arrest

Seoul police arrested 7 suspects accused of using generative AI to launch hacking attacks. The Seoul Metropolitan Police Agency stated that about 90 organizations were involved, collectively stealing 8.2 million records, marking the first large-scale arrest of suspects in AI-assisted hacking attacks in South Korea. The targeted victims included hospitals, universities, private tutoring centers, golf courses, and subsidiaries of large corporate groups, all of which held a significant amount of personal information, including names, contact details, and records of ordinary citizens. One funeral service company lost 1.22 million records, and reports indicated that the tutoring center's data also contained information on minors.According to local media reports, the main suspect, 32 years old, studied arts and sports and has no IT background. He told investigators that he self-taught hacking techniques through YouTube and online blogs, while police pointed out that he had worked in a security company conducting simulated attacks from 2019 to 2022. He initially used website vulnerability scanning tools and later introduced AI coding proxies and an automated penetration testing system called Artex at the end of August. Police stated that he hacked into 60 companies over a span of 44 days from August 31 to October 13.The entire attack operation lasted about 13 months, from September 2025 to this October, and the case was filed in June after a victim reported it. Police indicated that such a large-scale attack previously required a hacker group to accomplish, but AI now allows one person to achieve this in a short time. The suspect sent emails to 38 victims, collectively extorting 360 million Korean won, approximately 272,000 US dollars, but the only confirmed payment was 300,000 won, about 210 dollars. The main suspect was detained and transferred to prosecutors last Friday, facing charges of violating South Korea's Information and Communication Network Act, as well as extortion and attempted extortion. Police will continue to investigate the other 6 accomplices and confirm more victims, with 15 institutions already reporting damages.

Interpol announced that from June 29 to August 31, 2026, it coordinated law enforcement agencies from 21 countries to carry out Operation "Serengeti III," targeting online fraud, ransomware, business email compromise, online scams, and digital extortion. The operation resulted in the arrest of 1,462 suspects, the dismantling of 10,909 malicious networks, and the recovery of over $105 million in illegal funds. Investigations confirmed 65,929 victims, with financial investigations linking losses exceeding $385 million.In Angola, law enforcement dismantled two illegal cryptocurrency mining centers, arrested 9 suspects, and seized over 2,000 cryptocurrency mining devices and 6 illegal power transformer stations, with the seized power infrastructure alone valued at over $1 million. In Nigeria, authorities arrested a suspect linked to large-scale phishing and business email compromise, with the operation collecting approximately 2.1 million email addresses and software credentials; another investigation uncovered an international investment scam promoted through instant messaging applications that transferred over $2.4 million in suspected criminal proceeds, most of which were laundered through cryptocurrency transactions.Neal Jetton, head of cybercrime at Interpol, stated that cybercrime networks disregard borders and exploit technology to target victims on an unprecedented scale; the operation demonstrates that despite the increasingly borderless nature of cybercrime, international cooperation remains an effective tool for dismantling criminal networks, recovering criminal assets, and protecting communities. The operation received support from private sector partners such as Group-IB, Kaspersky, Fortinet, and Meta, and was co-funded by the EU and the joint project GLACY-e of the European Commission.

Turkish Minister of Justice Akın Gürlek confirmed on Saturday that Ethereum ecosystem token Hex and PulseChain founder Richard Heart were detained in Istanbul. Gürlek stated on the X platform that Heart, whose real name is Richard James Schueler, was detained along with his wife during an operation in the Beşiktaş district of Istanbul on Wednesday, and the police subsequently detained three individuals confirmed to be his bodyguards. The operation was carried out by the Istanbul Chief Prosecutor's Office in conjunction with the city's police intelligence and financial crimes department, with support from Turkey's intelligence agency MİT.Gürlek indicated that the police conducted searches at 15 addresses in the Beşiktaş, Üsküdar, and Sarıyer districts, seizing $7.15 million in cash, six cold wallets, 160,000 Turkish lira, 28 watches, 97 pieces of jewelry, 300 bags, and 19 graphics cards, while also confiscating four long-barreled rifles, three unlicensed handguns, and 1,400 rounds of ammunition. Gürlek stated that judicial procedures and the examination of seized items are still ongoing. Turkey's state news agency Anadolu reported separately that the police seized nine vehicles registered under Heart's wife's name. According to CoinGecko data, Hex has dropped about 14% in the past 24 hours.Gürlek linked Heart's red notice to the $1 billion cryptocurrency fraud charges involving the United States and Finland. The notice was issued in December 2024 at the request of Finnish authorities, who sought his arrest on charges of serious tax evasion and assault. In the United States, a federal judge dismissed the Securities and Exchange Commission's lawsuit against Heart in February 2025 on jurisdictional grounds, and the agency decided not to refile the lawsuit in April of that year.

According to Thai media Khaosod English, Thai immigration police recently arrested a 37-year-old Chinese man in Bangkok. He is wanted by Chinese police for allegedly participating in a transnational criminal network and money laundering activities. The police stated that the related criminal network involves transactions exceeding 500 million yuan (approximately 2.485 billion Thai baht).The suspect is accused of processing cryptocurrency and foreign exchange transactions for the criminal gang through more than 133 accounts and assisting members of the transnational criminal network in obtaining visas. The police indicated that the suspect had evaded capture by falsifying residence registration documents, changing license plates, and altering the appearance of vehicles, ultimately being apprehended in a luxury mansion in Bangkok. Thai authorities will handle his overstayed residence issue according to the law and coordinate his repatriation to China for investigation.

According to Hong Kong media HK01, Hong Kong BBB Group (Chinese name: Hao Hao Hao Group) claims to invest in the agarwood industry in Malaysia and sell over-the-counter stocks and digital assets, suspected to be a scam. The company states that it will convert OTC stocks into "digital asset" cryptocurrency by February 2027 or earlier.It is reported that the Hong Kong police have received reports from 21 individuals, involving an investment project amounting to 14 million Hong Kong dollars. The Commercial Crime Bureau is investigating for "conspiracy to defraud," and so far, four people have been arrested. Additionally, according to the Hong Kong Securities and Futures Commission's official website, "Malaysia Agarwood Plantation Investment, Agarwood Tree Program, Agarwood Potted Trees, APT4" have been listed as suspicious investment products.

According to CTV News, the Toronto police announced the arrest of 7 people in a violent kidnapping case targeting cryptocurrency holders and the subsequent investigation, including 3 members of the Canadian Armed Forces, with a total of 82 criminal charges filed.The police stated that the victim was kidnapped on July 25, handcuffed, and beaten, as the suspects attempted to obtain access to their cryptocurrency assets and corporate security systems, after which they were released. The investigation also seized firearms, drugs, and approximately 2,500 stolen military ammunition, and the case is still under investigation.

According to Bitcoin.com News citing Turkish media Sözcü, Richard Heart, the founder of HEX and the L1 public chain PulseChain, was detained by Turkey's National Intelligence Organization (MİT) in a joint operation with the police at a residence in Istanbul. The operation seized approximately 4 million dollars in cash, 53 Rolex watches, 11 Patek Philippe watches, firearms and ammunition, as well as a large amount of electronic equipment. His wife, A.K., was also detained.The U.S. SEC previously accused him of issuing unregistered securities through related projects, raising over 1 billion dollars, and allegedly misappropriating at least 12 million dollars to purchase luxury goods. The related lawsuit was dismissed in 2025 due to jurisdictional issues. In addition, Heart is wanted by Finnish authorities for serious tax evasion and assault cases.

According to Decrypt, the Federal Bureau of Investigation (FBI) arrested OpenAI engineer Abdulrahman Alfozan on October 9. The suspect, 35 years old and of Saudi nationality, has been employed at OpenAI since July 2025 and is accused of using or attempting to use devices to intercept oral communications. He made his first appearance in federal court this Tuesday. OpenAI stated that it has referred the matter to the FBI and thanked the relevant agents and prosecutors for their swift action, while the FBI's investigation is ongoing.OpenAI released a statement on X, stating that the company discovered a sophisticated recording device hidden in the office and used its own model to analyze the device and its origin, ultimately identifying that an employee placed it there a few days prior. According to the criminal complaint, the device was discovered around September 30, plugged into a USB port on the back of a television, wrapped in paper towels, with its contents encrypted, and was installed around September 28. Surveillance footage showed that Alfozan was seen near the conference room multiple times before the device was discovered, but he had neither the authority to enter that room nor to attend the related meetings, which typically involved confidential technical and strategic information.The complaint states that before the device was installed, Alfozan used internal productivity tools to inquire about OpenAI's office building address, conference rooms, room capacities, schedules, and locations of meetings between executives and external partners. A chatbot account associated with his spouse asked between September 24 and 30 how to create a continuous recording device, add Wi-Fi connectivity, enhance real-time listening capabilities, and encrypt the device's SD card.

The Federal Bureau of Investigation (FBI) reported that the losses associated with the scam center have reached 1.7 billion dollars. During the same period, law enforcement actions conducted in West Africa resulted in the arrest of 28 individuals.The Department of Justice (DOJ) stated that during a week-long coordinated law enforcement operation, law enforcement agencies removed over 3.7 million online accounts, pages, and groups, and identified over 11 million dollars in funds that could potentially be frozen.

On October 13, the U.S. Department of Justice announced the arrest of two Americans in an operation targeting North Korean IT personnel who entered U.S. companies under false identities, and the seizure of approximately 187 computer devices. Michael James Bostelle from Pennsylvania and Juan Cecilio Pena Carrillo from Texas were arrested based on an indictment from the Northern District of Ohio Federal Court. Prosecutors allege that the scheme involved over 70 U.S. employers, generating approximately $3 million in revenue for overseas IT personnel. The two are charged with conspiracy to commit wire and mail fraud, conspiracy to commit money laundering, and conspiracy to commit identity theft, with Pena additionally charged with aggravated identity theft.The device seizure operation is part of "Operation Lone Star," coordinated by federal law enforcement in the Northern District of Texas. From September 21 to 25, the FBI executed searches at over 40 suspected "laptop farm" residences in Texas, seizing devices including laptops and keyboards, video, and mouse equipment for remote access. According to the Ohio indictment, domestic accomplices received laptops issued by employers at home and then allowed overseas personnel to control them via remote access software or hardware, making it appear as if they were located in the U.S. and accessing company systems, while the accomplices received salaries and transferred funds overseas.The indictment mentions cryptocurrency as one of the means for transferring funds overseas. Trey Michael Nolte, a resident of Ohio, is listed as a co-conspirator but has not been charged in this case; the indictment states that in a conversation on July 8, 2024, he described managing transfers between bank accounts and virtual currencies using spreadsheets, subsequently transferring funds to the defendant Sun Sheng Ming;

According to reports from Japan's Jiji Press and TBS, Japanese police have arrested 6 individuals suspected of laundering money for a fraud group through cryptocurrency assets. Police investigations indicate that the gang is suspected of handling approximately 91 million yen (about 580,000 USD) in fraud funds between February and March 2024, involving around 30 victims.The funds first entered the company's bank account, then were exchanged for BTC, converted to USDT through overseas channels, and returned to the fraud group. The individuals involved are reportedly charging a commission of about 1%.

A 28-year-old core member of the globally renowned ransomware group Qilin has been arrested in Japan and was extradited to Germany on October 2. Reports indicate that the man is suspected of illegally infiltrating the systems of a logistics company in Germany in September 2024, encrypting data, and demanding a ransom of approximately $165,000 (about 26 million yen) in Bitcoin.Investigations show that he was responsible for building the attack systems within the Qilin criminal network and took a cut from the ransoms collected by various branch execution teams. Japanese police apprehended him while he was traveling to Osaka in late May this year, and he was subsequently handed over to German authorities after being deemed eligible by the Tokyo High Court. Qilin operates under a "ransomware as a service" (RaaS) model and previously claimed responsibility for a cyber attack on Japan's Asahi Group in 2025.

According to Decrypt, the European Union's law enforcement agency reported that Spanish police arrested a 16-year-old Romanian suspect in Alicante, suspected of being an administrator and main operator of the ransomware group KillSec.Two other suspects in their twenties were arrested in the UK and Romania, respectively; another developer who just turned 18 in August this year has been identified but has not been arrested due to some crimes occurring during their minor years.This operation, codenamed Operation KillSwitch, was led by the Hamburg State Criminal Police and the city's prosecution office, focusing on approximately 1,000 suspected attacks worldwide, with about 500 confirmed as successful intrusions.Law enforcement searched eight locations in Spain, Greece, Romania, and the UK, seized five central servers, and redirected related domain names to seizure announcement pages, while also confiscating at least 110 TB of stolen data.KillSec has been active since around 2024, exploiting software vulnerabilities and poorly secured cloud storage entry points to infiltrate corporate systems, copying internal data and naming victim organizations on dark web leak sites, threatening to publicly release documents to demand cryptocurrency ransoms, and if the target refuses to pay, they release the data for free.The Swiss Federal Police noted that the group also employed double extortion tactics, first encrypting servers and then applying pressure. U.S. prosecutors' charges indicate that a Dutch national residing in the UK, Fouad Eltibrizi (nicknamed Archduke), was indicted by a federal grand jury in Puerto Rico on September 16, subsequently arrested, and awaiting extradition, facing up to 10 years in prison. The European Cybercrime Centre, under the European Union Agency for Law Enforcement Cooperation, is assisting in tracing cryptocurrency funds and conducting digital forensics.

According to the Star newspaper, police in the central region of Perak, in collaboration with the National Energy Company (TNB), launched an operation in Seri Iskandar to dismantle an illegal cryptocurrency mining site and arrested two local men.The individuals involved are suspected of illegally connecting wires to power Bitcoin mining machines. Police seized 30 Bitcoin mining machines, routers, desktop switches, and a roll of wire at the scene. The case is being investigated under Section 427 of the Penal Code and Section 37(1) of the Electricity Supply Act 1990.Police emphasized that stealing electricity for mining is not only illegal but can also cause significant losses to the power company and pose a fire risk.

According to a report by Fabien Arnaud from the French media Midi Libre, a resident in Saint-Jean-de-Védas near Montpellier, France, was the victim of a home invasion and extortion related to cryptocurrency. The police acted quickly after the incident and have arrested three suspects.It is reported that the victim had previously encountered a similar violent extortion related to cryptocurrency on April 11 of this year.

According to the Dutch police (politie.nl), the police in eastern Netherlands arrested two men suspected of using counterfeit EURC cryptocurrency to purchase multiple Rolex watches on the second-hand platform Marktplaats. The victims discovered that the tokens they received were counterfeit and worthless after the payment was made.After the case was exposed on the television program "Plaats Delict," the police identified the suspects through viewer reports. The two men are a 24-year-old male from Geleen and a 45-year-old male from Leiden. During the search, firearms and drugs were found at the residence of the former, who has been detained for 14 days; the latter has been released but remains a suspect in the case. The police remind the public to be cautious with cryptocurrency payments and to avoid using unfamiliar payment methods.

The police of the United Arab Emirates and Sweden arrested 7 suspects involved in an international money laundering network. Investigators stated that tracking the cryptocurrency transactions of this network revealed its connections to organized crime and contract killings. According to the UAE News Agency citing the Ministry of Interior, the leader of the network is a Swedish citizen who had previously fled Sweden and was wanted by Interpol with a red notice, ultimately being captured in the UAE. Additionally, 6 other suspects were arrested simultaneously in Sweden, and all 7 have been charged.The Ministry of Interior stated that the network processed approximately 70 million Swedish kronor (about 7.1 million USD) in criminal cash proceeds over 10 months and transferred it to other criminal entities while using cryptocurrency to "transfer and move the value of these funds." Tracking cryptocurrency transactions and analyzing digital evidence helped investigators uncover the financial links between this network and other criminal activities, including organized crime and contract killings.Abdulaziz Al Ahmad, the Director of the Federal Criminal Police of the UAE Ministry of Interior, stated that the country will continue to track criminal networks and cut off their sources of funding. Anders Wiberg, head of the International Department of the Swedish Police, said that cooperation with the UAE was a key factor in the successful resolution of this case. Both countries launched simultaneous arrest operations after intelligence sharing and direct security coordination. Previously, Sweden had requested the police to increase efforts to seize illegal digital assets, as the issue of gangs using social media and encrypted applications to recruit paid killers has become increasingly serious.

According to Ledauphine, a violent kidnapping case related to cryptocurrency occurred in Taning, Haute-Savoie, France. Late at night on March 14 of this year, two masked men broke into the home of a 48-year-old woman, bound and beat her for several hours, and attempted to seize her cryptocurrency assets, subsequently trying to forcibly take her away. The victim was seriously injured but managed to escape using her survival instincts and sought help from a neighbor.The case is led by the Lyon inter-regional specialized judicial authority and is being investigated by the Chambéry gendarmerie search squad. After six months of in-depth investigation, police launched simultaneous operations in early September in the Île-de-France region, Isère, and Brittany, mobilizing over 60 gendarmes, successfully arresting five suspects in their early twenties, four of whom were formally charged, and three were detained pending trial. This case marks the third violent extortion incident targeting cryptocurrency holders in the Savoie region within a year.

According to Bloomberg, Belgian prosecutors stated on September 7 that a Chinese man, who also holds Belgian nationality, was arrested on May 10 at Brussels Airport while attempting to board a flight back to Beijing on suspicion of engaging in espionage activities against a Belgian semiconductor company. The investigation may point to the illegal transfer of specialized intellectual property and trade secrets related to gallium nitride chip production abroad.The investigation is related to the bankruptcy case of Belgan BV, which announced its bankruptcy in July 2024. Prosecutors indicated that there are signs suggesting that the man held a senior research position at the Belgian company while also serving as a director of a Chinese company engaged in similar manufacturing activities. This Chinese company was established a few months after he joined the Belgian company and was funded by a Chinese investment fund. This is the latest in a series of suspected espionage cases in Belgium.

According to Decrypt, the Gwangju Police Agency in South Korea arrested four Uzbek suspects in April under the Anti-Terrorism Financing Act and disclosed the case on Tuesday. One of them is listed on Interpol's Red Notice. The police stated that this is the first case involving cryptocurrency flowing out from a recognized terrorist organization and then being funneled back to fund physical goods.According to police investigations, from August 2024 to April 2025, the alleged mastermind transferred 4,267 USDT to the Syrian terrorist organization "Katibat Tawhid wal Jihad" (KTJ) in seven transactions. KTJ was established in 2014 and is mainly composed of Central Asian militants, recognized as a terrorist organization by the United Nations and the United States.Additionally, the mastermind is accused of receiving cryptocurrency from KTJ to purchase 11 used cars and 2 excavators, with a total value of approximately 170 million Korean won (about 121,000 USD), which were then shipped to Syria. The other three suspects are alleged to have assisted in the purchase and export of these vehicles.The police stated that previous terrorism-related cases mostly involved remittances to terrorist organizations, while this case is the first instance of receiving funds from a terrorist organization and reverse procuring and supplying vehicles.Investigations revealed that the mastermind rotated operations among three personal wallets, with the vehicle purchase funds deposited into an account under his spouse's name, and he presented someone else's driver's license when arrested. He entered South Korea in 2017 on a student visa, graduated from a university in Daejeon, and has been illegally residing since 2023. He denied the main charges during his first court hearing in June, claiming that the remittances were for family living expenses and that he did not know the identity of the vehicle purchasers. The police stated that the investigation also led to the capture of a second suspect listed on the Red Notice, and the case is still ongoing.