for protecting digital assets.

California Man Sues Banks Over $986K Cryptocurrency Scam



Ken Liem, a California resident, has filed a lawsuit against three major banks, accusing them of negligence in enabling a cryptocurrency investment scam. Liem claims he was defrauded of $986,000 after being targeted on LinkedIn in June 2023 by a scammer promoting crypto investment opportunities. Over six months, Liem wired substantial funds through Wells Fargo to accounts held by Hong Kong-based entities.

Liem’s ordeal escalated when his cryptocurrency account was frozen under false allegations of money laundering. To regain access to his funds, scammers demanded he pay a fake IRS tax—an established tactic used to maximize financial extraction from victims before vanishing.

The lawsuit names three financial institutions as defendants:
  • Chong Hing Bank Limited (Hong Kong-based)
  • Fubon Bank Limited (Hong Kong-based)
  • DBS Bank (Singapore-based, with a Los Angeles branch)

Allegations of Negligence and Non-Compliance

Liem accuses these banks of failing to follow mandatory “Know Your Customer” (KYC) and anti-money laundering (AML) protocols as required by the U.S. Bank Secrecy Act. The lawsuit asserts that the banks:
  • Failed to Verify Identities: Inadequate due diligence on account holders allowed fraudsters to operate unchecked.
  • Neglected Business Verification: The nature of the businesses linked to these accounts was not properly investigated.
  • Ignored Complaints: Liem reported the scam in August 2024, but the banks either disregarded his concerns or denied accountability.

The lawsuit contends that these financial institutions enabled the transfer of illicit funds from the U.S. to Asian accounts tied to organized scams by ignoring suspicious transactions.

Liem's case highlights the growing debate over banks' responsibility in preventing fraud. While lawsuits of this nature are uncommon, they are not without precedent. For instance:
  • January 2024: Two elderly victims of IRS impersonation scams sued JPMorgan Chase for allowing large international transfers without adequate scrutiny.

Globally, different approaches are being adopted to address fraud:
  • United Kingdom: New regulations require banks to reimburse scam victims up to £85,000 ($106,426) within five days, though banks have pushed back against raising this cap.
  • Australia: Proposed legislation could fine banks, telecom providers, and social media platforms for failing to prevent scams.
  • United States: The Consumer Financial Protection Bureau (CFPB) has taken legal action against Bank of America, Wells Fargo, and JPMorgan Chase for not preventing fraud on the Zelle platform, which has resulted in $870 million in losses since 2017.

As global authorities and financial institutions grapple with accountability measures, victims like Ken Liem face significant challenges in recovering their stolen funds. This lawsuit underscores the urgent need for stronger fraud prevention policies and stricter enforcement of compliance standards within the banking sector.

Crypto Dealers Targeted in Alarming Kidnapping and Extortion Cases

 


Recent incidents have revealed a troubling trend of cryptocurrency dealers being targeted for kidnappings and extortion. These cases underline the risks associated with the growing prominence of the cryptocurrency sector.

French authorities recently rescued a 56-year-old man found tied in the trunk of a car in Le Mans. According to France Bleu Normandie, the man had been abducted on New Year’s Eve by masked assailants who broke into his home, tied him and his wife up, and transported him approximately 500 kilometers across the country.

The captors used encrypted communication networks to demand a ransom from his son, a cryptocurrency influencer based in Dubai. The victim was discovered disoriented and covered in gasoline, prompting an ongoing investigation as the perpetrators remain at large.

Global Surge in Crypto-Related Crimes

Cryptocurrency's rising value and adoption have made it a lucrative target for cybercriminals. On December 17, Bitcoin (BTC) reportedly reached significant highs, amplifying interest in the sector. This growth has drawn attention from threat actors engaging in malware attacks, kidnappings, and extortion schemes.

For instance, on December 25, a cryptocurrency merchant in Pakistan was kidnapped in Karachi. The assailants coerced the victim into transferring $340,000 in cryptocurrency before abandoning him. Seven individuals, including a Counter-Terrorism Department officer, were later arrested, and charges for kidnapping and extortion were filed under the Pakistan Penal Code.

Cryptocurrency and Ransom Scams

In Australia, a case involving a Saudi royal highlighted the use of social platforms in abduction schemes. The victim was lured via a dating app to a location where he was ambushed and restrained. Threatened with severe harm, he transferred $40,000 in Bitcoin. While the lead perpetrator, Catherine Colivas, avoided prison due to mitigating circumstances, the case underscores the broader vulnerabilities in cryptocurrency transactions.

According to analysts at Chainalysis, the expanding ransomware landscape compounds these risks. Tracking incidents and ransom payments made in cryptocurrencies remains a significant challenge, emphasizing the need for heightened security and vigilance in the sector.

Crypto Phishing Scams: $47M Lost in February

 


In February, cybercriminals orchestrated a series of sophisticated crypto phishing scams, resulting in a staggering $47 million in losses. These scams, often initiated through social media platforms like X (formerly Twitter), saw a dramatic 40% surge in victims compared to January, with over 57,000 individuals falling prey to their deceitful tactics. Despite the increase in victims, the overall amount lost decreased by 14.5%, indicating a slight reprieve amidst the relentless onslaught of crypto-related scams.

Leading the charge in terms of losses were Ethereum (ETH) and the layer-2 network Arbitrum (ARB), accounting for three-quarters and 7.4% of the total losses, respectively. ERC-20 tokens, a popular form of cryptocurrency, constituted a staggering 86% of the assets pilfered by cybercriminals, highlighting their preference for easily transferable digital assets.

At the heart of these scams lies a cunning strategy: impersonating legitimate entities, such as well-known crypto projects, to trick unsuspecting users into divulging sensitive information like private keys. These keys serve as a gateway to users' digital wallets, which are subsequently raided by the scammers, leaving victims reeling from substantial financial losses.

Scam Sniffer, a prominent anti-scam platform, shed light on the prevalent use of fake social media accounts in these fraudulent schemes. By impersonating X accounts of reputable crypto projects, phishers exploit users' trust in official channels, coaxing them into unwittingly surrendering their private keys.

The year 2023 witnessed a staggering $300 million in losses due to crypto phishing scams, ensnaring over 320,000 users in their intricate web of deception. In recent times, scammers have adopted a new tactic, luring users with enticing "airdrop claim" links, which, unbeknownst to the victims, serve as traps to drain their wallets of funds.

Even high-profile entities like MicroStrategy have fallen victim to these scams, with their social media accounts compromised to disseminate phishing airdrop links. Additionally, the email services of reputable Web3 companies have been hijacked to distribute fraudulent airdrop claim links, resulting in significant financial losses for unsuspecting victims.

To shield themselves from falling prey to these scams, users are urged to exercise utmost vigilance and meticulously scrutinise any suspicious communication. Signs such as typographical errors, content misalignment, and grammatical inconsistencies should serve as red flags, prompting users to exercise caution when engaging with crypto-related content online.

By staying informed and adopting proactive measures, individuals can practise safety measures against these malicious schemes, safeguarding their hard-earned assets from falling into the clutches of cybercriminals.