involved

According to the official announcement from Foundation, regarding the recent phishing email incident, the team’s investigation found that their email system recorded over 23,000 phishing email sending attempts, of which 19,057 were sent via Mailgun, and another 1,503 were sent via Google Workspace.Due to some email accounts receiving multiple emails, and some sending attempts being unsuccessful or intercepted, it is currently not possible to confirm the actual number of affected individuals.

Chinese national Zheng Zhao was extradited from the Netherlands to the United States and appeared in court on October 23 in the Central District of California. He is suspected of participating in an investment fraud and money laundering case involving 174 American victims, with funds exceeding $36.9 million.The U.S. Department of Justice (DOJ) stated that the fraudulent activities were operated by a scam center in Cambodia. Prosecutors claimed that over $36.9 million was transferred into an account at Deltec Bank in the Bahamas controlled by accomplices, and then exchanged for the stablecoin USDT and transferred to a digital asset wallet in Cambodia. Eight other co-defendants have pleaded guilty; Zheng Zhao faces charges of conspiracy to commit money laundering, which could result in a maximum sentence of 20 years in prison if convicted.

According to Bitcoin.com, the Colombian Attorney General's Office announced on Wednesday that, in coordination with U.S. intelligence agencies, it has arrested 8 individuals suspected of using cryptocurrency to launder money for drug trafficking organizations. Police and military conducted simultaneous operations in four locations: Cúcuta, Maicao, Barranquilla, and Bogotá.Among those arrested were 7 individuals, including the gang leader Guillermo Carpio Cárdenas (nicknamed "Gallo"). The U.S. District Court for the District of Puerto Rico has charged that the gang used deposit networks, cryptocurrency tokens, and small transaction splitting (smurfing) to conceal the source of drug money and evade monitoring by financial intelligence agencies.Another suspect, Nassim Orfale Vasquez, was arrested in Barranquilla and has been indicted by the U.S. District Court for the Southern District of New York. According to the IRS, he has handled over $42 million in suspicious cryptocurrency transactions since 2018, and authorities are investigating whether there are larger money laundering organizations in Colombia's coastal regions.

According to The Defiant, Blockaid data shows that from January to August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion in funds, with victims recovering about $9.8 million, accounting for less than 1%.The report pointed out that all frozen or returned funds were achieved through on-chain governance or validator actions, and the blacklist mechanism of stablecoin issuers did not recover any funds in these 60 incidents.

According to on-chain detective Specter, ZachXBT disclosed that the Bitget attackers concealed the stolen funds through Zcash (ZEC), and other stolen funds also began to flow into ZEC, including funds from the Cryptobills Ledger incident and $12 million from the Triple-A hacker attack.Threat actors are using ZEC to transfer stolen funds.

According to The Block, citing South Korean media Digital Asset, South Korean cryptocurrency influencer "Coin King" Jonbur Kim (original surname Park) was acquitted of fraud charges by the Southern District Court of Seoul. The case involved allegations of cryptocurrency fraud amounting to approximately 340 billion won (about 253 million USD).The court stated on Thursday that the prosecution lacked sufficient evidence to prove the relevant crimes. Jonbur Kim had previously been accused of participating in fraudulent issuance, listing, false disclosures, and price manipulation, with the tokens involved primarily including Podo Coin and Artube.

On October 12, 2026, the financial technology company Yirendai released a statement through its public account, stating that it had noted the public security report released by "Ping An Beijing Chaoyang" on that day, and that the relevant situation should be based on the official announcement.Yirendai stated that the company operates independently as a publicly listed entity, focusing on financial technology and AI technology innovation. The company mentioned that no direct relationship with Yirendai's business has been found regarding the reasons involved in this incident, and that operations remain normal, with all business activities progressing in an orderly manner.The company also stated that it will strictly adhere to regulatory requirements, maintain compliant and stable operations, protect the legal rights and interests of partners and users, and express gratitude for the attention from all sectors.

According to the 21st Century Business Herald, the Chaoyang Branch of the Beijing Public Security Bureau reported that it has recently filed a case for investigation into the suspected illegal activities of related companies of Yixin. Currently, several criminal suspects, including the actual controllers Tang and Zhao, have been subjected to criminal coercive measures in accordance with the law.Yixin Group had previously fully suspended the redemption of quasi-fixed income products on May 22 and issued an apology letter to relevant investors on October 11. Yixin stated that the group has incurred significant losses in multiple businesses, and the market value of asset disposal is relatively low. Preliminary findings indicate that the group may be insolvent and has a significant debt repayment gap.

According to reports from Japan's Jiji Press and TBS, Japanese police have arrested 6 individuals suspected of laundering money for a fraud group through cryptocurrency assets. Police investigations indicate that the gang is suspected of handling approximately 91 million yen (about 580,000 USD) in fraud funds between February and March 2024, involving around 30 victims.The funds first entered the company's bank account, then were exchanged for BTC, converted to USDT through overseas channels, and returned to the fraud group. The individuals involved are reportedly charging a commission of about 1%.

According to a report by the WSJ, a previously undisclosed internal investigation report from Binance shows that Iranian financier Babak Zanjani used affiliated companies, shell companies, and multiple trading accounts to transfer funds through Binance, establishing a funding channel for the Iranian Islamic Revolutionary Guard Corps (IRGC) to evade Western sanctions. The related network involves 21 individual and corporate trading accounts, with a total trading volume of approximately $850 million, of which at least $67 million flowed from two accounts to wallets associated with the IRGC.The report indicates that Tajik businessman Sukhrob Oimakhmadov, classified as a "high-value customer" by Binance, received over $10 million through his account, with sources including digital wallets later identified by the Israeli Ministry of Defense as belonging to the IRGC. The cryptocurrency platform Zedcex, associated with Zanjani, had a total trading volume close to $830 million, with approximately $56 million withdrawn to related wallets. The network also involves the Turkish payment company ZedPay, as well as the cryptocurrency token USDZ used for trading.Binance stated that it has identified the related activities and taken measures, with all accounts associated with sanction violations being restricted from trading and gradually closed. The company also emphasized that the total trading volume of accounts does not equal the actual funds flowing into the IRGC and acknowledged past procedural issues in internal approvals and execution timeliness. The U.S. Department of the Treasury had previously imposed sanctions on Zanjani and related companies and individuals.

A 28-year-old core member of the globally renowned ransomware group Qilin has been arrested in Japan and was extradited to Germany on October 2. Reports indicate that the man is suspected of illegally infiltrating the systems of a logistics company in Germany in September 2024, encrypting data, and demanding a ransom of approximately $165,000 (about 26 million yen) in Bitcoin.Investigations show that he was responsible for building the attack systems within the Qilin criminal network and took a cut from the ransoms collected by various branch execution teams. Japanese police apprehended him while he was traveling to Osaka in late May this year, and he was subsequently handed over to German authorities after being deemed eligible by the Tokyo High Court. Qilin operates under a "ransomware as a service" (RaaS) model and previously claimed responsibility for a cyber attack on Japan's Asahi Group in 2025.

Salus posted on platform X, claiming that the project Revenue Family, which claims to be X Money's withdrawal bridge, involves malicious authorization. The perpetrators submitted user permit signatures to obtain unlimited USDG authorization, and then called transferFrom within the same transaction to transfer funds, with the funds flowing into two hacker addresses in an 80/20 ratio.On October 1, the project claimed that its social media account was stolen by internal reviewers, suspended exchanges, and denied that REV is the official token.

Greek police dismantled a cryptocurrency investment fraud gang and arrested 17 people, including 9 military personnel. Preliminary investigations by the police show that about 10,000 people participated in the investment, with an average investment of around 800 euros per person, and the amount involved is estimated to exceed 8 million euros.The gang operated by recruiting new members to obtain higher returns, exhibiting clear "pyramid" characteristics. In addition, the gang recently froze the withdrawal function and claimed that investors could receive double their principal back after 50 days if they doubled their investment. The police have currently seized about 280,000 euros, and the investigation is ongoing.

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

NEAR Intents released a security notice confirming that it has encountered an attack. Preliminary investigations indicate that the vulnerability originated from a defect in the interaction between the Omni deposit and withdrawal infrastructure and contracts. The contract vulnerability has been fixed, and core services are expected to be restored within 1 hour, with a commitment to fully compensate for the damaged assets.NEAR Intents stated that deposit and withdrawal services for multiple public chains, including BSC, Polygon, and TON, will be additionally suspended for about 12 hours. The relevant cases have been reported, and on-chain tracking has begun.Subsequently, on-chain detective ZachXBT indicated that NEAR Intents' BSC hot wallet experienced multiple abnormal outflows of funds, with the stolen funds transferred to KuCoin and further cross-chain to the Bitcoin network. The amount involved has exceeded 3.8 million USD.

Recently, the Beijing Shijingshan police successfully intercepted a new type of cross-border telecom fraud case, freezing 780,000 yuan in involved funds and returning it to the victims. In this case, 53-year-old Mr. Liu received a fraudulent call from abroad while accompanying his child studying overseas. The scammer impersonated domestic police, fabricated false allegations of money laundering, and induced him to urgently request money transfers from his family in China.The funds were subsequently transferred into the accounts of two other Chinese students studying abroad. Upon investigation, it was found that these three individuals were all victims of the same fraud gang, exhibiting characteristics of "multiple scams in one case, with victims serving as money laundering tools for each other." The scammers first transferred funds into the accounts of some victims, then coerced them into exchanging for U currency to assist in the transfer, which was highly concealed and involved complex cross-border links. The police successfully "awakened" the victims through patient persuasion, preventing greater losses.

The U.S. Commodity Futures Trading Commission (CFTC) has filed a lawsuit against Cash FX Group S.A. and its CEO Huascar Jose Lopez Castillo, The Conversion Pros Inc. and its CEO Ronald Pope, Justin Halladay, accusing the aforementioned defendants of operating a multi-level marketing Ponzi scheme that raised over $950 million from the public, including in the United States, claiming it was for retail foreign exchange contract trading.The CFTC stated that the defendants falsely claimed that funds were traded by professional traders, proprietary algorithms, and AI, promising returns of up to 15% per week; in reality, Cash FX conducted only a small amount of foreign exchange trading, and almost all participant funds were misappropriated, paying fictitious trading profits to other participants using funds from new participants, while paying millions of dollars to the defendants. The CFTC claimed that Cash FX also provided participants with false account statements to maintain the illusion of high trading returns, resulting in participants losing at least $406 million. The CFTC is seeking to order the defendants to pay restitution, recover illegal profits, pay civil monetary penalties, and impose trading and registration bans as well as permanent injunctions.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

According to CriptoNoticias, the Spanish Civil Guard and National Police have respectively cracked down on two cryptocurrency-related criminal cases, capturing or identifying a total of 48 individuals involved.Among them, one Ponzi scheme resulted in losses of approximately 327,000 euros for 113 investors; another criminal network implemented fraud through phishing, fake rental advertisements, and other methods, converting illegal gains into cryptocurrency to evade tracking, causing losses exceeding 430,000 euros.