cybercrime

According to Fortune, the San Francisco-based cryptocurrency crime tracking company TRM Labs completed a $70 million Series C funding round in September 2025, achieving a valuation of $1 billion. Just six months later, it received additional investment from existing investors, doubling its valuation to $2 billion.CEO Esteban Castano stated that the company's mission has expanded from blockchain forensics to a broader mapping of cybercrime, with AI becoming a second growth engine rather than a transformation, while the core cryptocurrency business remains strong. The company is set to launch a new investigation platform specifically targeting AI-driven deepfake scams, extortion related to pornography, and child sexual abuse crimes.Castano noted that the widespread adoption of cryptocurrency has made it possible to comprehensively map crime networks, and the company is expected to reach a $100 million annual recurring revenue milestone in the coming weeks. Currently, it has about 500 employees and has offices in London, Singapore, and Washington.

U.S. Attorney General Todd Blanche posted on the X platform that this week cybercriminals launched password recovery attacks against hundreds of thousands of X users. The X platform successfully thwarted this attack to prevent user accounts from being hijacked, and the Department of Justice is working closely with X to track down the attackers.

According to a report by the Korea United News Agency, the Gwangju Police Agency's Cyber Crime Investigation Team will arrest and transfer three suspects led by A (in their 60s), who are suspected of establishing offices in Seoul, Gwangju in South Jeolla Province, and Gunsan in North Jeolla Province since November 2024. They allegedly deceived over 100 elderly individuals aged 70 to 80 into investing in virtual assets with false promises such as "guaranteed principal" and "potential profits of hundreds of billions of Korean won," accumulating approximately 500 million Korean won in fraud.The police stated that there are likely still unreported victims and are continuing to expand the investigation, reminding the public to remain vigilant against investment offers that promise guaranteed principal and high returns.

The Federal Bureau of Investigation (FBI) disclosed that in 2025, the reported losses from cybercrime by the American public approached $21 billion, with 181,565 complaints involving cryptocurrency, totaling losses of over $11 billion.New York Attorney General Letitia James testified before Congress on July 27, stating that the CLARITY Act aims to transfer primary regulatory authority over digital assets to the Commodity Futures Trading Commission (CFTC), which could potentially weaken the ability of states to investigate fraud and hold cryptocurrency companies accountable. James urged cryptocurrency platforms to comply with anti-money laundering, know your customer, cybersecurity, and market monitoring requirements, and to take financial responsibility for preventable fraud. Her office has received nearly three times the number of cryptocurrency fraud complaints in the past three years, with related losses approaching $500 million over the past five years.

According to Financefeeds, the U.S. Department of Justice has announced criminal charges against 19-year-old dual citizen Peter Stokes, who is accused of being a member of the cybercrime organization "Scattered Spider," and has been extradited from Finland to the United States.

According to Bitcoin.com, the European Cybercrime Centre recently led a joint operation codenamed "Endgame," which was the result of collaboration among law enforcement agencies from Canada, Denmark, Germany, the Netherlands, and the United States.These agencies jointly targeted the network infrastructure that provided services to criminals, utilizing three key types of "cybercrime-as-a-service" (CaaS) malware: SocGholish, Amadey, and StealC, to collect victims' information and sensitive data.Law enforcement agencies took action against a total of 326 servers and 142 domain names, seizing illegal cryptocurrency worth approximately $47 million and recovering over 27 million stolen credentials.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.

According to CryptoSlate, the U.S. Congress is pushing to rebuild the Department of Justice's cryptocurrency crime task force. Previously, the Department of Justice disbanded the National Cryptocurrency Enforcement Team in April 2025 and stopped its "law enforcement as regulation" strategy targeting the cryptocurrency industry. The new bill was proposed by Representatives Lance Gooden and Josh Gottheimer, aiming to establish a federal cryptocurrency theft task force within the Department of Justice, responsible for coordinating investigations and prosecutions of cases involving cryptocurrency theft, hacking, fraud, and more.The task force's responsibilities include developing best practices for evidence collection, digital evidence analysis, asset tracking, and victim outreach, providing technical assistance and training to state and local law enforcement agencies, and coordinating international cross-border case cooperation. The bill explicitly excludes the cryptocurrency market, financial institutions, and financial products from the task force's regulatory scope, without changing the existing regulatory framework and criminal law. An FBI report indicates that in 2025, there were 181,565 complaints involving cryptocurrency, with reported losses exceeding $11 billion. The bill has not yet clarified details regarding funding, staffing, and victim response mechanisms.

The National Police of Ukraine and the Internal Security Department conducted a joint operation, arresting a suspect in the Transcarpathian region who is alleged to be involved in an international cybercrime gang. This gang is implicated in fraud and money laundering cases exceeding $100 million targeting the United States and Europe, and had previously been listed as an international wanted person by the FBI.The suspect was found in possession of forged identity documents and had even fabricated a death certificate to conceal their whereabouts. The gang deployed malware to steal personal and corporate data, subsequently extorting victims for ransom. Money laundering methods included purchasing real estate and using relatives' names to obscure the flow of funds. Authorities seized approximately $11 million in assets, including cash, real estate, vehicles, and about $3 million worth of cryptocurrency, and also apprehended two co-defendants. The suspect faces charges of document forgery and money laundering.

A 27-year-old German hacker, Noah Christopher, was arrested in Bangkok, Thailand, facing up to 74 arrest warrants for cyber crimes in Europe.Investigations show that this individual is suspected of developing and operating a ransomware platform and a "cybercrime-as-a-service" (CaaS) system between 2021 and 2025, including providing distributed denial-of-service (DDoS) attack tools (such as Fluxstress and Neldowner), assisting global clients in launching cyber attacks and charging fees, with related ransom payments involving cryptocurrencies and other digital assets, constituting transnational cybercrime activities. His visa has been revoked, and he is currently detained awaiting extradition to Germany.

According to DL News, the Ertzaintza police in Spain's Basque Country stated that cryptocurrency-related crimes in the region are on the rise, with a total of 541 related cases investigated in 2025, which are still under investigation.The police have been equipped with specialized tools to monitor cryptocurrency transactions across multiple blockchain networks and have formed a cybercrime department consisting of 26 detectives dedicated to combating crimes such as crypto fraud and hacking. The cases under investigation include 13 suspected cases of crypto fraud, 2 suspected cases of crypto money laundering, as well as tax evasion and illegal purchases of goods and services.The police warned that scammers impersonate friends and family on social media platforms like Instagram to provide investment advice, tricking victims into installing applications that allow remote control, thereby stealing cryptocurrency wallets and bank accounts.

According to Cointelegraph, the FBI, Europol, and law enforcement agencies from 14 countries conducted a joint operation on March 3-4, successfully shutting down the cybercrime forum LeakBase. The forum had over 142,000 members and served as a platform for hackers to buy and sell stolen data and cybercrime tools.Law enforcement has seized user accounts, posts, credit details, private information, and IP logs as evidence, and executed search warrants and arrests in multiple countries. Notably, LeakBase's predecessor, Raidforums, was shut down in 2022 and had hosted leaked data containing personal information of approximately 272,000 users of the cryptocurrency wallet company Ledger. In recent years, data breaches in the cryptocurrency industry have continued to rise, including security incidents such as the hacking of Coinbase's internal systems.

The Ministry of Public Security has announced that it has drafted the "Cyber Crime Prevention Law (Draft for Comments)" and is now publicly soliciting opinions from society, with the deadline for feedback set for March 2, 2026. The content includes: no individual or organization shall knowingly harbor, transfer, acquire, sell on behalf of others, or conceal or disguise funds, data, or virtual property obtained from others' online illegal activities.No individual or organization shall knowingly use funds obtained from others' illegal activities to provide capital flow services using virtual currency or other online virtual property for others.

According to China News Service, Hong Kong hosted the annual meeting of the International Criminal Police Organization's Cybercrime Expert Group for the first time. The meeting covered various topics including online extortion, artificial intelligence, and virtual asset tracking. Chief Superintendent Chow Man-ming of the Hong Kong Police Force noted the emerging trends in crimes related to virtual assets and established a virtual asset intelligence task force last year as a public-private partnership to jointly address technological challenges.The Hong Kong police have also developed a virtual asset tracking system that visualizes the virtual asset investigation process and fully supports investigators.

On Monday night, three masked men broke into a residence in Manosque, France, threatening a woman with a gun and stealing a USB drive containing her partner's cryptocurrency data. According to the French newspaper Le Parisien, the incident occurred at a home on Cherry Path in the Alpes-de-Haute-Provence region.The attackers threatened the victim with a handgun and slapped her before fleeing the scene with the USB drive. It is reported that the victim was unharmed and managed to escape and call the police within minutes. Local police have opened an investigation, and the case has been handed over to the local criminal investigation department and the national police regional headquarters. Last year, security company Casa's Chief Technology Officer Jameson Lopp recorded over 70 violent attacks related to cryptocurrency in its public database, with France becoming a hotspot for such violent crimes in Europe, with more than 14 related cases.Cybercrime consultant David Sehyeon told Decrypt, "The baseline level of criminal activity in France is relatively high, and the cryptocurrency wealth held by entrepreneurs, traders, and public figures is quite visible. Coupled with the growth of local expertise in digital assets, these factors together create a breeding ground for more speculative and organized cryptocurrency-related crime."

Indian police have arrested a former Coinbase customer service representative in Hyderabad, who is suspected of being involved in the insider data breach incident disclosed by Coinbase in May of this year. This is the first known arrest in the case, confirmed by Coinbase CEO Brian Armstrong.The incident dates back to December 2024, and investigations show that cybercriminals obtained access to internal systems by bribing overseas customer service personnel, stealing sensitive information from 69,461 users, including names, addresses, phone numbers, emails, and government-issued identification documents. Coinbase stated that the attackers attempted to extort $20 million, which the company refused to pay, instead establishing a reward program of the same amount to track down and apprehend those involved.In its Q2 financial report, Coinbase disclosed that the incident has resulted in $307 million in related expenses, covering user compensation, legal fees, and security upgrade costs. Additionally, Coinbase is currently facing a class-action lawsuit from shareholders, alleging that it failed to disclose the incident in a timely manner, misleading investors. Coinbase stated that it will continue to cooperate with international law enforcement agencies in the investigation, suggesting that further arrests may follow.

Recently, according to market news, analyst Emmett Gallic monitored that Aleksey Bilyuchenko, who has been accused by the U.S. Department of Justice of being a Mt. Gox hacker, has deposited 1,300 BTC (worth approximately $114 million) into an unknown trading platform in the past 7 days. This series of addresses still holds 4,100 BTC (worth $360 million). They have sold a total of 2,300 BTC.Public information shows that Aleksey Bilyuchenko has been operating BTC-e, a notorious trading platform, with Alexander Vinnik since 2011, which has been accused of laundering money for global cybercriminals, including ransomware, identity theft, and drug trafficking.BTC-e was shut down by law enforcement in 2017. The U.S. Department of Justice has accused him of hacking Mt. Gox (then the world's largest Bitcoin exchange) with Aleksandr Verner since 2011, stealing approximately 647,000 bitcoins (leading to the bankruptcy of Mt. Gox). They have been charged with conspiracy to launder money and using part of the proceeds to operate BTC-e.

According to market news, the U.S. Department of Justice revealed that the Federal Bureau of Investigation (FBI) has teamed up with European law enforcement agencies to dismantle a multinational money laundering platform that primarily provided cryptocurrency cash-out services to cybercriminals. The platform, named E-Note, was operated by a Russian citizen and has handled over $70 million in illegal funds since 2017, including assets extorted or stolen from victims in the United States.The U.S. Attorney's Office for the Eastern District of Michigan announced the indictment of 39-year-old Russian citizen Mykhalio Petrovich Chudnovets, charging him with conspiracy to commit money laundering. It is alleged that since 2010, the suspect has assisted cybercrime groups in transferring criminal proceeds across borders and converting cryptocurrency into cash through the E-Note payment processing service he controlled. Law enforcement agencies have seized his servers, mobile applications, and related domain names. If convicted, he faces a maximum of 20 years in prison.

The European Union (EU) law enforcement agency Europol announced on Monday that a coordinated law enforcement operation conducted in Zurich has successfully dismantled the cryptocurrency mixing service Cryptomixer, which was allegedly used by cybercriminals to launder illegal bitcoins.The operation was jointly carried out by the Swiss and German police in collaboration with Europol, resulting in the seizure of three servers, the domain name Cryptomixer.io, bitcoins worth over 25 million euros (approximately 29 million dollars), and more than 12 terabytes of data. Officials stated that since 2016, Cryptomixer has assisted in laundering over 1.3 billion euros worth of bitcoins. Its longer settlement window and random fund distribution patterns made it an ideal tool for concealing criminal proceeds.