frozen

According to Salus monitoring, Tether has blacklisted 9 addresses related to the CoinDCX security incident and frozen 2,212,850.3 USDT.The investigation began when investigator Darcy discovered an unusual transfer of approximately 15.99 million USDT. CoinDCX co-founder Sumit Gupta initially claimed that no security breach had occurred. Subsequently, Salus raised questions based on the transfer situation of the "proof of reserves" addresses and the TRX distribution pattern, prompting the parties involved to respond and providing Tether with verifiable on-chain evidence, allowing it to take appropriate action.

According to CoinDesk, the U.S. Department of Justice announced that authorities in Ghana and Nigeria arrested 28 people in an enforcement action against a West African scam network, which involved cryptocurrency investment fraud.The UK's National Crime Agency (NCA) stated that the operation also uncovered 117 victims of human trafficking in Ghana, who are awaiting repatriation to Nigeria. Private sector partners identified over $11 million in funds that could be frozen.The operation, hosted by the NCA, brought together tech companies and law enforcement agencies, aiming to combat scam networks targeting citizens of the U.S., U.K., and other countries. The Department of Justice stated that this is the first joint operation focused on West Africa. Cryptocurrency exchanges Coinbase and Binance, as well as blockchain analysis companies Chainalysis, Elliptic, and TRM Labs, were all involved.Coinbase stated that it assisted in tracking illegal funds, supporting asset freezes, and providing intelligence to investigators, identifying over 65 active scam victims and preventing over $415,000 in potential losses. TRM Labs claimed it uncovered a large-scale peer-to-peer money laundering network. In the Sasaabi region of Ghana, authorities arrested 19 people and seized 303 electronic devices; Nigeria arrested another 9 people. Meta reported that it has deleted over 3.7 million Facebook and Instagram accounts, pages, and groups, most of which targeted Americans and Britons through impersonation tactics. Law enforcement also received leads on over 30 suspected scam centers.

According to Caixin, the asset investigation into the Prince Group of Cambodia, suspected of transnational online fraud and money laundering, is further unfolding in the UK. Following the freezing of multiple luxury properties in London belonging to the group's founder, Chen Zhi, and the individual identified as the "number two person," Hu Xiaowei, the 170 million yuan luxury property and luxury watches under the name of the group's financial officer, Li Tianming, have also been frozen by the UK.In October 2025, when the U.S. Department of the Treasury announced sanctions against the Prince Group and its affiliated individuals, Li Tianming was listed as a close associate of Chen Zhi, indicating that he effectively assumed the role of financial officer responsible for the illegal financial operations of the Prince Group, involving the management of illegal fund flows and large-scale cash smuggling.

According to Bitcoin.com, the LBTC exchange operation for the Bitcoin sidechain project Liquid Network has been suspended for 35 days. As of October 11, 2026, the project still maintains an 86% support rate; attackers previously exploited a vulnerability in the Elements software to steal nearly 4,000 bitcoins, of which approximately 3,400 have been returned, while the wallet still holds 598.5 bitcoins, valued at 49.69 million dollars.Blockstream rejected the attackers' request for a 10% bounty and demanded the immediate return of the remaining bitcoins. Liquid Network stated that an independent external security audit of Elements v23.3.4 is underway, and the Liquid Federation is synchronizing updates to the PAK list, placing all redemption keys in cold storage.There is currently no specific date for the resumption of redemption operations. Some LBTC holders are migrating funds through applications like Sideswap and Sideshift.ai, with one user stating that due to insufficient liquidity, the migration took several weeks, with a total spread and fees of about 5%.

According to MistTrack monitoring, Tether has frozen a large amount of USDT on certain addresses related to the Ledger user funds theft incident, which has resulted in losses nearing 90 million dollars. It is reported that some affected users have contacted MistTrack for assistance, and their team is following up. Previously, Ledger stated that it is investigating the theft incident involving user funds related to the Southeast Asian dealer CryptoBillis.

The Drift Foundation announced the progress of recovering funds from the security incident on April 1, where approximately $295.4 million in user assets were stolen. The foundation has hired Mandiant, zeroShadow, and SEAL 911 to conduct investigations and fund tracking, with Mandiant identifying the attackers as the North Korean threat organization UNC6862.The stolen funds were subsequently bridged to Ethereum, with approximately 130,259 ETH dispersed across four wallets. Of these, three wallets have not transferred any funds to date, holding a total of 107,165 ETH; the other wallet transferred about 23,094 ETH to Tornado Cash on July 23. The foundation stated that approximately $9.2 million of the stolen funds have been frozen, with the relevant funds previously transferred through Tornado Cash in August, but unfreezing and returning still require legal procedures.The Drift Foundation will transfer all assets recovered through freezing, bounties, or law enforcement to the DFX recovery pool and is assessing the subsequent path of the DRIFT token within the broader ecosystem. Additionally, the foundation has partnered with Bybit to launch a public bounty program, offering a 10% bounty for successfully recovered funds.

Cross-chain trading protocol NEAR Intents stated in a post on X that on September 24, Bitget was attacked, resulting in approximately $387.5 million in funds being stolen, most of which were aggregated into Ethereum and converted to ETH. The hacker attempted to transfer over $50 million through NEAR Intents, but ultimately only $166,000 was successfully transferred, while $503,000 was intercepted during the execution process.NEAR Intents indicated that the relevant data comes from on-chain tracking tools, Arkham, internal logs, and risk control layer SHIELD, among other sources. The figures listed are rounded estimates, with an assessment deviation of no more than 10%. SHIELD identified over $50 million in money laundering attempts and has filtered out duplicate flows, of which $166,000 has been successfully transferred, while another $503,000 was frozen midway through execution and remains restricted, pending legal and recovery procedures.NEAR Intents stated: permissionless does not equal neutral, the team refuses to assist in cashing out stolen assets and will forgo the bounty from this incident to allow Bitget to recover funds as much as possible. Bitget previously established a 5% + 5% bounty arrangement. NEAR Intents also mentioned that the protocol will remain permissionless but set boundaries, and will combat money laundering of stolen funds, while suggesting Bitget contact legal and law enforcement channels to handle the frozen funds.

According to on-chain data, Tether has successfully frozen 218,000 USDT in the stolen address from Bitget, which is a "three-hop" associated address of the initial stolen address from Bitget. This address remained inactive for over 2.5 hours after being discovered.Crypto KOL tanuki42 initiated a tracking of "Circle vs Tether" at that time and asked which of the two companies would freeze the related assets first.Currently, Circle has frozen the related stolen assets 7 hours and 18 minutes earlier than Tether.

Echo Base is an institution focused on stabilizing digital asset companies, assisting in the formation of the BitMart Creditors' Committee, representing users holding frozen assets, and hiring legal advisors to evaluate recovery plans, including applying for bankruptcy proceedings without financial support. Echo Base had proposed a funding plan of up to $10 million to support BitMart in submitting a pre-negotiated bankruptcy application, but received no response from BitMart.Echo Base stated that the relevant actions stem from BitMart's failure to respond to the restructuring proposal and user withdrawal requests. Sonn Law Group has initiated an investigation for users with frozen assets of $500,000 or more at BitMart, assessing potential claims and asset recovery plans. Echo Base CEO Roshan Dharia stated that BitMart's employee plan can only sustain operations until January 2027, and the longer the delay, the fewer viable options there will be.

According to Bitcoin News, the Bitcoin mining pool OCEAN has officially stopped supporting the BIP-110 fork chain, citing limited mining activity and the transition to the Blake2b proof-of-work mechanism. OCEAN stated that it will not adopt or support the BIP-110 hard fork and will not continue to pay BIP-110 block rewards.The BIP-110 chain stalled after the user-activated soft fork attempt failed on August 8, and the mining rewards post-fork became unusable due to not reaching 100 confirmations. OCEAN stated that these rewards have been permanently frozen at BIP-110 block 961,639. Miners hoping to continue supporting BIP-110 have been directed to CONVOY Mining, which plans to support the Blake2b hard fork and continue the BIP-110 share record.

According to BeInCrypto, the digital campaign of Brazil's "pro-Bitcoin" presidential candidate Renan Santos has been suspended, with 3.3 million reais (approximately 600,000 USD) of public campaign funds frozen and 16 campaign social media accounts restricted.Weeks before this ruling, Santos had just supported the establishment of a national Bitcoin reserve. His candidacy has not been revoked, but his online reach and funding have been severely impacted.

On August 20, MANTRA Chain released a complete review report of the security incident, confirming that the attacker exploited an unsigned integer underflow vulnerability in the balance accounting layer of the upstream dependency cosmos/evm, unauthorizedly transferring a total of 720,923,967.99 MANTRA from two addresses, valued at approximately 3.6 million dollars based on the price before the attack. Among them, the attacker transferred 600,000,035.56 MANTRA from the on-chain burn address and 120,923,932.44 MANTRA from a genesis-era multi-signature address related to an early incentive program.MANTRA stated that this incident did not involve the leakage of validator keys, administrator privileges, governance control, or multi-signature signers; the attacker did not require privileged access and could complete the attack solely through unauthorized contract deployment and self-funded wallets. The first abnormal transfer occurred at 19:06 UTC on August 20, when the attacker transferred approximately 600 million MANTRA from the burn address; subsequently, at 22:59 UTC, another transfer of approximately 120.9 million MANTRA was made. The chain subsequently stopped operating at 23:13 UTC and resumed after upgrading to v8.4.0. The entire network interruption lasted for 30 hours and 13 minutes.This vulnerability was not an issue with MANTRA's self-developed code but originated from the cosmos/evm module, which is responsible for providing EVM functionality on the Cosmos SDK. The vulnerability allowed the attacker to execute unsigned balance deductions without checking if the balance was sufficient, causing an overflow of values and bypassing normal account authorization logic. MANTRA stated that as of today, no funds have been recovered, with approximately 37.96 million MANTRA (accounting for 5.27% of the total transferred) still remaining in the attacker's address, which has been frozen due to the chain's suspension and v8.4.0 restrictions. The remaining funds have flowed to related trading platforms, and the recovery efforts have entered the law enforcement investigation stage. In the future, monitoring of accounts that cannot normally authorize transfers, burn addresses, and other historically "non-transferable" addresses will be strengthened, and efforts will be made to promote improvements in the security vulnerability disclosure process within the Cosmos ecosystem.

MANTRA Chain tweeted that it has noticed events affecting MANTRA Chain and has temporarily suspended the operation of the chain as a precautionary measure while conducting an investigation. Currently, all endpoints and transactions have been frozen.This means that deposits to MANTRA Chain and withdrawals from the chain are temporarily affected. If users are unsure of the specific impact on a particular transaction, it is recommended to pause operations and wait for further notice. The team stated that there is currently no fundamental cause or recovery timeline to announce and will update as soon as verified information is obtained through official channels, reminding users to rely only on official MANTRA channels for updates.

According to KOL Kuai Dong (@_FORAB), several cryptocurrency practitioners reported this morning that their addresses on other exchanges inexplicably received small deposits from HTX exchange, and shortly after receiving them, their accounts were frozen. Previously, several exchanges, including Binance and OKX, announced that in response to sanctions from the EU and the UK, they would no longer process deposits and withdrawals from HTX, otherwise accounts could be forcibly frozen. Some users in the community claimed that this action is similar to "address poisoning," which could trigger KYT/AML risk control on other platforms.However, HTX market manager MollyFu stated that the official side absolutely did not engage in such behavior; it is either a misunderstanding or someone is deliberately causing trouble. The platform has been processing tens of thousands of deposits and withdrawals daily in the past two days, and accounts are normal. They will not randomly airdrop to users on other platforms; if testing is conducted, it will only be done on a small scale through their own accounts. HTX stated that they have held an internal meeting to discuss the matter and are quickly investigating the cause, promising to provide an explanation to the community.

According to Livecoins, the Joint Task Force Against Organized Crime in Rondônia, Brazil (FICCO/RO) executed arrest and search warrants against a gang suspected of electronic fraud and money laundering. The criminal organization is accused of using cryptocurrency exchanges to hide illegal funds transferred from the original victims' accounts.A case investigated in 2025 resulted in losses of approximately $5.74 million. The court has issued 8 preventive arrest warrants and 18 search warrants, and authorized the freezing of related assets such as cryptocurrency exchange and bank accounts. In addition to targeting securities accounts, the law also mandates the seizure of vehicles and boats belonging to the individuals under investigation.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

On-chain yield platform Altura announced that it originally planned to purchase USDT using fiat funds from its Altura bank account through over-the-counter trading partners, but the bank account holding the relevant funds has been temporarily frozen by the bank. Screenshots show that the frozen amount is approximately £16.446 million, about $21.88 million, and this plan has therefore been hindered.Altura stated that it has communicated with the bank regarding this matter, and the bank has requested that it wait for the review to be completed, stating that it will contact them separately if additional materials are needed. The current situation is completely beyond Altura's control, and they must wait for further responses from the bank. Altura also announced that due to limited team resources, it will suspend community chat functions to focus on addressing the current issues, and it promises that subsequent developments will be promptly communicated through its official X account, Telegram channel, and Discord, while urging the community to avoid speculation until official confirmation is received.

According to Jinshi reports, U.S. Treasury Secretary Basant stated that $130 million in cryptocurrency wallets related to the Iranian Islamic Revolutionary Guard Corps has been frozen.

Token Pocket's Chief Business Officer Michael stated that the mnemonic phrase of the Robinhood founder was leaked during a live broadcast. After hackers gained control of the address, they used that address and associated addresses to buy a large amount of the Meme coin at $1, prompting thousands of investors to follow suit, rapidly increasing the market value of the token from about $500,000 to $14 million in a short period.Subsequently, the price of the $1 token fell sharply, with a trading volume of about $20 million within just two hours. After the related addresses were frozen, the hackers quickly moved to the BNB Chain (BSC), using that address and its associated addresses to issue new tokens, and created trading hype through self-buying and selling, ultimately executing a sell-off to cash out. Robinhood's RPC has frozen that address, and nodes do not allow transactions sent from that address to be packaged, so transfers and trades cannot be conducted.