Trust Wallets in a post on X said, “We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69.”
CZ has assured that the company is investigating how threat actors were able to compromise the new version.
Mobile-only users and browser extension versions are not impacted. User funds are SAFE,” Zhao wrote in a post on X.
The compromise happened because of a flaw in a version of the Trust Wallet Google Chrome browser extension.
If you suffered the compromise of Browser Extension v2.68, follow these steps on Trust Wallet X site:
Please wait to open the Browser Extension until you have updated to Extension version 2.69. This helps safeguard the security of your wallet and avoids possible problems.
Social media users expressed their views. One said, “The problem has been going on for several hours,” while another user complained that the company ”must explain what happened and compensate all users affected. Otherwise reputation is tarnished.” A user also asked, “How did the vulnerability in version 2.68 get past testing, and what changes are being made to prevent similar issues?”
For years, illegal online marketplaces were closely linked to the dark web. These platforms relied on privacy-focused browsers and early cryptocurrencies to sell drugs, weapons, stolen data, and hacking tools while remaining hidden from authorities. At the time, their technical complexity made them difficult to track and dismantle.
That model has now changed drastically. In 2025, some of the largest illegal crypto markets in history are operating openly on Telegram, a mainstream messaging application. According to blockchain intelligence researchers, these platforms no longer depend on sophisticated anonymity tools. Instead, they rely on encrypted chats, repeated channel relaunches after bans, and communication primarily in Chinese.
Analysis shows that Chinese-language scam-focused marketplaces on Telegram have reached an unprecedented scale. While enforcement actions earlier this year temporarily disrupted a few major platforms, activity quickly recovered through successor markets. Two of the largest currently active groups are collectively processing close to two billion dollars in cryptocurrency transactions every month.
These marketplaces function as service hubs for organized scam networks. They provide money-laundering services, sell stolen personal and financial data, host fake investment websites, and offer digital tools designed to assist fraud, including automated impersonation technologies. Researchers have also flagged listings that suggest serious human exploitation, adding to concerns about the broader harm linked to these platforms.
Their rapid growth is closely connected to large-scale crypto investment and romance scams. In these schemes, victims are gradually manipulated into transferring increasing amounts of money to fraudulent platforms. Law enforcement estimates indicate that such scams generate billions of dollars annually, making them the most financially damaging form of cybercrime. Many of these operations are reportedly run from facilities in parts of Southeast Asia where trafficked individuals are forced to carry out fraud under coercive conditions.
Compared with earlier dark web marketplaces, the difference in scale is striking. Previous platforms processed a few billion dollars over several years. By contrast, one major Telegram-based marketplace alone handled tens of billions of dollars in transactions between 2021 and 2025, making it the largest illicit online market ever documented.
Telegram has taken limited enforcement action, removing some large channels following regulatory scrutiny. However, replacement markets have repeatedly emerged, often absorbing users and transaction volumes from banned groups. Public statements from the platform indicate resistance to broad bans, citing privacy concerns and financial freedom for users.
Cryptocurrency infrastructure also plays a critical role in sustaining these markets. Most transactions rely on stablecoins, which allow fast transfers without exposure to price volatility. Analysts note that Tether is the primary stablecoin used across these platforms. Unlike decentralized cryptocurrencies, Tether is issued by a centralized company with the technical ability to freeze funds linked to criminal activity. Despite this capability, researchers observe that large volumes of illicit transactions continue to flow through these markets with limited disruption. Requests for comment sent to Tether regarding its role in these transactions did not receive a response at the time of publication.
Cybercrime experts warn that weak enforcement, fragmented regulation, and inconsistent platform accountability have created conditions where large-scale fraud operates openly. Without coordinated intervention, these markets are expected to continue expanding, increasing risks to users and the global digital economy.
Chennai, India — In a paradigm-shifting judgment that reshapes how India’s legal system views digital assets, the Madras High Court has ruled that cryptocurrencies qualify as property under Indian law. The verdict, delivered by Justice N. Anand Venkatesh, establishes that while cryptocurrencies cannot be considered legal tender, they are nonetheless assets capable of ownership, transfer, and legal protection.
Investor’s Petition Leads to Legal Precedent
The case began when an investor approached the court after her 3,532.30 XRP tokens, valued at around ₹1.98 lakh, were frozen by the cryptocurrency exchange WazirX following a major cyberattack in July 2024.
The breach targeted Ethereum and ERC-20 tokens, resulting in an estimated loss of $230 million (approximately ₹1,900 crore) and prompted the platform to impose a blanket freeze on user accounts.
The petitioner argued that her XRP holdings were unrelated to the hacked tokens and should not be subject to the same restrictions. She sought relief under Section 9 of the Arbitration and Conciliation Act, 1996, requesting that Zanmai Labs Pvt. Ltd., the Indian operator of WazirX, be restrained from redistributing or reallocating her digital assets during the ongoing restructuring process.
Zanmai Labs contended that its Singapore-based parent company, Zettai Pte Ltd, was undergoing a court-supervised restructuring that required all users to share losses collectively. However, the High Court rejected this defense, observing that the petitioner’s assets were distinct from the ERC-20 tokens involved in the hack.
Justice Venkatesh ruled that the exchange could not impose collective loss-sharing on unrelated digital assets, noting that “the tokens affected by the cyberattack were ERC-20 coins, which are entirely different from the petitioner’s XRP holdings.”
Court’s Stance: Cryptocurrency as Property
In his judgment, Justice Venkatesh explained that although cryptocurrencies are intangible and do not function as physical goods or official currency, they meet the legal definition of property.
He stated that these assets “can be enjoyed, possessed, and even held in trust,” reinforcing their capability of ownership and protection under law.
To support this interpretation, the court referred to Section 2(47A) of the Income Tax Act, which classifies cryptocurrencies as Virtual Digital Assets (VDAs). This legal category recognizes digital tokens as taxable and transferable assets, strengthening the basis for treating them as property under Indian statutes.
Jurisdiction and Legal Authority
Addressing the question of jurisdiction, the High Court noted that Indian courts have the authority to protect assets located within the country, even if international proceedings are underway. Justice Venkatesh cited the Supreme Court’s 2021 ruling in PASL Wind Solutions v. GE Power Conversion India, which affirmed that Indian courts retain the right to intervene in matters involving domestic assets despite foreign arbitration.
Since the petitioner’s crypto transactions were initiated in Chennai and linked to an Indian bank account, the Madras High Court asserted complete jurisdiction to hear the dispute.
Beyond resolving the individual case, Justice Venkatesh emphasized the urgent need for robust regulatory and governance frameworks for India’s cryptocurrency ecosystem.
The judgment recommended several safeguards to protect users and maintain market integrity, including:
• Independent audits of cryptocurrency exchanges,
• Segregation of customer funds from company finances, and
• Stronger KYC (Know Your Customer) and AML (Anti-Money Laundering) compliance mechanisms.
The court underlined that as India transitions toward a Web3-driven economy, accountability, transparency, and investor protection must remain central to digital asset governance.
Impact on India’s Crypto Industry
Legal and financial experts view the judgment as a turning point in India’s treatment of digital assets.
By recognizing cryptocurrencies as property, the ruling gives investors a clearer legal foundation for ownership rights and judicial remedies in case of disputes. It also urges exchanges to improve corporate governance and adopt transparent practices when managing customer funds.
“This verdict brings long-needed clarity,” said a corporate lawyer specializing in digital finance. “It does not make crypto legal tender, but it ensures that investors’ holdings are legally recognized as assets, something the Indian market has lacked.”
The decision is expected to influence future policy discussions surrounding the Digital India Act and the government’s Virtual Digital Asset Taxation framework, both of which are likely to define how crypto businesses and investors operate in the country.
A Legally Secure Digital Future
By aligning India’s legal reasoning with international trends, the Madras High Court has placed the judiciary at the forefront of global crypto jurisprudence. Similar to rulings in the UK, Singapore, and the United States, this decision formally acknowledges that cryptocurrencies hold measurable economic value and are capable of legal protection.
While the ruling does not alter the Reserve Bank of India’s stance that cryptocurrencies are not legal currency, it does mark a decisive step toward legal maturity in digital asset regulation.
It signals a future where blockchain-based assets will coexist within a structured legal framework, allowing innovation and investor protection to advance together.
Canadian police have shut down the cryptocurrency trading platform TradeOgre and seized digital assets valued at more than $40 million USD, marking both the country’s largest cryptocurrency seizure and the first time a crypto exchange has been dismantled by national law enforcement.
A Platform Built on Anonymity
TradeOgre was a small but notable exchange that allowed users to trade niche digital currencies, including Monero, which is popular for its privacy features. The platform stood out for avoiding Know Your Customer (KYC) checks, meaning people could open accounts without providing identification. According to the Royal Canadian Mounted Police (RCMP), TradeOgre also failed to register as a money services business with FINTRAC, Canada’s financial watchdog. These gaps made the exchange appealing to those seeking anonymity but also raised red flags for regulators.
The case began in June 2024, when Canada’s Money Laundering Investigative Team (MLIT) opened a probe after receiving intelligence from Europol. Investigators relied on blockchain tracing tools to track wallet activity linked to the platform. In July 2024, TradeOgre suddenly went offline without any announcement from its operators, fueling rumors among users that it had carried out an “exit scam.” Authorities later confirmed that the takedown was part of their enforcement action.
Why Authorities Took Action
The RCMP said TradeOgre was operating illegally in Canada because it was unregistered and allowed anonymous trading. Investigators suspect the site was used by criminals to launder illicit funds, taking advantage of Monero and other privacy-focused coins. However, officials stressed that not all customer funds were necessarily linked to crime.
In a statement, the RCMP clarified that they could not confirm whether the seized assets came from specific crimes such as extortion. They also noted that details about the exact sources of the money could not be released at this stage.
Fallout and Reactions
The sudden seizure left many users cut off from their funds. Some, including well-known crypto community members like Taylor Monahan of MetaMask, criticized the move, arguing that innocent users had their assets frozen without warning. “Very much looking forward to seeing the evidence… and for you to provide recourse to ALL innocent parties,” Monahan wrote on social media.
The RCMP responded that individuals who believe their funds were legitimate may seek remedies through the Canadian court system if the assets are subject to forfeiture proceedings. The agency added that any inquiries about the seized cryptocurrency should be directed to the MLIT.
A Warning for Crypto Users
Authorities emphasized that this case shows the risks of using unregulated exchanges. While anonymity may appeal to some traders, platforms that avoid oversight expose customers to legal uncertainty, sudden shutdowns, and loss of access to funds.
CEO Cyrus Fazel said that an external finance wallet of a partner was compromised. The incident happened due to hacking of the partner’s API, a process that lets software customers communicate with each other, impacting a single counterparty. It was not a compromise of SwissBorg, the company said on X.
SwissBorg said that the hack has impacted fewer than 1% of users. “A partner API was compromised, impacting our SOL Earn Program (~193k SOL, <1% of users). Rest assured, the SwissBorg app remains fully secure and all other funds in Earn programs are 100% safe,” it tweeted. The company said they are looking into the incident with other blockchain security firms.
All other assets are secure and will compensate for any losses, and user balances in the SwissBorg app are not impacted. SOL Earn redemptions have been stopped as recovery efforts are undergoing. The company has also teamed up with law enforcement agencies to recover the stolen funds. A detailed report will be released after the investigations end.
The exploit surfaced after a surge in crypto thefts, with more than $2.17 billion already stolen this year. Kiln, the partner company, released its own statement: “SwissBorg and Kiln are investigating an incident that may have involved unauthorized access to a wallet used for staking operations. The incident resulted in Solana funds being improperly removed from the wallet used for staking operations.”
After the attack, “SwissBorg and Kiln immediately activated an incident response plan, contained the activity, and engaged our security partners,” it said in a blogpost, and that “SwissBorg has paused Solana staking transactions on the platform to ensure no other customers are impacted.”
Fazel posted a video about the incident, informing users that the platform had suffered multiple breaches in the past.
A new Android malware strain called RatOn has rapidly evolved from a tool limited to NFC relay attacks into a sophisticated remote access trojan with the ability to steal banking credentials, hijack cryptocurrency wallets, and even lock users out of their phones with ransom-style screens. Researchers warn the malware is under active development and combines multiple attack methods rarely seen together in one mobile threat.
How It Spreads
RatOn is being distributed through fake websites designed to look like the Google Play Store. Some of these pages advertise an adult-themed version of TikTok called “TikTok 18+.” Once victims install the dropper app, it requests permission to install software from unknown sources, bypassing Android’s built-in safeguards. The second-stage payload then seeks administrator and accessibility permissions, along with access to contacts and system settings, giving it deep control of the device. From there, RatOn can download an additional component called NFSkate, a modified version of the NFCGate tool, enabling advanced relay attacks known as “ghost taps.”
Capabilities and Tactics
The trojan’s abilities are wide-ranging:
1. Overlays and ransomware screens: RatOn can display fake login pages to steal credentials or lock the device with alarming ransom notes. Some overlays falsely accuse users of viewing child exploitation content and demand $200 in cryptocurrency within two hours to regain access.
2. Banking and crypto theft: It specifically targets cryptocurrency wallets such as MetaMask, Trust Wallet, Blockchain.com, and Phantom. By capturing PIN codes and recovery phrases, the malware enables attackers to take over accounts and steal assets. It can also perform automated transfers inside George ÄŒesko, a Czech banking app, by simulating taps and inputs.
3. NFC relay attacks: Through NFSkate, RatOn can remotely use victims’ card data for contactless payments.
4. Remote commands: The malware can change device settings, send fake push notifications, send SMS messages, add contacts, record screens, launch apps like WhatsApp and Facebook, lock the phone, and update its target list of financial apps.
Researchers noted RatOn shares no code with other Android banking trojans and appears to have been built from scratch. A similar trend has been seen before: the HOOK trojan, another Android threat, also experimented with ransomware-style overlays.
Development and Targets
The first sample of RatOn was detected on July 5, 2025, with further versions appearing as recently as August 29, pointing to ongoing development. Current attacks focus mainly on users in the Czech Republic and Slovakia. Investigators believe the need for local bank account numbers in automated transfers suggests possible collaboration with regional money mules.
Why It Matters
RatOn’s integration of overlay fraud, ransomware intimidation, NFC relay, and automated transfers makes it unusually powerful. By combining old tactics with new automation, it raises the risk of large-scale theft from both traditional banking users and cryptocurrency holders.
Users can reduce exposure by downloading apps only from official stores, refusing risky permissions for unknown apps, keeping devices updated, and using strong multi-factor authentication on financial accounts. For cryptocurrency, hardware wallets that keep recovery phrases offline provide stronger protection. Anyone who suspects infection should immediately alert their bank and seek professional removal help.
Cybersecurity researchers have uncovered a new technique where attackers use fake Captcha tests to trick people into installing malware called Lumma Stealer. This malicious program is designed to quietly search infected computers for valuable information, such as login credentials, cryptocurrency wallet details, and two-factor authentication codes.
The scheme first appeared on a Greek banking website, where users were shown what looked like a Captcha security test. Instead of a normal verification, the prompt instructed Windows users to copy a piece of text into their Run dialog box and press Enter. By doing so, victims unknowingly triggered the installation of Lumma Stealer without downloading a visible file.
According to data shared by DNSFilter, a security company monitoring the incident, clients came across this fake Captcha 23 times in just three days. Alarmingly, around 17% of users who saw it followed the instructions, which led to attempts to infect their systems with malware.
How Lumma Stealer Works
Once inside a computer, Lumma Stealer immediately begins searching for anything that can be exploited for profit. This includes saved browser passwords, cookies, stored two-factor authentication tokens, cryptocurrency wallets, and even the data kept in password managers. Cybercriminals can use this stolen information to commit identity theft, break into financial accounts, or steal digital assets such as crypto funds.
What makes this threat particularly concerning is that Lumma Stealer can be hidden on otherwise legitimate websites, meaning unsuspecting users may fall victim even without visiting suspicious or obviously harmful pages.
Malware-as-a-Service Model
Lumma Stealer is part of a growing cybercrime trend known as Malware-as-a-Service (MaaS). Under this model, professional malware developers create the malicious software, improve its ability to avoid detection, and maintain hosting services. They then rent access to the malware to other cybercriminals in exchange for subscription fees. This arrangement makes it easy for attackers with little technical expertise to launch damaging campaigns.
Earlier this year, authorities attempted to disrupt Lumma Stealer operations. The U.S. Department of Justice seized several domains linked to the malware, while Microsoft removed thousands of related websites. However, security analysts report that Lumma Stealer quickly resurfaced, showing just how resilient and profitable such services can be.
Part of Lumma Stealer’s popularity comes from its low cost. Subscriptions can be found on underground forums for only a few hundred dollars per month, yet the potential financial return for criminals is enormous. In recent analyses, experts estimated that hundreds of thousands of devices have been compromised, with losses reaching tens of millions of dollars.
The importance of staying alert online cannot be emphasised enough. Unusual instructions, such as copying text into a computer’s Run command should raise suspicion immediately. Cybersecurity specialists advise users to verify unexpected prompts and ensure their systems are protected with updated security tools to reduce the risk of infection.
The Federal Bureau of Investigation (FBI) has raised concern over what it describes as a fast-expanding online threat, warning that criminal groups are becoming more organized and dangerous in cyberspace. The activity includes ransomware, phishing scams, cryptocurrency theft, and even violent real-world crimes linked to online networks.
According to the FBI, one of the most concerning groups involved in these activities is part of an online collective often referred to as “The Com,” short for “The Community.” This loosely connected network is made up of several subgroups, including one known as “Hacker Com.” The collective primarily communicates in English and has members spread across different countries.
A striking detail is that many individuals taking part are very young, with ages ranging from early teens to their mid-20s. Recruitment often happens on online gaming platforms, social media channels, or through existing members who look for people with shared interests.
The FBI notes that the scale and sophistication of these groups has increased substantially over the past four years. Members use advanced tools such as phishing kits, voice changers, and other techniques to disguise their identities and hide illegal financial dealings. These methods make it difficult for law enforcement to trace stolen funds or identify those responsible.
Much of the activity is financially motivated, especially through schemes involving cryptocurrency. Offenses include SIM swapping, hacking into networks, and in some cases, direct physical threats. The FBI has reported that criminal actors have resorted to extreme methods such as coercion, intimidation, and even violence to force victims into giving up access to digital accounts.
Beyond theft, some members also carry out dangerous acts such as swatting: making false emergency reports that lead armed law enforcement to a target’s home or issuing bomb threats. These tactics are sometimes used to distract authorities during larger cyberattacks or thefts. Disturbingly, certain groups have extended their activities into the offline world, where crimes can escalate into real-world violence.
Given the scope of the threat, the FBI is advising the public to be cautious when sharing personal details online. Posting photos, videos, or sensitive information on social media, dating platforms, or gaming forums can make individuals and families targets. Parents are especially encouraged to stay alert to their children’s online activity and to have open conversations about the potential risks.
For those who believe they may have been targeted or victimized, the FBI recommends keeping all available evidence, such as messages or transaction details, and reporting incidents promptly through its Internet Crime Complaint Center (ic3.gov) or by contacting a local FBI field office.
The Bureau emphasizes that awareness and vigilance are key defenses against these developing online dangers.
Two executives behind a cryptocurrency service called Samourai Wallet have admitted in court that they helped criminals hide more than $200 million.
Keonne Rodriguez, the company’s CEO, and William Lonergan Hill, its chief technology officer, pleaded guilty to conspiracy charges in the United States. Both men admitted they had knowingly operated an unlicensed money-transmitting business that was used to clean illegal funds.
Under the law, Rodriguez and Hill face a maximum prison sentence of five years each, along with financial penalties. They will also have to give up more than $200 million as part of their plea deal.
The U.S. Department of Justice (DOJ) had first arrested the pair in April last year. Prosecutors accused them of two main crimes: running a business without the required license and laundering money, a serious charge that can carry up to 20 years in prison.
Authorities say the two executives built Samourai in 2015 with tools designed to make it harder to track money on the blockchain, which is the public digital record of cryptocurrency transactions.
Samourai’s services worked in two main ways:
• Whirlpool: A mixing feature that bundled together Bitcoin transactions from multiple users. This made it harder to trace where the money originally came from.
• Ricochet: A tool that added extra steps called “hops” between the sending and receiving addresses. This technique was meant to confuse investigators and disguise the money trail.
Prosecutors explained that these tools were heavily used by cybercriminals. They were linked to proceeds from online thefts, drug trafficking, and fraud schemes. According to the DOJ, the scale of activity was massive: between 2017 and 2019, over 80,000 Bitcoin flowed through Samourai’s services. At the time of those transactions, the total value was estimated at more than $2 billion.
While the company portrayed itself as offering privacy, federal investigators say it profited directly from crime. Samourai’s mixing services alone generated more than $6 million in fees for Rodriguez and Hill.
Speaking about the case, U.S. Attorney Nicolas Roos emphasized that when cryptocurrency platforms are abused for crime, it damages public trust and puts pressure on legitimate companies trying to operate within the law.
The case underlines how regulators are cracking down on cryptocurrency “mixers,” services that blend together digital transactions to hide their origins. While privacy is one of cryptocurrency’s appeals, officials warn that these tools often provide cover for large-scale money laundering.