investigation

In response to the abnormal volatility in the SK hynix perpetual contract market, Hyperliquid stated that the platform is an unlicensed blockchain, and the HIP-3 market can be independently deployed and operated by different teams. The xyz:SKHYNIX perpetual contract is deployed and operated by the Trade.xyz team, which is currently investigating the incident and will announce progress after reaching a conclusion.Hyperliquid also explained that HIP-3 deployers can independently push the market's mark price, oracle price, and external perpetual price inputs. If a pricing mechanism similar to that used by platform validators for operating perpetual contracts is adopted, the protocol only provides one of the three median components, namely the on-chain latest transaction price, the best buy price, and the best sell price median, while the other two components are provided by the deployer, who jointly determines the final mark price.

It has been reported that the mayoral candidate of Incheon, South Korea, is accused of falsely reporting assets, suspected of failing to declare the spouse's cryptocurrency assets.

According to Bitcoin.com, the U.S. Attorney's Office for the District of Columbia and the U.S. Secret Service Washington Field Office announced that a cyber fraud task force has seized over $25 million in cryptocurrency as part of multiple investigations related to international fraud schemes targeting residents of the United States and Canada. The U.S. Attorney for the District of Columbia has filed five civil forfeiture complaints seeking the forfeiture of the recovered cryptocurrency.Investigators have confirmed multiple money laundering networks and thousands of victims globally, with the largest complaint involving a romance scam affecting over 200 victims, totaling approximately $12.1 million. Another complaint involves a network of suspicious cryptocurrency wallets reported by Canadian authorities to the U.S. Secret Service, amounting to about $10.4 million.Agents tracked over 270 suspected victim transactions related to fraudulent investment platforms, with these two cases accounting for approximately 85% of the assets involved in the five forfeiture complaints. The remaining cases involve blocked withdrawals, fake investment accounts, and recovery of fraud. Investigators stated that most suspected money launderers are located in Southeast Asia and identified internet protocol addresses associated with China, Malaysia, and Cambodia; the five investigations are still ongoing.

Fang Xinghai, former member of the Party Committee and Vice Chairman of the China Securities Regulatory Commission, is suspected of serious violations of discipline and law, and is currently undergoing disciplinary review and supervisory investigation by the Central Commission for Discipline Inspection and the National Supervisory Commission.

According to Dawn, the Federal Investigation Agency (FIA) of Pakistan has established a virtual currency investigation department within the newly launched National Command and Control Center (NC3), focusing on combating money laundering and terrorist financing using virtual assets.Officials responsible for the counter-terrorism department stated that this department will work in conjunction with the newly established Pakistan Virtual Assets Regulatory Authority (PVARA) to specifically investigate criminal activities related to crypto assets, and recommend that the National Cyber Crime Investigation Agency (NCCIA) and the Anti-Narcotics Force (ANF) set up similar units to address the use of crypto assets in cybercrime and drug trafficking.The FIA has also integrated functions such as anti-money laundering, border entry and exit monitoring, human trafficking, and smuggling investigations within the NC3, and is promoting new regulations and personnel expansion to shorten case processing times and enhance law enforcement coordination efficiency.

According to News.bitcoin, the Kenyan government is investigating the hacking incident of President William Ruto's official website, where attackers briefly disabled the site and altered the homepage content, demanding a ransom of 5 Bitcoins.William Kabogo, the Cabinet Secretary for the Ministry of Information, Communication and the Digital Economy, stated that the Kenyan law enforcement agency ICT Authority immediately activated the cybersecurity response protocol to control the incident and conduct forensic investigations, temporarily restricting public access to the portal. Currently, there is no evidence that sensitive data has been accessed without authorization, leaked, or lost, and government systems and digital services remain securely operational.

According to Darcy, co-founder of FlashRescue, approximately $22 million in illicit funds flowed into the cryptocurrency exchange HitBTC in 2026. He pointed out that during two instances of cooperating with police investigations, HitBTC refused to assist in the verification process, and multiple on-chain investigators reported that this is a consistent practice of the platform.He mentioned that in the Bybit theft case, as much as $3.68 million from a money laundering network linked to the DPRK (North Korea) flowed into HitBTC, but the platform also did not cooperate with relevant authorities for further investigation.

Summer.fi officially announced that it has suffered an attack and has suspended all vaults under the Lazy Summer Protocol. An investigation into the root cause is currently underway, and updates will be provided continuously.

According to informed sources, U.S. regulators are investigating allegations made by Susquehanna International Group. The allegations claim that unknown insider traders profited $100 million through options bets before recent regulatory crackdowns on cross-border brokers Futu and Tiger Brokers in China. Susquehanna publicly disclosed these allegations in a lawsuit filed on June 29 in Manhattan federal court. Sources indicate that the U.S. SEC is reviewing the trades described in the market maker's complaint.Susquehanna claims in the lawsuit that it lost over $70 million as the counterparty to most of the alleged insider trading. The lawsuit states that traders purchased U.S. exchange-traded options from Chinese securities firms, which subsequently became targets of the regulatory crackdown on May 22. The scope and stage of the SEC investigation remain unclear. A U.S. judge approved Susquehanna's request to freeze related accounts on June 29. The Chinese government stated that Futu and Tiger Brokers provided unlicensed trading services to mainland residents. Following the announcement on May 22, the stock prices of both companies fell. Futu was fined 1.85 billion yuan in regulatory penalties, and founder Leaf Li's wealth decreased by $1.7 billion in a single day.

According to BBX data, the prediction market faced a dual attack yesterday, with traditional exchange infrastructure accelerating its on-chain transition. The core dynamics are as follows:The prediction market/event contract ecosystem where Robinhood Markets, Inc. (NASDAQ: $HOOD) operates suffered a dual regulatory blow yesterday: first, the U.S. Commodity Futures Trading Commission (CFTC) has launched a comprehensive investigation into Polymarket (privately held), covering its social media activities and suspected wash trading behaviors; second, a Michigan court ruled to prohibit Kalshi (privately held) from offering sports betting services to residents in Michigan. Although these two incidents directly target Polymarket and Kalshi, their strategic importance to Robinhood cannot be ignored—Robinhood provides event contract products linked to KalshiEx LLC or ForecastEx LLC through its subsidiary Robinhood Derivatives LLC, making it the largest distribution channel for prediction markets among regulated brokers in the U.S. The CFTC's escalation of enforcement investigations into similar platforms will directly impact Robinhood's event contract business compliance framework and product expansion speed; in June, the average daily trading volume in this sector reached a historic record.Nasdaq, Inc. (NASDAQ: $NDAQ) announced yesterday that it has chosen Pyth Network (on-chain price oracle protocol) as its on-chain distribution partner for TotalView (Nasdaq's full market depth data product), marking the first time Nasdaq has integrated its core institutional-level market data into a blockchain network—TotalView provides full-level buy and sell quotes and transaction data for the U.S. stock market, historically only available to traditional financial institutions (subscription-based); on-chain distribution means that DeFi protocols, decentralized exchanges, and smart contracts can now access Nasdaq-level real-time equity market data as an on-chain pricing basis for the first time. The Pyth Network token (PYTH) subsequently rose by over 6%, with the market interpreting this as a historic fusion point between traditional securities market infrastructure and decentralized finance.

According to the official report, the Dutch Public Prosecution Service (OM) has applied to the Rotterdam court to declare the cryptocurrency trading platform Knaken Cryptohandel B.V. and its subsidiary Stichting Knaken Payments bankrupt.OM stated that the Dutch Authority for the Financial Markets (AFM) had previously warned that the platform was illegally providing exchange and custody services for crypto assets without the necessary licenses. Although the platform claims to have ceased operations and is undergoing liquidation, it has currently completely stopped making payments to customers. OM is concerned that its liquidation process lacks order and may harm investors' interests, thus applying for bankruptcy, aiming to appoint a liquidator to take over and safeguard creditors' funds.In addition, based on the report from AFM, the Dutch Financial Intelligence and Investigation Service (FIOD) has launched a parallel investigation into the alleged criminal activities of the platform. Law enforcement executed multiple searches on June 29, seizing relevant digital storage devices and freezing some of the company's assets, with no arrests made so far.

According to Bloomberg, the Commodity Futures Trading Commission (CFTC) is conducting a broad investigation into the prediction market platform Polymarket, covering its business activities including social media operations.Previously, The Wall Street Journal reported that Polymarket hired dozens of social media creators, primarily of college age, to create fake trading videos to attract users. This investigation encompasses other aspects of the company's business. The CFTC and the Department of Justice concluded an investigation last year into whether Polymarket violated the ban on U.S. users, but some U.S. users still access its main platform by circumventing the ban through VPNs and other means.Since reaching a settlement with the CFTC in 2022, Polymarket has technically prohibited U.S. users from using its main platform, but the company is taking steps to reintroduce its main exchange to the U.S. and is cooperating with the CFTC to lift the ban. Senators Adam Schiff and John Curtis sent a letter to the CFTC last Thursday, requesting confirmation of whether an investigation into Polymarket's advertising practices is ongoing and inquiring how the agency has prevented Polymarket from attracting U.S. users since the 2022 action.

According to the Wall Street Journal, several U.S. lawmakers are calling for an investigation into the prediction market platform Polymarket, as its advertising is alleged to potentially contain misleading content.It is reported that the lawmakers believe Polymarket may not clearly disclose the nature of its products and associated risks in its marketing, which could mislead users. Some legislators have requested regulatory agencies to intervene and assess the compliance of its advertising and information disclosure standards.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.

The National Association of Attorneys General, the National Association of Assistant U.S. Attorneys, the International Association of Chiefs of Police, and the National Sheriffs' Association jointly sent a letter to the Department of Justice and the White House on Tuesday, warning that Section 604 of the Digital Asset Market Structure Clarity Act contains serious enforcement loopholes that could make it difficult for law enforcement agencies to investigate and prosecute crypto-related criminal activities. The letter pointed out that Section 604 includes broad exemption clauses that may allow individuals or entities assisting in the circulation of crypto assets to evade regulatory accountability, disrupting the investigative and enforcement powers that have long been relied upon.The four organizations emphasized that their concerns are not aimed at developers who simply write or publish software code, but rather at the broad exemptions that may provide a shield for illegal activities. The core of the controversy lies in Section 604—the "Blockchain Regulatory Clarity Act" (BRCA) provision, which was originally a standalone bill but was later incorporated into the Clarity Act, aimed at providing a safe harbor for non-custodial developers, clarifying that they do not fall under money transmission entities. Law enforcement organizations believe this move will create obstacles for investigations into crypto crimes.Additionally, the letter pointed out that several other provisions of the bill would "reduce transparency, weaken accountability mechanisms, and create loopholes in the anti-money laundering framework." On the same day, nearly a hundred Catholic leaders representing parishes across the country also issued a warning, stating that the bill could weaken protections against human trafficking. In response, White House cryptocurrency advisor Patrick Harker insisted that the Clarity Act is a bill that "supports regulation and supports law enforcement," emphasizing that the U.S. must proactively set standards or risk passively accepting the rules of other countries.

Democratic senators in the United States are urging an investigation into the Trump family's alleged $500 million cryptocurrency deal with the Abu Dhabi royal family.

According to Decrypt, the Thai Special Investigations Department (DSI) has expanded its investigation into the "gray Chinese capital" network. This network is suspected of using illegal cryptocurrency mining to launder money from phone scams and online gambling, with an annual amount involved exceeding 30 billion Thai Baht (approximately 300 million USD). Currently, authorities have seized 6,390 mining machines, with illegal electricity theft losses reaching 953 million Thai Baht (approximately 29 million USD), and arrest warrants have been issued for 4 Chinese financiers and 4 Myanmar nationals.The U.S. Secret Service has seized over 17.8 million USD in cryptocurrency assets related to key suspect Wang Yicheng, who is alleged to be connected to "pig butchering" scam operations. Additionally, the investigation also involves several officials from Thai electricity agencies and law enforcement personnel, and the case has been handed over to the National Anti-Corruption Commission for handling.

The privacy public chain Namada officially announced a vulnerability incident. The team is currently investigating the related issues and has contacted relevant parties for collaborative handling. If the operator behind this attack is a white hat hacker, we hope they will proactively contact the team to further understand the vulnerability situation and promote problem resolution.On-chain data shows that some ATOM assets related to the incident are suspected to have been transferred out to a Cosmos Hub network address via IBC (Inter-Blockchain Communication protocol). Approximately 228,517 ATOM funds related to that address were subsequently cleared within a few hours through IBC transfers and multiple withdrawal operations. Currently, that address has only a small remaining balance.

According to CriptoNoticias, Chilean judicial authorities have launched an investigation into the cryptocurrency platform Plusspay, accusing it of providing a money laundering channel for the multinational criminal organization Aragua Train.The investigation shows that the platform may have exchanged local fiat currency for Tether, USD stablecoins, and other stablecoins through multiple affiliated companies, and used the Chilean banking system to transfer funds, with the scale of related suspicious fund flows exceeding 84 million dollars.

Regarding the suspected attack on the Aztec Router contract on the Ethereum chain, Aztec Labs has officially launched an investigation and clarified that Aztec Connect was deprecated three years ago. Aztec Labs does not hold any administrator keys or control over the system, and currently cannot pause or upgrade it. Therefore, the community is reminded to be vigilant against false "support" accounts and private messages.