cybercrime

The International Criminal Police Organization stated that Operation Serengeti III took place from June 29 to August 31, 2026, across 21 countries, resulting in the arrest of 1,462 suspects, the dismantling of 10,909 malicious networks, and the recovery of over 105 million dollars in illegal funds. The investigation also confirmed that 65,929 victims were attacked by cybercrime gangs, with related losses exceeding 385 million dollars.This operation focused on combating online fraud, ransomware, business email compromise, online scams, and digital extortion. In specific cases, the Ugandan police dismantled two transnational fraud gangs and arrested 365 foreign nationals; Angola seized two illegal cryptocurrency mining centers, arrested 9 individuals, and confiscated over 2,000 mining machines; in Nigeria, another case involved over 2.4 million dollars in suspected criminal proceeds, a significant portion of which was laundered through cryptocurrency transactions.

Interpol announced that from June 29 to August 31, 2026, it coordinated law enforcement agencies from 21 countries to carry out Operation "Serengeti III," targeting online fraud, ransomware, business email compromise, online scams, and digital extortion. The operation resulted in the arrest of 1,462 suspects, the dismantling of 10,909 malicious networks, and the recovery of over $105 million in illegal funds. Investigations confirmed 65,929 victims, with financial investigations linking losses exceeding $385 million.In Angola, law enforcement dismantled two illegal cryptocurrency mining centers, arrested 9 suspects, and seized over 2,000 cryptocurrency mining devices and 6 illegal power transformer stations, with the seized power infrastructure alone valued at over $1 million. In Nigeria, authorities arrested a suspect linked to large-scale phishing and business email compromise, with the operation collecting approximately 2.1 million email addresses and software credentials; another investigation uncovered an international investment scam promoted through instant messaging applications that transferred over $2.4 million in suspected criminal proceeds, most of which were laundered through cryptocurrency transactions.Neal Jetton, head of cybercrime at Interpol, stated that cybercrime networks disregard borders and exploit technology to target victims on an unprecedented scale; the operation demonstrates that despite the increasingly borderless nature of cybercrime, international cooperation remains an effective tool for dismantling criminal networks, recovering criminal assets, and protecting communities. The operation received support from private sector partners such as Group-IB, Kaspersky, Fortinet, and Meta, and was co-funded by the EU and the joint project GLACY-e of the European Commission.

According to a report from the official Coinbase blog, the Anti-Scam Centre (ASC) of the Singapore Police Force released a briefing on scams and cybercrime for the first half of 2026, showing that cryptocurrency scam losses in Singapore decreased by 43% year-on-year, from 114.9 million Singapore dollars to 65.5 million Singapore dollars.The ASC attributes this achievement in part to the actions taken by industry partners, including the shutdown of 47,500 mobile lines, 37,500 WhatsApp accounts, and 52,200 malicious websites, as well as investigations into over 2,900 money mules and scammers, resulting in approximately 470 prosecutions. The Coinbase Global Intelligence Team identified over 720 potential victims through four joint operations with the ASC, helping to intercept potential losses of over 18.9 million Singapore dollars.

According to official disclosures from Coinbase, it has collaborated with Microsoft and several institutions to combat the AI-driven cybercrime platform EvilTokens. This platform offers "phishing as a service" through Telegram bots, utilizing AI to analyze trust relationships and payment permissions in compromised email accounts, and bypassing multi-factor authentication through Microsoft's device code login process.The Coinbase global intelligence team tracked that between October 2025 and June 2026, EvilTokens generated approximately $1.1 million in revenue through four Tron addresses, involving over 1,000 deposits from more than 700 different addresses. The related evidence supported Microsoft's civil lawsuit, ultimately leading to the seizure of 50 websites and the deactivation of over 175 associated domain names. The Metropolitan Police Service of the United Kingdom arrested the relevant operators and seized digital devices on September 11. Coinbase stated that this incident did not result in the leakage of Coinbase accounts or credentials, but some customers were manipulated into transferring cryptocurrency to the scammers' addresses through phishing emails.

According to Fortune, the San Francisco-based cryptocurrency crime tracking company TRM Labs completed a $70 million Series C funding round in September 2025, achieving a valuation of $1 billion. Just six months later, it received additional investment from existing investors, doubling its valuation to $2 billion.CEO Esteban Castano stated that the company's mission has expanded from blockchain forensics to a broader mapping of cybercrime, with AI becoming a second growth engine rather than a transformation, while the core cryptocurrency business remains strong. The company is set to launch a new investigation platform specifically targeting AI-driven deepfake scams, extortion related to pornography, and child sexual abuse crimes.Castano noted that the widespread adoption of cryptocurrency has made it possible to comprehensively map crime networks, and the company is expected to reach a $100 million annual recurring revenue milestone in the coming weeks. Currently, it has about 500 employees and has offices in London, Singapore, and Washington.

U.S. Attorney General Todd Blanche posted on the X platform that this week cybercriminals launched password recovery attacks against hundreds of thousands of X users. The X platform successfully thwarted this attack to prevent user accounts from being hijacked, and the Department of Justice is working closely with X to track down the attackers.

According to a report by the Korea United News Agency, the Gwangju Police Agency's Cyber Crime Investigation Team will arrest and transfer three suspects led by A (in their 60s), who are suspected of establishing offices in Seoul, Gwangju in South Jeolla Province, and Gunsan in North Jeolla Province since November 2024. They allegedly deceived over 100 elderly individuals aged 70 to 80 into investing in virtual assets with false promises such as "guaranteed principal" and "potential profits of hundreds of billions of Korean won," accumulating approximately 500 million Korean won in fraud.The police stated that there are likely still unreported victims and are continuing to expand the investigation, reminding the public to remain vigilant against investment offers that promise guaranteed principal and high returns.

The Federal Bureau of Investigation (FBI) disclosed that in 2025, the reported losses from cybercrime by the American public approached $21 billion, with 181,565 complaints involving cryptocurrency, totaling losses of over $11 billion.New York Attorney General Letitia James testified before Congress on July 27, stating that the CLARITY Act aims to transfer primary regulatory authority over digital assets to the Commodity Futures Trading Commission (CFTC), which could potentially weaken the ability of states to investigate fraud and hold cryptocurrency companies accountable. James urged cryptocurrency platforms to comply with anti-money laundering, know your customer, cybersecurity, and market monitoring requirements, and to take financial responsibility for preventable fraud. Her office has received nearly three times the number of cryptocurrency fraud complaints in the past three years, with related losses approaching $500 million over the past five years.

According to Financefeeds, the U.S. Department of Justice has announced criminal charges against 19-year-old dual citizen Peter Stokes, who is accused of being a member of the cybercrime organization "Scattered Spider," and has been extradited from Finland to the United States.

According to Bitcoin.com, the European Cybercrime Centre recently led a joint operation codenamed "Endgame," which was the result of collaboration among law enforcement agencies from Canada, Denmark, Germany, the Netherlands, and the United States.These agencies jointly targeted the network infrastructure that provided services to criminals, utilizing three key types of "cybercrime-as-a-service" (CaaS) malware: SocGholish, Amadey, and StealC, to collect victims' information and sensitive data.Law enforcement agencies took action against a total of 326 servers and 142 domain names, seizing illegal cryptocurrency worth approximately $47 million and recovering over 27 million stolen credentials.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.

According to CryptoSlate, the U.S. Congress is pushing to rebuild the Department of Justice's cryptocurrency crime task force. Previously, the Department of Justice disbanded the National Cryptocurrency Enforcement Team in April 2025 and stopped its "law enforcement as regulation" strategy targeting the cryptocurrency industry. The new bill was proposed by Representatives Lance Gooden and Josh Gottheimer, aiming to establish a federal cryptocurrency theft task force within the Department of Justice, responsible for coordinating investigations and prosecutions of cases involving cryptocurrency theft, hacking, fraud, and more.The task force's responsibilities include developing best practices for evidence collection, digital evidence analysis, asset tracking, and victim outreach, providing technical assistance and training to state and local law enforcement agencies, and coordinating international cross-border case cooperation. The bill explicitly excludes the cryptocurrency market, financial institutions, and financial products from the task force's regulatory scope, without changing the existing regulatory framework and criminal law. An FBI report indicates that in 2025, there were 181,565 complaints involving cryptocurrency, with reported losses exceeding $11 billion. The bill has not yet clarified details regarding funding, staffing, and victim response mechanisms.

The National Police of Ukraine and the Internal Security Department conducted a joint operation, arresting a suspect in the Transcarpathian region who is alleged to be involved in an international cybercrime gang. This gang is implicated in fraud and money laundering cases exceeding $100 million targeting the United States and Europe, and had previously been listed as an international wanted person by the FBI.The suspect was found in possession of forged identity documents and had even fabricated a death certificate to conceal their whereabouts. The gang deployed malware to steal personal and corporate data, subsequently extorting victims for ransom. Money laundering methods included purchasing real estate and using relatives' names to obscure the flow of funds. Authorities seized approximately $11 million in assets, including cash, real estate, vehicles, and about $3 million worth of cryptocurrency, and also apprehended two co-defendants. The suspect faces charges of document forgery and money laundering.

A 27-year-old German hacker, Noah Christopher, was arrested in Bangkok, Thailand, facing up to 74 arrest warrants for cyber crimes in Europe.Investigations show that this individual is suspected of developing and operating a ransomware platform and a "cybercrime-as-a-service" (CaaS) system between 2021 and 2025, including providing distributed denial-of-service (DDoS) attack tools (such as Fluxstress and Neldowner), assisting global clients in launching cyber attacks and charging fees, with related ransom payments involving cryptocurrencies and other digital assets, constituting transnational cybercrime activities. His visa has been revoked, and he is currently detained awaiting extradition to Germany.

According to DL News, the Ertzaintza police in Spain's Basque Country stated that cryptocurrency-related crimes in the region are on the rise, with a total of 541 related cases investigated in 2025, which are still under investigation.The police have been equipped with specialized tools to monitor cryptocurrency transactions across multiple blockchain networks and have formed a cybercrime department consisting of 26 detectives dedicated to combating crimes such as crypto fraud and hacking. The cases under investigation include 13 suspected cases of crypto fraud, 2 suspected cases of crypto money laundering, as well as tax evasion and illegal purchases of goods and services.The police warned that scammers impersonate friends and family on social media platforms like Instagram to provide investment advice, tricking victims into installing applications that allow remote control, thereby stealing cryptocurrency wallets and bank accounts.

According to Cointelegraph, the FBI, Europol, and law enforcement agencies from 14 countries conducted a joint operation on March 3-4, successfully shutting down the cybercrime forum LeakBase. The forum had over 142,000 members and served as a platform for hackers to buy and sell stolen data and cybercrime tools.Law enforcement has seized user accounts, posts, credit details, private information, and IP logs as evidence, and executed search warrants and arrests in multiple countries. Notably, LeakBase's predecessor, Raidforums, was shut down in 2022 and had hosted leaked data containing personal information of approximately 272,000 users of the cryptocurrency wallet company Ledger. In recent years, data breaches in the cryptocurrency industry have continued to rise, including security incidents such as the hacking of Coinbase's internal systems.

The Ministry of Public Security has announced that it has drafted the "Cyber Crime Prevention Law (Draft for Comments)" and is now publicly soliciting opinions from society, with the deadline for feedback set for March 2, 2026. The content includes: no individual or organization shall knowingly harbor, transfer, acquire, sell on behalf of others, or conceal or disguise funds, data, or virtual property obtained from others' online illegal activities.No individual or organization shall knowingly use funds obtained from others' illegal activities to provide capital flow services using virtual currency or other online virtual property for others.

According to China News Service, Hong Kong hosted the annual meeting of the International Criminal Police Organization's Cybercrime Expert Group for the first time. The meeting covered various topics including online extortion, artificial intelligence, and virtual asset tracking. Chief Superintendent Chow Man-ming of the Hong Kong Police Force noted the emerging trends in crimes related to virtual assets and established a virtual asset intelligence task force last year as a public-private partnership to jointly address technological challenges.The Hong Kong police have also developed a virtual asset tracking system that visualizes the virtual asset investigation process and fully supports investigators.

On Monday night, three masked men broke into a residence in Manosque, France, threatening a woman with a gun and stealing a USB drive containing her partner's cryptocurrency data. According to the French newspaper Le Parisien, the incident occurred at a home on Cherry Path in the Alpes-de-Haute-Provence region.The attackers threatened the victim with a handgun and slapped her before fleeing the scene with the USB drive. It is reported that the victim was unharmed and managed to escape and call the police within minutes. Local police have opened an investigation, and the case has been handed over to the local criminal investigation department and the national police regional headquarters. Last year, security company Casa's Chief Technology Officer Jameson Lopp recorded over 70 violent attacks related to cryptocurrency in its public database, with France becoming a hotspot for such violent crimes in Europe, with more than 14 related cases.Cybercrime consultant David Sehyeon told Decrypt, "The baseline level of criminal activity in France is relatively high, and the cryptocurrency wealth held by entrepreneurs, traders, and public figures is quite visible. Coupled with the growth of local expertise in digital assets, these factors together create a breeding ground for more speculative and organized cryptocurrency-related crime."