Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label cryptocurrency. Show all posts
Technology
Blockchain cryptocurrency Financial markets Polymarket Technology

What Is Polymarket? How Blockchain Is Transforming Prediction Markets

 



Prediction markets have existed for decades as a way to forecast future events, but blockchain technology has reshaped how they operate. Among the platforms driving this evolution is Polymarket, a decentralized prediction market launched in 2020 that enables users to trade on the outcomes of real-world events using blockchain technology rather than relying on a traditional bookmaker.

Unlike conventional betting platforms, Polymarket functions as a peer-to-peer marketplace where participants buy and sell shares tied to the outcome of an event. Instead of placing wagers against a central operator, users trade with one another, while blockchain infrastructure records every transaction transparently. Built on the Polygon network, the platform allows users to retain self-custody of their assets through compatible cryptocurrency wallets, with trading collateral managed on-chain.

Markets on Polymarket span a wide range of topics, including elections, major sporting events, cryptocurrency and financial markets, macroeconomic indicators, legislation, entertainment awards, weather events, and other headline-driven developments. The platform's appeal lies in its ability to convert collective opinion into real-time market prices that reflect how participants assess the probability of future outcomes. As breaking news emerges, market prices adjust almost instantly, offering a continuously updated snapshot of public expectations.

Trading is designed to be relatively straightforward. After connecting a supported crypto wallet and funding an account, users can browse active markets with clearly defined settlement rules and expiration dates. Participants purchase either "Yes" or "No" shares, typically priced between $0.01 and $1.00, with the price broadly representing the market's implied probability of an event occurring. For example, a "Yes" share priced at $0.42 suggests traders collectively estimate roughly a 42% chance that the event will happen. If the prediction proves correct when the market resolves, each winning share settles at $1, while incorrect positions become worthless. Unlike traditional wagers, positions can also be bought or sold before settlement, allowing traders to realize gains or reduce losses as market sentiment changes.

A key differentiator is the platform's decentralized settlement process. Rather than relying solely on a central operator, market outcomes are verified through oracle systems that provide trusted real-world data to smart contracts, which then automate payouts to eligible participants. Combined with Polygon's comparatively low transaction fees and faster confirmation times, this infrastructure enables transparent trading and efficient settlement while reducing reliance on intermediaries.

Polymarket has gained popularity among cryptocurrency enthusiasts, analysts, journalists, and researchers because it offers a real-time measure of market sentiment across thousands of topics. Many users participate to express informed opinions, hedge against uncertainty, or monitor how collective expectations evolve around elections, economic releases, technology developments, sports competitions, and global news.

However, participation is not without risk. Like any speculative market, users can lose their entire investment if their prediction is incorrect. Less active markets may also experience low liquidity, making it difficult to enter or exit positions efficiently, while thin trading volumes can amplify price swings following large trades or rumors. Participants should also consider smart contract risks, dependence on oracle systems for accurate settlement, and the possibility of delayed resolutions if disputes arise over market outcomes.

Regulation remains one of the most daunting challenges for decentralized prediction markets. Availability varies across jurisdictions, with some countries permitting access while others impose restrictions or outright bans. As regulatory frameworks continue to evolve, users should review the laws applicable in their region before participating. Recent years have also seen Polymarket navigate changing regulatory requirements while expanding its operations in new markets.

Beyond speculation, prediction markets have long attracted interest from economists because they aggregate information from large groups of participants. Academic research suggests that highly liquid prediction markets can, in certain circumstances, rival or outperform traditional polling and expert forecasts by rapidly incorporating new information into prices. Nevertheless, forecasting accuracy depends heavily on market participation and liquidity, meaning smaller or thinly traded markets may not always reflect the true probability of an event.

As blockchain infrastructure, oracle technology, and regulatory clarity continue to mature, decentralized prediction markets are expected to play an increasingly important role in forecasting global events. Platforms such as Polymarket are demonstrating how transparent, blockchain-based markets can provide not only a new way to trade on future outcomes but also a powerful tool for understanding collective expectations in an increasingly data-driven world.

Read more »
windows
CAPTCHA ClickFix cryptocurrency Cryptominer Cyber Security Hardware PowerShell windows

Steam Forum Scam Uses ClickFix Technique to Infect Gamers With XMRig Cryptominer

 



Cybercriminals are targeting Steam users through fraudulent troubleshooting posts that exploit the increasingly common ClickFix social engineering technique, tricking gamers into manually executing malicious PowerShell commands that ultimately install cryptocurrency mining malware on Windows systems.

Rather than relying on software vulnerabilities, the campaign abuses trust within Steam's community discussion forums. Attackers reportedly create newly registered accounts and respond to users seeking help with problems such as game crashes, missing inventory items, or other technical issues. Their replies appear to offer legitimate troubleshooting steps, encouraging victims to launch Windows PowerShell with administrator privileges and paste a command that supposedly resolves the issue.

Instead of fixing the reported problem, the command downloads and installs XMRig, an open-source cryptocurrency mining application that has frequently been repurposed by cybercriminals to mine Monero using victims' computing resources without their knowledge or consent.

The campaign reflects the continued rise of ClickFix attacks, a social engineering method that persuades users to execute malicious commands themselves. These attacks typically imitate security checks, CAPTCHA verifications, software updates, or troubleshooting instructions that appear credible because they are presented as solutions to an existing problem. Since the victim willingly launches the command, the activity may evade security controls designed to block automatically executed malware.

The PowerShell script distributed in this campaign disguises itself as a Windows optimisation utility named "msf utility \ PC Opt." Once started, it displays what appear to be routine maintenance operations, including cleaning temporary files, flushing the DNS cache, updating drivers, checking disk health, disabling unnecessary startup applications, scanning for malware, repairing the Windows image, and running the System File Checker.

However, these operations largely serve as a visual distraction. Instead of performing meaningful system maintenance, the script displays convincing progress messages and introduces short delays to create the impression that legitimate optimisation tasks are taking place while malicious actions occur in the background.

The script's primary malicious routine first disables Transport Layer Security (TLS) certificate validation before confirming that it has been launched with administrator privileges. If elevated permissions are unavailable, execution stops after displaying an error requesting administrative access.

Once running with the required privileges, the malware establishes persistence by creating a directory within the Windows installation path and modifying Microsoft Defender settings to exclude that location from antivirus scanning. Excluding a directory from security scans reduces the likelihood that the installed malware will be detected or quarantined.

The script also checks for traces of previous installations by attempting to stop an existing scheduled task associated with the miner, terminating related processes, and removing older configuration files. While the exact purpose of this cleanup remains uncertain, it may help replace an earlier installation or remove conflicting miner components before deploying a fresh payload.

To retrieve the malware, the script temporarily creates an outbound Windows Firewall rule permitting network communication with an attacker-controlled server over TCP port 443. After downloading the payload, it verifies that the retrieved file is both non-empty and a valid executable before moving it into its final installation directory.

To maintain long-term access, the malware creates a scheduled Windows task configured to launch the XMRig executable automatically whenever the operating system starts. The task executes with SYSTEM privileges, giving the miner elevated permissions while allowing it to continue operating after reboots.

XMRig itself is a legitimate open-source cryptocurrency miner designed for authorised mining operations. However, threat actors frequently misuse the software in cryptojacking campaigns because it efficiently mines the privacy-focused cryptocurrency Monero, allowing attackers to generate revenue by exploiting compromised computers' CPU resources. Victims often experience unusually high processor usage, increased power consumption, system slowdowns, excessive fan activity, and reduced hardware lifespan.

This indicates a new wave in cybercriminal tactics. Rather than exploiting software flaws, attackers increasingly rely on convincing users to compromise their own systems through social engineering. ClickFix campaigns have been observed across multiple platforms in recent months, targeting individuals through fake browser alerts, fraudulent technical support pages, counterfeit software updates, and deceptive verification prompts.

Users should exercise caution when following technical advice posted by unknown forum members, particularly when instructions require launching PowerShell, Command Prompt, or other administrative tools. Legitimate game support rarely requires manually executing complex commands obtained from public discussion forums.

Systems that may have been exposed should be examined for unexpected scheduled tasks related to XMRig, suspicious Microsoft Defender exclusions, and unfamiliar files or folders created within protected Windows directories. A full antivirus scan should be performed immediately, and any malicious scheduled tasks, Defender exclusions, or installed payloads should be removed. Where compromise cannot be confidently ruled out, performing a complete operating system reinstallation may provide the most reliable method of restoring system integrity, as additional malicious activity may have occurred after the initial infection.

Read more »
Technology
Bitcoin cryptocurrency Cryptography Galaxy Digital Quantum Advisory Quantum Innovation Research Technology

Galaxy Digital launches $5M initiative to boost Bitcoin against future quantum computing threats

 

Galaxy Digital has announced a new initiative aimed at helping the Bitcoin ecosystem prepare for the long-term cybersecurity risks posed by unprecedented advances in quantum computing, committing up to $5 million in funding for developers and researchers working on technologies designed to safeguard the cryptocurrency's cryptographic foundations. 

The announcement comes as governments, standards bodies and private-sector organizations increasingly accelerate efforts to prepare critical digital infrastructure for a future in which sufficiently powerful quantum computers could undermine many of today's encryption methods. 

The crypto financial services firm said applications are now open for its newly established Galaxy Bitcoin Quantum Readiness Initiative, which is designed to support the development of practical tools and research that could help Bitcoin transition toward quantum-resistant security over time. 

According to Galaxy, grant funding will prioritize several areas considered essential for Bitcoin's long-term resilience. These include the development of post-quantum digital signature schemes capable of replacing today's cryptographic mechanisms, tools that would help cryptocurrency wallet providers and custodians migrate users to new security standards, formal security audits of proposed implementations, and technical work evaluating quantum-resistant transaction proposals before they are introduced to the Bitcoin network. Rather than distributing funds upfront, Galaxy said grants will be awarded individually and released as development milestones are achieved. 

The initiative extends beyond developer funding. Galaxy is also establishing a dedicated research program that will publish ongoing analysis examining quantum-related risks to Bitcoin while tracking emerging mitigation strategies. In addition, the company has formed a Quantum Advisory Council consisting of specialists in quantum computing and post-quantum cryptography to evaluate grant proposals and provide technical guidance for future research efforts. 

Galaxy said it also hopes other organizations across the cryptocurrency ecosystem will participate by contributing funding, collaborating on research, or supporting open-source development that could accelerate Bitcoin's eventual transition to quantum-resistant cryptography. 

Bitcoin currently relies on elliptic curve cryptography to verify ownership of wallets and authenticate transactions. Existing classical computers are considered incapable of breaking these cryptographic protections within any practical timeframe. However, cybersecurity researchers have long warned that sufficiently advanced fault-tolerant quantum computers could eventually execute algorithms capable of recovering private keys from exposed public keys, potentially allowing attackers to forge transactions and steal digital assets if the network remains unchanged. 

Although experts broadly agree that no quantum computer currently possesses the capability to compromise Bitcoin's cryptography, many researchers argue that preparations must begin well before such systems become available. Unlike conventional software updates, major protocol changes within Bitcoin require extensive technical review, community consensus, testing and gradual deployment across a decentralized global network, making the transition to post-quantum protections a multi-year effort. 

Industry concerns have also been reinforced by research estimating the potential scale of future exposure. CryptoQuant has projected that approximately 6.9 million bitcoin, valued at roughly $461 billion at current market prices, could become vulnerable if quantum computers eventually develop the ability to defeat Bitcoin's existing cryptographic protections before the network adopts stronger security mechanisms. While researchers do not consider such a scenario imminent, they increasingly describe proactive migration planning as essential because of the time required to update wallets, infrastructure and network software. 

Preparations for the post-quantum era are also gaining momentum outside the cryptocurrency industry. The U.S. National Institute of Standards and Technology finalized its first post-quantum cryptography standards in 2024, providing organizations with standardized algorithms intended to replace vulnerable public-key cryptography as quantum technology advances. 

At the same time, the U.S. Department of Commerce is investing more than $2 billion through the CHIPS and Science Act to strengthen domestic quantum computing capabilities. The funding package spans nine companies working across multiple quantum hardware approaches, reflecting the U.S. government's broader effort to accelerate quantum innovation while simultaneously preparing national infrastructure for the cybersecurity challenges that future quantum systems may introduce. 

Bitcoin was trading at approximately $66,300 on July 21, while shares of Galaxy Digital had declined roughly 8% over the previous 12 months to trade near $25.20 per share, according to market data referenced alongside the company's announcement.
Read more »
ohio
cryptocurrency Cyber Extortion Data Theft kairos ohio

Report Details Alleged $1 Million Payment to Kairos After Data Theft

 



A newly published investigation has offered an unusual look inside a cyber extortion case in which a U.S. government organization is believed to have paid about $1 million after attackers stole sensitive data from its network. The analysis, conducted by Rakesh Krishnan for Ransom-ISAC, draws on leaked negotiation conversations and cryptocurrency transaction records to reconstruct how the incident unfolded.

The case stands out because the attackers, operating under the name Kairos, do not appear to have used traditional ransomware. According to the report, investigators found no evidence that the group encrypted computer systems or provided victims with decryption keys. Instead, the attackers allegedly copied confidential files and demanded payment in exchange for keeping the stolen information private.

Although the report does not identify the victim by name, several details point toward Union County, Ohio. File names referenced during the negotiations included "Union.xlsx," "1 union co psi template.doc," and an archive labelled "union.rar." One collection of files reportedly came from the county prosecutor's office, with the attackers claiming that publishing those records could interfere with criminal cases. During the discussions, the victim also described itself as a small county government with limited financial resources.

The reported incident closely matches a cyberattack disclosed by Union County in May 2025. At the time, county officials announced that personal information belonging to 45,487 current and former employees and residents had been exposed. The compromised records included Social Security numbers, financial information, passport details, fingerprints, and other sensitive data. Neither Union County nor Kairos has publicly confirmed that the leaked negotiations relate to that breach.

The leaked conversations show that the negotiations continued for nearly a month. Kairos initially demanded $3 million, claiming to possess more than two terabytes of stolen information containing around 1.6 million files. The victim responded with progressively higher offers, beginning at $100,000 before increasing to $255,000 and later $430,000. The attackers eventually reduced their demand to $1 million while imposing strict payment deadlines and warning that the most sensitive files would be released if an agreement was not reached.

According to the investigation, the payment was made on June 13, 2025, using approximately 9.44 Bitcoin, valued at roughly $1 million at the time. Blockchain analysis traced the cryptocurrency through several digital wallets before portions of the funds reached addresses linked to the cryptocurrency exchanges Bybit and OKX, as well as the Russian cryptocurrency service BELQI. While blockchain records allow investigators to follow the movement of digital assets, they do not automatically reveal the identities of those controlling the wallets.

The report also questions the value of paying cybercriminals in exchange for promises to delete stolen information. Kairos reportedly supplied what it described as proof that the files had been removed. However, the evidence only showed that the group once possessed the data and could not verify that every copy had actually been destroyed. Security experts have long warned that organizations have no reliable way to confirm whether stolen information has been deleted after a ransom payment.

Beyond the individual case, the investigation reflects a wider change in the cybercrime ecosystem. An increasing number of threat groups are abandoning file encryption and relying solely on data theft and extortion to pressure victims into paying. Sophos reported that only about half of the ransomware incidents it investigated during 2025 involved data encryption, the lowest proportion recorded in six years. Groups such as the Silent Ransom Group have also carried out extortion campaigns targeting organizations by threatening to leak stolen information without deploying ransomware.

The Kairos negotiations also resemble tactics seen in previous cyber extortion cases. Researchers examining leaked internal communications from the Black Basta ransomware operation found similarly prolonged bargaining, with initial multimillion-dollar demands eventually ending in substantially lower settlements. Earlier leaks involving the Conti ransomware group provided comparable insight into how attackers negotiate payments behind the scenes.

Although Kairos' public leak site is no longer online and its last publicly known victim was recorded in June 2026, investigators observed cryptocurrency activity linked to the group's infrastructure as recently as May 2026. The continued movement of funds suggests that the disappearance of a leak site does not necessarily indicate that an operation has ceased.

The case offers several practical lessons for government agencies and other organizations. Strengthening multi-factor authentication, monitoring repeated failed login attempts, watching for unusually large outbound data transfers, separating highly sensitive records from other systems, and preparing a communication strategy before an incident occurs can all reduce the impact of cyber extortion. The investigation also reinforces a point repeatedly emphasized by incident responders: once data has been stolen, there is no dependable way to verify an attacker's promise that it has been permanently deleted.

Read more »
sim swap
CBZC cryptocurrency Cyber Crime FBI Poland sim swap

Poland arrests four suspects in international SIM-swapping operation linked to multimillion-dollar cryptocurrency thefts

 



Polish law enforcement authorities have arrested four suspected members of an organized cybercrime group accused of orchestrating intricate SIM-swapping attacks that allegedly enabled the theft of millions of dollars in cryptocurrency from victims. The coordinated operation was led by Poland's Central Bureau for Combating Cybercrime (CBZC) with operational assistance from the U.S. Federal Bureau of Investigation (FBI) and Homeland Security Investigations (HSI), highlighting the cross-border nature of the investigation.

According to investigators, the group combined technical intrusions with social engineering techniques to compromise organizations working alongside telecommunications providers. By infiltrating partner infrastructure and gaining unauthorized access to employee email accounts, the suspects allegedly obtained sensitive information that enabled them to perform fraudulent SIM-swapping attacks.

A SIM-swap attack involves transferring a victim's mobile phone number to a SIM card controlled by an attacker. Once the transfer is completed, the attacker can intercept SMS messages, one-time verification codes, password reset requests, and other communications that rely on the victim's phone number for authentication.

Authorities allege that after taking control of victims' mobile numbers, the cybercriminals intercepted SMS-based authentication messages and email communications before using that access to seize control of cryptocurrency exchange accounts. The attackers then transferred digital assets from compromised accounts before attempting to conceal the proceeds through an extensive laundering operation.

Investigators estimate that the criminal scheme generated millions of U.S. dollars in stolen cryptocurrency. The illicit proceeds were allegedly moved through a distributed financial network consisting of multiple domestic and international bank accounts, international payment platforms, and multi-currency digital wallets in an effort to obscure the origin of the funds. Polish authorities estimate that the total amount laundered exceeded tens of millions of Polish złoty, equivalent to at least approximately US$5 million based on current exchange rates.

In a statement describing the operation, CBZC said the suspects relied on specialized software together with social engineering techniques to gain unauthorized access to infrastructure belonging to organizations cooperating with telecommunications operators, as well as employee email accounts. Investigators said the information obtained during those compromises enabled the illegal cloning and takeover of victims' phone numbers through SIM-swapping attacks.

Authorities further stated that the suspects allegedly treated the criminal enterprise as a continuous source of income, repeatedly moving stolen assets across numerous financial accounts and cryptocurrency wallets located in multiple jurisdictions to complicate financial tracing efforts.

All four suspects have been placed in pre-trial detention. They face allegations including participation in an organized criminal organization, unauthorized access to information systems to facilitate theft, and money laundering. If convicted, the offenses carry penalties of up to 25 years' imprisonment under Polish law.

While Polish authorities have not publicly identified the individuals arrested because of the ongoing international investigation, blockchain investigator ZachXBT claimed that one of the detainees is Wojtek Kulisz, also known online by the alias "Merry." The identification was reportedly based on items visible in official footage released during the police operation. Authorities have not independently confirmed that claim.

Investigators have also declined to disclose which cryptocurrency exchanges were affected or identify the victims, citing the continuing international investigation. Law enforcement agencies say efforts to identify additional victims, trace stolen assets, and pursue further investigative leads remain ongoing.

The case stresses the urgency of the risks associated with SMS-based authentication. Security professionals have long advised cryptocurrency investors and organizations to replace SMS-based two-factor authentication with authenticator applications or hardware security keys whenever possible, as SIM-swapping attacks remain an effective method for bypassing text message verification when attackers successfully compromise telecommunications systems or manipulate carrier processes.

Read more »
Microsoft
Credential Theft CryptoBandits cryptocurrency malware Microsoft

CryptoBandits Malware Combines Crypto Theft and Backdoor Access

 



Microsoft has disclosed details of a newly identified Windows malware campaign that combines cryptocurrency theft, covert command-and-control communications, and remote access capabilities, creating a threat that extends well beyond traditional crypto-stealing malware.

Tracked as CryptoBandits, the malware has been active since at least February 2026 and is designed to compromise Windows systems through malicious shortcut (LNK) files. While its primary objective is to steal cryptocurrency-related information, Microsoft researchers found that the malware also functions as a lightweight backdoor, allowing attackers to maintain ongoing access to infected devices and issue remote commands.

According to Microsoft's analysis, the threat relies heavily on built-in Windows scripting technologies, including Windows Script Host and ActiveX components, to execute malicious actions while avoiding more obvious indicators typically associated with conventional malware families. Once executed, CryptoBandits deploys a portable version of the Tor anonymity network and establishes communications with attacker-controlled hidden services through a local SOCKS5 proxy, concealing the infrastructure used to manage infected systems.

Researchers observed the malware being distributed through malicious shortcut files that masquerade as legitimate content. After compromising a system, CryptoBandits deploys two distinct modules: a worm component responsible for spreading the infection and a cryptocurrency clipper designed to monitor and manipulate wallet-related data.

The propagation mechanism enables the malware to scan connected USB storage devices and generate additional malicious shortcut files that imitate legitimate documents. By replacing or disguising genuine files with weaponized shortcuts, attackers increase the likelihood that the malware will spread when removable media is shared between systems. Microsoft also noted that the malware can deploy additional payloads while excluding them from Microsoft Defender scanning, helping attackers reduce the likelihood of detection.

One of the most dangerous aspects of CryptoBandits is its clipboard-monitoring functionality. Cryptocurrency clippers are designed to watch for wallet addresses copied by victims during transactions. When a targeted wallet address is detected, the malware silently replaces it with an attacker-controlled address before the victim pastes the information into a cryptocurrency application or exchange platform. Because cryptocurrency addresses are often long and difficult to verify manually, victims may unknowingly transfer digital assets directly to criminal-controlled wallets.

Beyond address substitution, Microsoft found that the malware can harvest cryptocurrency seed phrases and private keys, information that can provide direct access to digital wallets. The malware also captures screenshots and transmits collected information to attacker-controlled infrastructure through Tor-based communications channels.

The malware establishes persistence through scheduled tasks and incorporates anti-analysis checks intended to identify whether system monitoring tools are active. Researchers observed the clipper verifying whether Windows Task Manager was running before continuing execution, a technique commonly used by malware operators attempting to evade investigation and detection.

After installation, CryptoBandits launches a renamed Tor executable and registers the infected device with its command-and-control infrastructure. The malware then continuously polls its operators for instructions at intervals of roughly 500 milliseconds, enabling rapid execution of attacker-issued commands. This capability transforms the malware from a simple financial stealer into a remotely managed backdoor capable of supporting additional malicious activity.

Microsoft's investigation also revealed extensive use of runtime obfuscation. Core malware components remain encrypted until execution, while both the Python-based installation routines and JavaScript payloads are intentionally obscured to complicate reverse engineering efforts. Such techniques make static analysis significantly more difficult and can delay detection by traditional signature-based security tools.

At the center of the operation is the malware's bundled Tor client. Rather than relying on exposed internet-facing servers, CryptoBandits routes traffic through localhost: 9050 using a SOCKS5 proxy and communicates with hidden-service infrastructure hosted within the Tor network. By concealing command-and-control traffic behind anonymized routing, attackers reduce network visibility and make infrastructure disruption efforts considerably more challenging.

The campaign gives us a foray into the new trend of financially motivated cybercrimes, where lightweight malware increasingly combines credential theft, cryptocurrency targeting, covert communications, and remote-access functionality within a single package. Security researchers have repeatedly observed threat actors moving away from easily identifiable command-and-control servers in favor of anonymized infrastructure that blends malicious traffic with legitimate network activity.

To mitigate the threat, Microsoft recommends restricting unnecessary use of scripting engines such as Windows Script Host, monitoring systems for unauthorized local SOCKS proxy activity, reviewing unusual clipboard access patterns, and implementing behavioral detection mechanisms capable of correlating script execution, network communications, process activity, and data exfiltration attempts. Additional safeguards include disabling autorun functionality for removable media, restricting execution of shortcut files from USB devices, and closely monitoring Tor-related network traffic originating from enterprise endpoints.

Read more »
Financial Monitoring
Bitcoin Crypto Market crypto market risks cryptocurrency Cryptocurrency news Cyber Security Financial Monitoring

Bitcoin Drops Below $60,000 as Market Selloff and Security Fears Weigh on Crypto

 

Falling further now, Bitcoin dipped under $60,000 again - the first time since early 2024 - amid softness across financial markets and rising unease about digital safety. Around $59,909, it lost close to 6% in one session, almost 18.5% in seven days. This slump stretches beyond just Bitcoin. Ethereum followed closely behind, sliding 23% over the week until reaching approximately $1,555. Meanwhile, Solana saw a similar drop of 22%, settling near $63.75 after sharp downward pressure. 

Bitcoin now trades over 52 percent below its peak of $126,080 set last October. A mix of pressures drives the drop, according to market observers. Attention earlier centered on steady withdrawals from physical Bitcoin ETFs along with Strategy offloading coins for the first time since 2022. Lately, though, shifts in outlook regarding Federal Reserve interest moves have added pressure, alongside fresh unease about digital asset safety. 

Surprising strength marked last month's U.S. labor numbers, as payrolls expanded by 172,000 during May. That outcome ran well ahead of forecasts - almost twice what analysts had predicted - shifting how investors view future rate moves. With inflation concerns lingering, officials may feel less pressure to ease policy soon. Because higher yields often make safer investments more appealing, digital coins typically face headwinds under such conditions. Market participants now weigh whether extended tightening cycles could dampen speculative flows. 

Despite recent gains in employment figures, expectations for lower interest rates have faded, according to Nicolai Søndergaard of Nansen. Having shed roughly 15 percent lately, Bitcoin now faces added strain without any obvious economic trigger to spark rebound. Though digital assets struggle, broader uncertainty lingers due to unrest in the Middle East. That stress shows up in cautious trading behavior worldwide. 

With few positive signals on the horizon, momentum remains fragile. Even as attention grows around blockchain safety, news of a serious weakness in Zcash - a coin built for anonymity - has raised alarms. Though programmers pushed out an update to correct the problem, they stated plainly that tracking past misuse is impossible due to hidden transaction details. Without clear evidence of abuse, doubt spread quickly among investors. 

That hesitation showed in price movements: ZEC plunged over two-fifths in value in just one day. Now worries spread through crypto circles after the event. Because AI tools might detect weak spots in blockchains, investor unease grows. Questions emerge - could similar flaws threaten more digital currencies? As machine learning advances, trust faces new tests. Out of nowhere, a slight uptick appeared for Bitcoin ETFs amid continued market softness. 

On Thursday, U.S. spot Bitcoin funds saw inflows exceeding $3 million - breaking a run of 13 straight days of outflows. While tiny next to the billions pulled so far this year, the shift hinted at changed sentiment, if only briefly. Not long after prolonged pullbacks, investors paused, then edged back in. After tech shares slipped, so did broader market sentiment - Nasdaq dropped sharply amid wider financial strains. 

Not just crypto felt the downturn; traditional assets wavered too, pulled by similar worries. Investors moved carefully through overlapping pressures: shaky economies, global conflicts, threats in digital finance. When equities fell, digital coins followed close behind, mirroring the wariness spreading through capital markets.
Read more »
Stablecoins
Bitcoins Blockchain Integration crypto transactions cryptocurrency Cyber Crime data compliance Financial Regulators Money Laundering river Stablecoins

Stablecoins Replace Bitcoin as the Primary Cryptocurrency in Illicit Transactions, Industry Data Shows

 




For years, Bitcoin was widely associated with cryptocurrency-related crime. New industry data suggests that picture has changed astronomically, with stablecoins now accounting for the vast majority of identified illicit cryptocurrency activity.

The change of terms was accentuated by Bitcoin-focused financial services company River, which cited blockchain intelligence findings showing that Bitcoin's role in unlawful crypto transactions has declined sharply over the past several years. According to data attributed to Chainalysis, Bitcoin represented roughly 70% of illicit cryptocurrency transaction volume in 2020. By 2025, that figure had fallen to approximately 7%, while stablecoins had grown to account for around 84% of identified illicit transaction volume.

The numbers point to a drastic transformation in how cybercriminals, fraud operators, sanctioned entities, and money-laundering networks move digital funds across borders.


Why Stablecoins Are Becoming More Attractive to Criminal Networks

Unlike Bitcoin and many other cryptocurrencies, stablecoins are designed to maintain a relatively fixed value, typically by being linked to a traditional currency such as the U.S. dollar.

This stability removes one of the major risks associated with cryptocurrency transactions. A criminal group holding $1 million in Bitcoin today could see the value fluctuate significantly within days. Stablecoins largely eliminate that uncertainty, allowing illicit actors to move, store, and transfer funds without being exposed to major price swings.

Researchers say this makes stablecoins particularly useful in fraud schemes, investment scams, money-laundering operations, and cross-border transfers where predictable value is important.

The spike in acceptance of stablecoins across exchanges, payment services, and over-the-counter trading networks has also contributed to their increased use. Many stablecoins can be transferred globally within minutes while maintaining a value closely tied to fiat currency, making them practical for both legitimate and illegitimate financial activity.


Bitcoin Still Appears in Certain Criminal Operations

Despite its declining share, Bitcoin has not disappeared from the cybercrime infrastructure. It is still part of the overall pipeline in digital currency exchange. 

Blockchain investigators continue to observe Bitcoin being used in ransomware attacks, darknet marketplaces, and extortion schemes. In these environments, long-established infrastructure, existing payment workflows, and familiarity among threat actors continue to support Bitcoin's use.

However, analysts note that criminal organizations are increasingly treating Bitcoin as only one option within a much larger digital financial ecosystem rather than the default cryptocurrency for illicit transactions.


Illicit Crypto Activity Continues to Soar

The change in asset preference comes as blockchain intelligence firms report increases in the overall value of illicit cryptocurrency activity.

TRM Labs recently estimated that illicit cryptocurrency flows reached approximately $158 billion in 2025, representing the highest level recorded by the company. The firm reported a sharp increase from the previous year, attributing much of the growth to sanctions-related activity, sophisticated money-laundering operations, underground financial networks, and expanded use of cryptocurrency by state-linked actors.

A large portion of these transactions involved stablecoins in the grand scheme of carrying out cyber criminal activities. 

Researchers also observed that sanctions-evasion networks increasingly rely on stablecoins because of their liquidity, accessibility, and ability to move large sums through multiple jurisdictions with relative speed.


Compliance and Regulatory Pressure Expected to become more stringent

The developing concentration of illicit activity within stablecoin ecosystems is likely to intensify scrutiny from regulators and law-enforcement agencies.

Unlike decentralized cryptocurrencies, many major stablecoins are issued by identifiable companies that maintain reserve assets and have the technical ability to freeze certain wallets when required by legal authorities.

As a result, policymakers are increasingly examining how stablecoin issuers monitor suspicious transactions, respond to sanctions violations, and cooperate with criminal investigations.

Several stablecoin providers have already expanded collaboration with law enforcement agencies. Tether, the issuer of USDT, has publicly reported freezing wallets connected to suspected criminal activity, while blockchain analytics companies continue to develop tracking tools designed to identify suspicious transaction patterns across networks.


Criminal Use Remains a Small Portion of Overall Activity

Although illicit cryptocurrency volumes have risen in absolute terms, researchers caution against interpreting the data as evidence that most cryptocurrency activity is criminal.

Industry reports consistently show that unlawful transactions represent only a small fraction of total blockchain activity. Stablecoins process trillions of dollars in annual transaction volume, meaning the overwhelming majority of transactions are associated with legitimate uses such as payments, trading, remittances, and settlement activities.

Nevertheless, the latest findings draw a clearer picture into how criminal groups adapt quickly to changing financial technologies. While Bitcoin once dominated illicit cryptocurrency transactions, blockchain intelligence data now suggests that stablecoins have become the preferred vehicle for many forms of crypto-enabled financial crime due to their price stability, global accessibility, and ease of transfer.

The trend is expected to remain a driving focus for regulators, compliance teams, cryptocurrency exchanges, and law-enforcement agencies as governments continue developing rules for the rapidly expanding stablecoin sector.


Read more »
Digital Token
cryptocurrency Cryptocurrency Cybersecurity Cyber Networks Cyber Security Cyber Vulnerabilities Digital Token

MAPO Token Crashes 96% After Cross-Chain Bridge Exploit Triggers Massive Unauthorized Mint

 

A major shock hit cryptocurrency markets when the MAPO token crashed nearly 96% after a vulnerability in the Butter Network cross-chain bridge was exploited. The attacker created an enormous number of unauthorized tokens, flooding the market with supply far beyond legitimate circulation. 

The sudden imbalance disrupted trading across Ethereum-linked decentralized finance platforms and triggered widespread panic selling. Blockchain security researchers found that the flaw allowed the creation of one quadrillion MAPO tokens, vastly exceeding the project’s intended supply. Investors reacted quickly, dumping holdings as confidence collapsed. 

Within hours, the token’s value fell from nearly $0.003 to around $0.0001, wiping out significant market value and damaging trust in the ecosystem. The attack centered on Butter Network bridge infrastructure. Investigators reported that a newly created external wallet was used to move roughly one billion MAPO tokens into decentralized exchanges. 

During the exploit, nearly 52 ETH, worth about $180,000 at the time, was drained from Uniswap liquidity pools. Analysts traced the activity back to the bridge vulnerability and the attacker’s newly established account. Although a large portion of the unauthorized tokens was sold, researchers noted that the attacker still controlled nearly a trillion MAPO tokens. 

Those remaining holdings continue to threaten liquidity pools and exchanges supporting the token. The incident once again highlights the security challenges facing cross-chain bridges, which remain attractive targets because of their complexity and large asset reserves. The exploit adds to a growing list of attacks affecting blockchain and decentralized finance projects.

Security experts have repeatedly warned that systems connecting multiple networks create additional risks. Vulnerabilities within cross-chain infrastructure can remain hidden until specific conditions trigger them, making these platforms particularly difficult to secure. Following the breach, Map Protocol confirmed that the issue originated within its Solidity-based smart contracts. 

The project temporarily paused mainnet operations and began migration efforts while the investigation continued. Butter Network also suspended ButterSwap services as a precaution, though officials stated that user funds were not directly compromised. The team later announced plans for a new contract deployment and a snapshot of token holdings to support recovery efforts. 

Any assets remaining in attacker-controlled wallets will be invalidated and excluded from future migration or conversion processes. Blockchain records showed that nearly one billion MAPO tokens were transferred to Uniswap shortly after the unauthorized minting occurred. Further analysis revealed that the attacker first submitted a legitimate oracle multisignature message before deploying a malicious smart contract at a carefully selected address. 

A manipulated retry message was then resent with the same transaction hash, making it appear authentic. Because the bridge incorrectly validated the altered message, it approved the creation of the massive token supply. Researchers emphasized that no private keys were stolen and no light-client systems were compromised. 
Instead, the breach resulted from a smart contract validation flaw involving dynamic fields in Solidity code. 
The incident demonstrates how weaknesses in contract logic can create severe consequences, putting liquidity ecosystems, blockchain projects, and investor funds at risk even without traditional network-level compromises.
Read more »
Technology
Artificial Intelligence cryptocurrency Cyber Fraud Deepfake Scams Technology

AI Scams Are Becoming Harder to Detect — 7 Warning Signs You Should Watch Closely

 



Artificial intelligence is not only improving everyday technology but also strengthening both traditional and emerging scam techniques. As a result, avoiding fraud now requires greater awareness of how these schemes are taking new shapes.

Being able to identify scams is an essential skill for everyone, regardless of age. This is especially important as AI tools continue to advance rapidly, contributing to a noticeable increase in reported fraud cases. According to the Federal Bureau of Investigation’s 2025 Internet Crime Report, complaints linked to cryptocurrency and artificial intelligence ranked among the most financially damaging cybercrimes, with total losses approaching $21 billion. The agency also highlighted that, for the first time in its history, its Internet Crime Complaint Center included a dedicated section on artificial intelligence, documenting 22,364 cases that resulted in losses of nearly $893 million.

These scams are increasingly convincing. AI can generate realistic emails and replicate human voices through audio deepfakes, making fraudulent communication difficult to distinguish from legitimate interactions. Because of this, such threats should be treated as ongoing and persistent risks.

Protecting yourself, your family, and your finances requires both instinct and awareness. By training both your attention to detail and your ability to listen carefully, you can better identify suspicious activity. Below are seven warning signs that can help you recognize AI-driven scams and avoid serious consequences.

1. Messages that feel unusually personalized

AI can gather publicly available details, including your job, interests, or recent purchases, to create messages that appear tailored specifically to you. While these messages may seem accurate, they can still contain subtle errors or incorrect assumptions about your life, which should raise concern.


2. Requests that create urgency

Scammers often attempt to rush you with statements such as warnings that your account will be locked, demands for immediate payment, or requests for login credentials to restore access. This pressure is designed to force quick decisions without careful thinking.


3. Messages that appear overly polished

Unlike older scams filled with spelling or grammar mistakes, AI-generated messages are often clear and well-written. However, phrases like “confirm your information to avoid cancellation” or “we noticed unusual activity” should still be treated cautiously, especially if accompanied by suspicious visuals or a lack of supporting detail.


4. Audio that sounds slightly unnatural

Voice-cloning technology can imitate people you know, making phone-based scams more believable. Still, these voices may reveal themselves through unnatural pacing, limited emotional variation, or requests that seem out of character for the person being impersonated.


5. Deepfake videos that seem real but contain flaws

AI can also generate convincing videos of colleagues, family members, or even public figures. These may appear during video calls, workplace interactions, or through compromised social media accounts. Warning signs include inconsistent lighting, unusual shadows, or subtle distortions in facial movement.


6. Attempts to move conversations across platforms

Scammers may begin communication through email or professional platforms and then attempt to shift the interaction to messaging apps, payment platforms, or other channels. This tactic, often supported by chatbot-driven conversations, is used to appear credible while avoiding detection.


7. Unusual or suspicious payment requests

Requests for payment through gift cards, wire transfers, or cryptocurrency remain a major red flag. These methods are difficult to trace and are frequently used in fraudulent schemes, regardless of how legitimate the request may initially appear.


Why awareness matters

While AI has not changed the underlying tactics of scams, it has made them far more refined and scalable. Techniques such as impersonation, urgency, and trust-building are now enhanced through automation and data-driven personalization.

As these technologies continue to become an omnipresent aspect of our lives and keep developing, the risk will proportionately grow. Staying cautious, verifying unexpected requests, and sharing this knowledge with friends and family are critical steps in reducing exposure.

In a digital environment where scams increasingly resemble genuine communication, recognizing these warning signs remains one of the most effective ways to stay protected.

Read more »
Technology
Blockchain cryptocurrency Cryptography Technology

Coinbase CEO Says Quantum Threat to Crypto Is Manageable

 

Coinbase Chief Executive Brian Armstrong said concerns that quantum computing could undermine blockchain security are manageable, describing the issue as one the crypto industry has time to address. 

Speaking to CNBC at the World Liberty Forum in Mar a Lago alongside Senator Bernie Moreno of Ohio, Armstrong responded to questions about whether advances in quantum technology could eventually break blockchain encryption. 

“One thing I’ve heard is that quantum is going to break the blockchain. Is that true?” interviewer Sara Eisen asked. 

Armstrong dismissed the idea that the threat is imminent or unfixable. 

He said Coinbase has been proactive and is working closely with major blockchain networks to prepare for a shift toward post quantum cryptography. 

“We’re going to stay engaged on that, and I think it’s very solvable,” Armstrong said. 

Quantum computing has long been viewed as a theoretical risk to public key cryptography, which underpins networks such as Bitcoin and Ethereum. 

While current quantum systems are not powerful enough to crack widely used encryption methods, researchers warn that upgrading global financial systems and decentralized networks could take years, making early preparation important. 

Last month, Coinbase formed an independent quantum advisory board to guide its efforts. The group includes University of Texas professor Scott Aaronson, Stanford cryptographer Dan Boneh, Ethereum Foundation researcher Justin Drake and Coinbase Head of Cryptography Yehuda Lindell. 

The advisory board is expected to publish research evaluating quantum related risks and recommend migration strategies for blockchain systems. Industry observers say there is still time to transition to stronger cryptographic standards. 

Pranav Agarwal, independent director at Jetking Infotrain India, said the main concern for Bitcoin would be the potential breaking of private keys secured by SHA 256 encryption. 

However, he noted that the timeline for building a large scale quantum system capable of such an attack remains uncertain and that upgrading encryption is feasible. 

“There is enough time” to strengthen cryptographic protections across major networks, including Bitcoin and Ethereum, Agarwal said. 

Across the broader crypto ecosystem, preparation has accelerated. The Ethereum Foundation recently elevated post quantum security to a strategic priority. 

Ethereum co founder Vitalik Buterin has urged developers not to delay adopting quantum resistant cryptography, arguing that networks should aim for long term resilience rather than emergency fixes. 

The Solana Foundation said in December that it had begun testing quantum resistant digital signatures on a test network. Bitcoin developers have also advanced proposals such as BIP 360, designed to reduce exposure to quantum related risks. 

During the CNBC interview, Armstrong also addressed developments in U.S. market structure legislation. 

He defended Coinbase’s decision to oppose an earlier draft of a bill known as the CLARITY Act, citing concerns over how stablecoin rewards were treated in the proposal. Armstrong rejected claims that Coinbase blocked the legislation. 

He said the company raised issues that brought lawmakers back to the table and expressed confidence that a revised compromise could advance in the coming months, potentially reaching the President’s desk. 

He also voiced support for the Commodity Futures Trading Commission’s authority over event contracts and prediction markets, as policymakers continue to debate the regulatory framework for digital assets in the United States.
Read more »
Ledger
Crypto Wallet Crypto Wallet Theft cryptocurrency Cryptocurrency threats Cyber Phishing Cyber Security Ledger

Trezor and Ledger Impersonated in Physical QR Code Phishing Scam Targeting Crypto Wallet Users

 

Nowadays criminals push fake crypto warnings through paper mail, copying real product packaging from firms like Trezor and Ledger. These printed notes arrive at homes without digital traces, making them feel more trustworthy than email scams. Instead of online messages, fraudsters now use stamps and envelopes to mimic official communication. Because it comes in an envelope, people may believe the request is genuine. Through these letters, attackers aim to steal secret backup codes used to restore wallets. Physical delivery gives the illusion of authenticity, even though the goal remains theft. The method shifts away from screens but keeps the same deceitful intent. 

Pretending to come from company security units, these fake messages tell recipients they need to finish an urgent "Verification Step" or risk being locked out of their wallets. A countdown appears on screen, pushing people to act fast - slowing down feels risky when time runs short. Opening the link means scanning a barcode first, then moving through steps laid out by the site. Pressure builds because delays supposedly lead to immediate consequences. Following directions seems logical under such conditions, especially if trust in the sender feels justified. 

A single message pretending to come from Trezor told users about an upcoming Authentication Check required before February 15, 2026, otherwise access to Trezor Suite could be interrupted. In much the same way, another forged notice aimed at Ledger customers claimed a Transaction Check would turn mandatory, with reduced features expected after October 15, 2025, unless acted upon. Each of these deceptive messages leads people to fake sites designed to look nearly identical to real setup portals. BleepingComputer’s coverage shows the QR codes redirect to websites mimicking real company systems. 

Instead of clear guidance, these fake sites display alerts - claiming accounts may be limited, transactions could fail, or upgrades might stall without immediate action. One warning follows another, each more urgent than the last, pulling users deeper into the trap. Gradually, they reach a point where entering their crypto wallet recovery words seems like the only option left. Fake websites prompt people to type in their 12-, 20-, or 24-word recovery codes, claiming it's needed to confirm device control and turn on protection. 

Though entered privately, those words get sent straight to servers run by criminals. Because these attackers now hold the key, they rebuild the digital wallet elsewhere without delay. Money vanishes quickly after replication occurs. Fewer scammers send fake crypto offers by post, even though email tricks happen daily. Still, real-world fraud attempts using paper mail have appeared before. 

At times, crooks shipped altered hardware wallets meant to steal recovery words at first use. This latest effort shows hackers still test physical channels, especially if past leaks handed them home addresses. Even after past leaks at both Trezor and Ledger revealed user emails, there's no proof those events triggered this specific attack. However the hackers found their targets, one truth holds - your recovery phrase stays private, always. 

Though prior lapses raised alarms, they didn’t require sharing keys; just like now, safety lives in secrecy. Because access begins where trust ends, never hand over seed words. Even when pressure builds, silence protects better than any tool. Imagine a single line of words holding total power over digital money - this is what a recovery phrase does. Ownership shifts completely when someone else learns your seed phrase; control follows instantly. Companies making secure crypto devices do not ask customers to type these codes online or send them through messages. 

Scanning it, emailing it, even mailing it physically - none of this ever happens if the provider is real. Trust vanishes fast when any official brand demands such sharing. Never type a recovery phrase anywhere except the hardware wallet during setup. When messages arrive with urgent requests, skip the QR scans entirely. Official sites hold the real answers - check there first. A single mistake could expose everything. Trust only what you confirm yourself.  

A shift in cyber threats emerges as fake letters appear alongside rising crypto use. Not just online messages now - paper mail becomes a tool for stealing digital assets. The method adapts, reaching inboxes on paper before screens. Physical envelopes carry hidden risks once limited to spam folders. Fraud finds new paths when trust in printed words remains high.
Read more »
U.S. Department of Justice
cryptocurrency Cyber Fraud DoJ crypto seizure pig butchering scam Tether freeze U.S. Department of Justice

U.S. Justice Department Seizes $61 Million in Tether Linked to ‘Pig Butchering’ Crypto Scams


The U.S. Department of Justice (DoJ) has revealed that it seized approximately $61 million in Tether connected to fraudulent cryptocurrency operations commonly referred to as “pig butchering” scams.

According to the department, investigators traced the confiscated digital assets to wallet addresses allegedly used to launder funds obtained through cryptocurrency investment fraud schemes. The stolen proceeds were reportedly siphoned from victims who were manipulated into investing in fake platforms promising lucrative returns.

"Criminal actors and professional money launderers use cyber-enabled fraud schemes to swindle their victims and conceal their ill-gotten gains," said HSI Charlotte Acting Special Agent in Charge Kyle D. Burns.

"HSI special agents work diligently to trace the illicit proceeds of crime across the globe to disrupt and dismantle the transnational criminal organizations that seek to defraud hardworking Americans."

Authorities explained that these schemes typically begin with scammers initiating contact through dating platforms or social media messaging applications. The perpetrators build trust by posing as romantic interests or financial advisors before persuading victims to invest in fabricated cryptocurrency opportunities.

Officials further noted that many of these operations are allegedly run from scam compounds based primarily in Southeast Asia. Individuals trafficked under false promises of well-paying jobs are reportedly forced to participate in the schemes. Their passports are confiscated, and they are coerced into deceiving targets online under threats of severe punishment.

Victims are directed to professional-looking but fraudulent investment websites that display falsified portfolios and exaggerated profits. These manipulated dashboards are designed to encourage larger investments. When victims attempt to withdraw their funds, they are often told to pay additional “fees,” resulting in further financial losses.

"Once the victims' money transferred to a cryptocurrency wallet under the scammers’ control, the crooks quickly routed that money through many other wallets to hide the nature, source, control, and ownership of that stolen money," the department added.

In a related statement, Tether disclosed that it has frozen roughly $4.2 billion in assets tied to unlawful activities so far. The company said that nearly $250 million of that amount has been linked to scam networks since June 2025.

The seizure marks one of the larger enforcement actions targeting cryptocurrency-enabled fraud and reflects ongoing efforts by U.S. authorities to disrupt global cybercrime syndicates exploiting digital assets.
Read more »
Korea
Bitcoin Bitcoin Cyber Threat Bithumb cryptocurrency Cryptocurrency news Cyber Security digital currency Financial Regulators Korea

Bithumb Error Sends 620,000 Bitcoins to Users, Triggers Regulatory Scrutiny in South Korea

 

A huge glitch at Bithumb, South Korea’s second-biggest digital currency platform, triggered chaos when users suddenly found themselves holding vast quantities of bitcoin due to a flawed promotion. Instead of issuing minor monetary rewards, a technical oversight allowed 620,000 bitcoins to be wrongly allocated. Regulators quickly stepped in, launching investigations as the scale of the incident became clear. Recovery efforts are now underway for assets exceeding $40 billion, stemming directly from the mishap. Legal pressure mounts on the firm while authorities assess compliance failures. What began as a routine marketing effort has turned into one of the largest operational blunders in crypto trading history.  

On 6 February, a mistake unfolded amid a promotion meant to give rewards to 695 qualifying users - totaling 620,000 Korean won, about $423. Instead of using local currency, one employee typed in bitcoin by accident; this shifted the reward value dramatically. What should have been small bonuses became 620,000 bitcoins, valued around $42 billion then. Among those who qualified, nearly half accessed their digital boxes before anyone noticed. These 249 people ended up with massive deposits, exceeding the entire crypto balance held by the platform. 

Bithumb said it fixed many incorrect deposits through adjustments in its internal records. Still, regulators noted approximately 13 billion won - about $9 million - was unaccounted for, lost when certain users moved or cashed out funds prior to detection. During the half-hour span before freezing actions began, 86 individuals allegedly offloaded close to 1,788 bitcoins, sparking temporary shifts in pricing across the site's trading system. 

Criticism came fast once news broke. "Catastrophic" was the word used by Lee Chan-jin - head of South Korea’s Financial Supervisory Service - to describe what happened to those who offloaded their bitcoin. With prices climbing afterward, people forced to give back holdings might now owe money instead. Not just a one-off error, according to Lee; it revealed deeper flaws in how crypto platforms handle internal ledgers and transaction safeguards. 

Disagreement persists among legal professionals regarding possible criminal consequences for users who withdrew accidentally deposited bitcoin. Though crypto assets were central to a 2021 South Korean high court decision, their exclusion from the definition of "property" in penal statutes muddies enforcement paths. Instead of pursuing drawn-out lawsuits, Bithumb initiated private talks with around eighty individuals who converted the digital value into local currency, asking repayment in won amounts. 

Now probing deeper, the Financial Supervisory Service has opened a comprehensive review; meanwhile, lawmakers in Seoul will hold an urgent session on 11 February to press officials and platform leaders for answers. Speaking publicly, Bithumb admitted changes are underway - its payout systems being rebuilt, oversight tightened - even though they insist no cyberattack occurred nor did outside actors gain access.
Read more »
South Korea
Bitcoin Bithumb cryptocurrency Cyber Security phishing South Korea

Bithumb Mistakenly Credits Users With Billions in Bitcoin During Promotion Error

 




A promotional campaign at South Korean cryptocurrency exchange Bithumb turned into a large scale operational incident after a data entry mistake resulted in users receiving bitcoin instead of a small cash-equivalent reward.

Initial reports suggested that certain customers were meant to receive 2,000 Korean won as part of a routine promotional payout. Instead, those accounts were credited with 2,000 bitcoin each. At current market valuations, 2,000 bitcoin represents roughly $140 million per account, transforming what should have been a minor incentive into an extraordinary allocation.

Bithumb later confirmed that the scope of the error was larger than early estimates. According to the exchange, a total of 620,000 bitcoin was mistakenly credited to 695 user accounts. Based on prevailing prices at the time of the incident, that amount corresponded to approximately $43 billion in value. The exchange stated that the issue stemmed from an internal processing mistake and was not connected to external hacking activity or a breach of its security infrastructure. It emphasized that customer asset custody systems were not compromised.

The sudden appearance of large bitcoin balances had an immediate effect on trading activity within the platform. Bithumb reported that the incident contributed to a temporary decline of about 10 percent in bitcoin’s price on its exchange, as some affected users rapidly sold the credited assets. To contain further disruption, the company restricted withdrawals and suspended certain transactions linked to the impacted accounts. It stated that 99.7 percent of the mistakenly issued bitcoin has since been recovered.

The event has revived discussion around the concept often described as “paper bitcoin.” On centralized exchanges, user balances are reflected in internal ledgers rather than always corresponding to coins held in individual blockchain wallets. In practice, exchanges may not maintain a one-to-one on-chain reserve for every displayed balance at every moment. This structural model has previously drawn criticism, most notably during the collapse of Mt. Gox in 2014, which was then the largest bitcoin exchange globally. Its failure exposed major discrepancies between reported and actual holdings.

Data from blockchain analytics firm Arkham Intelligence indicates that Bithumb currently controls digital assets worth approximately $5.3 billion. That figure is substantially lower than the $43 billion temporarily reflected in the erroneous credits, underscoring that the allocation existed within internal accounting records rather than as newly transferred blockchain assets.

Observers on social media platform X questioned how such a large discrepancy could occur without automated safeguards preventing the issuance. Bithumb has faced security challenges in the past. In 2017, an employee’s device was compromised, exposing customer data later used in phishing attempts. In 2018, around $30 million in cryptocurrency was stolen in an attack attributed to the Lazarus Group, an organization widely linked to North Korea. A further breach in 2019 resulted in losses of roughly $20 million and was initially suspected to involve insider participation. In each instance, Bithumb stated that it compensated affected users for lost funds, though earlier incidents included exposure of personal information.

Beyond cybersecurity events, the exchange has also been subject to regulatory scrutiny, including investigations related to alleged fraud, embezzlement, and promotional practices. Reports indicate it was again raided this week over concerns involving misleading advertising.

Bithumb maintains that no customer ultimately suffered a net financial loss from the recent error, though the price movement raised concerns about potential liquidations for leveraged traders. A comparable situation occurred at decentralized exchange Paradex, which reversed trades following a pricing malfunction.

The incident unfolds amid broader market strain, with digital asset prices astronomically below their October peaks and political debate intensifying around cryptocurrency-linked business interests connected to U.S. public figures. Recent disclosures from the U.S. Department of Justice concerning Jeffrey Epstein’s early involvement in cryptocurrency ventures have further fueled online speculation and conspiracy narratives across social platforms.

Read more »
online trading
Bitcoins Cryptocurrency Threats Crypto Market Crypto Risk Crypto Safety cryptocurrency Cyber Security online trading

Cryptocurrency Market Slump Deepens Amid Global Tech Selloff and Risk-Off Sentiment

 

Now falling, the crypto market feels strain from turmoil spreading beyond tech stocks worldwide. As investors pull back sharply, digital currencies take a hit alongside firms that list Bitcoin on their books. When one part shakes, others follow - worry grows over how deeply losses might spread through finance and tech alike. 

A sharp drop hit Bitcoin lately, pushing prices toward their weakest point since early 2023. Nearly $12 down for every hundred just yesterday, it now trades near sixty thousand dollars, according to figures on CoinMarketCap. Once hovering near seventy-two thousand, the descent has been relentless. Four months back, it stood at about one hundred twenty-six thousand - today, less than half remains. 

This plunge highlights how deeply the current market retreat is cutting. What stands clear is how ongoing sell-offs, paired with steady withdrawals from spot Bitcoin ETFs, weigh heavily on price direction. Around $60,000, any upward movement in Bitcoin has stalled - this pattern, according to Pi42's co-founder and chief executive, Avinash Shekhar, shapes a guarded mindset among investors. Each time gains slip away, trust in short-term rebound weakens. With swings growing sharper, hesitation lingers in trader behavior. 

Even after a steep drop, Bitcoin showed signs of steadiness around $65,000 by Friday morning in Indian markets. Still, the overall market value fell almost 9 per cent, landing near $1.3 trillion. Trade spiked dramatically - volume climbed above 90 per cent - as approximately $143 billion in Bitcoin shifted in just one day. Around half of all cryptocurrency investors kept leaning toward major coins under pressure, with Bitcoin holding nearly 58 per cent share. Stability returned slowly while trading intensity stayed high. Despite stronger signals elsewhere, wider economic pressures continue to cloud investor mood. 

According to Giottus chief executive Vikram Subburaj, conditions now reflect a typical pullback environment - liquidity shrinks while buyers hesitate and global concerns linger without resolution. When examined closely, shrinking exchange-traded fund flows along with strained blockchain metrics have together dampened appetite for crypto holdings, deepening the drop seen over recent seven-day periods. This drop marks the toughest stretch for digital currencies since last October, just ahead of Donald Trump securing the presidency amid pro-crypto signals throughout his run. 

Not only Bitcoin feels the heat - Ethereum, BNB, Solana, XRP, Dogecoin, Cardano, and Bitcoin Cash all slid 9 to 13 percent in tandem. Sector-wide losses suggest a widespread pullback, not an isolated dip. Despite earlier momentum, confidence now appears fragile across major assets. Besides the plunge, crypto's overall market value now sits near $2.22 trillion. That fall means losses exceeding $2 trillion since the high mark of about $4.39 trillion seen in October 2025, nearly half vanishing within only four weeks. Rather than stabilizing, investor mood has soured due to swings in metals like gold and silver - normally seen as secure - alongside slumping stock markets. 

Because of these shifts, appetite for risk-heavy assets has cooled noticeably. Despite weaker US job figures and rising worries over big spending in AI, the cryptocurrency space stays under pressure, says Akshat Siddhant of Mudrex. Because global markets show caution, downward trends hold firm for now. Yet, within this pullback, patient Bitcoin holders might find pockets of value worth watching closely. Though short-term volatility lingers, the broader downturn isn’t seen as a total barrier to strategic entry points. Following such dips carefully could matter more than reacting fast.
Read more »
snail mail
cryptocurrency Cyber Fraud forged letterheads Hardware Wallets Ledger phishing snail mail

Fraudsters Use Postal Mail to Target Crypto Hardware Wallet Owners



Cybercriminals are using traditional mail services to target cryptocurrency users who own hardware wallets manufactured by Trezor and Ledger. The attackers are distributing printed letters that falsely present themselves as official security notifications and attempt to trick recipients into revealing their wallet recovery phrases.

The letters instruct users to complete a compulsory “Authentication Check” or “Transaction Check,” claiming this step will soon become mandatory. Recipients are warned that failure to comply before stated deadlines could result in disrupted wallet functionality. One Trezor-themed letter sets February 15, 2026 as the cutoff date, while a Ledger-branded version references October 15, 2025.

The correspondence appears professionally formatted and claims to originate from internal security or compliance departments. In a case shared publicly by cybersecurity researcher Dmitry Smilyanets, a Trezor-related letter stated that authentication would soon be enforced across devices and urged users to scan a QR code to prevent interruption of Trezor Suite access. The letter further asserted that even if users had already enabled authentication on their device, they must repeat the process to ensure full activation and synchronization of the feature.

The QR codes direct recipients to fraudulent domains including trezor.authentication-check[.]io and ledger.setuptransactioncheck[.]com. At the time of reporting, the Ledger-linked domain was inactive, while the Trezor-related site remained accessible but displayed a phishing warning from Cloudflare.

The Trezor-themed phishing page states that users must complete authentication by February 15, 2026 unless they purchased specific models, including Trezor Safe 7, Safe 5, Safe 3, or Safe 1, after November 30, 2025, in which case the feature is allegedly preconfigured. After selecting “Get Started,” users are warned that ignoring the process could lead to blocked access, transaction signing errors, and complications with future updates.

Those who continue are prompted to enter their wallet recovery phrase. The form accepts 12-, 20-, or 24-word phrases and claims the information is necessary to confirm device ownership. Technical analysis shows that submitted phrases are transmitted through a backend endpoint located at /black/api/send.php on the phishing domain.

With access to the recovery phrase, attackers can restore the wallet on another device and transfer funds.

The method used to identify recipients remains unclear. However, both manufacturers have experienced past data breaches that exposed customer contact information, potentially increasing targeting risks.

Although email-based crypto phishing is common, physical mail scams remain relatively uncommon. In 2021, attackers mailed tampered Ledger devices designed to capture recovery phrases during setup. A similar postal campaign targeting Ledger users was reported again in April.

A recovery phrase, also called a seed phrase, represents the private cryptographic key controlling a cryptocurrency wallet. Anyone who obtains it gains complete control over the associated funds.

Legitimate hardware wallet providers do not request recovery phrases through mail, QR codes, websites, or email. The phrase should only be entered directly on the hardware device during a genuine restoration process.



Read more »
Subscribe to: Posts (Atom)