suspect

According to Reuters, Mexican authorities discovered an illegal cryptocurrency mining operation in a remote mountainous building in Tehuacán, Puebla, where 300 GPUs, 80 medium-voltage terminals, and 8 satellite antennas were found on-site. Authorities are investigating whether the operation is stealing electricity from a nearby hydroelectric power station.This is the fourth similar crypto farm discovered in the area since early last year, with three others found near a hydroelectric power station in northern Puebla last year. Local residents reported that the noise from the equipment can be heard from a kilometer away. Mexican security analyst David Saucedo stated that drug trafficking groups seem to have reached a new level of sophistication, as establishing such operations requires technical expertise and support from well-funded groups.Chainalysis Latin America expert Caio Motta pointed out that such operations are usually located in areas with extremely low electricity prices or within the reach of organized crime to steal electricity and establish large-scale mining infrastructure.

According to on-chain detective ZachXBT's post on his personal channel, Revolut allegedly failed to identify a fraudulent request, resulting in the personal identification information (PII) of some users being leaked. The leaked information includes copies of passports or driver's licenses and verification selfies, account statements, IBANs, withdrawal records, complete transaction histories including Bitcoin transactions, as well as names, birth dates, occupations, home addresses, email addresses, and phone numbers.ZachXBT stated that the number of affected users may be limited, but it appears to target high-net-worth individuals. It is reported that several Revolut users received related security alert emails yesterday.

Strive Vice President Joe Burnett posted on platform X that the email infrastructure of Trezor and BitBox is suspected to have been compromised, and the Bitcoin strengthening phase is still ongoing.

According to Decrypt, the Mexican federal prosecutor, in conjunction with the Navy and Puebla state police, conducted a raid on a property in the remote mountainous area of Tlaola, Puebla, seizing approximately 300 cryptocurrency mining machines, as well as transformers, medium-voltage terminals, and satellite internet antennas.The investigation revealed that the mining operation illegally tapped into the grid of the Nuevo Necaxa hydroelectric power station, and authorities have filed charges for "theft of electricity." Currently, forensic accountants are tracing the source of the hardware funding, and money laundering suspicions have not been ruled out. Data from the Mexican Federal Electricity Commission shows that from January to July 2024, non-technical electricity losses reached up to 6,346 gigawatt-hours, valued at approximately 13.8 billion pesos (about 817 million USD).

According to Cointelegraph, the Attorney General's Office of the State of Mexico (FGJEM) reported that two suspects, Diego Sebastián and Gerardo, were arrested for allegedly murdering Jonathan Meléndez, the keyboardist of the rock band Camilo Séptimo, along with his pregnant wife, daughter, and an employee. The family's golden retriever was also killed.The suspects are accused of committing the crime to obtain a cold wallet that allegedly contained millions of dollars in Bitcoin, with one of the suspects being a business partner of the victim, using that relationship to gain access to the victim's home. The two will appear in court on Wednesday, where the judge will decide if there is enough evidence to continue the criminal proceedings. If convicted, each suspect could face a prison sentence of 25 to 70 years corresponding to each victim.Such violent robberies targeting cryptocurrency holders (known as "ransom attacks") are on the rise. According to CertiK data, there were 52 reported ransom attack incidents globally in the first half of 2026, a year-on-year increase of 33.3%; among them, there were 20 home invasions targeting cryptocurrency holders, compared to only 1 during the same period last year.Chainalysis estimates that in the first half of 2026, criminals stole over 30 million dollars in cryptocurrency through ransom attacks. In 2025, global ransom attack incidents increased by 75% to 72 cases, with France leading with 19 cases, accounting for about 40% of the total attacks in Europe.

On-chain analyst SomaXBT posted on platform X, stating that suspected Lootbot users have encountered a collective wallet theft incident, with the current loss amount exceeding 600,000 USD (approximately 245 ETH).Initial information indicates that about 50% of the victims are Lootbot subscription users. It is worth mentioning that Lootbot is one of the projects founded by dexter, the founder of the previously soft Rug project gm.ai, originally a trading bot platform in the Telegram ecosystem.

According to CoinDesk, the Polish prosecutor's office has charged Roman Ż., a former business partner of the missing BitBay/Zondacrypto founder Sylwester Suszek, with two counts, including fraud.Roman Ż. was arrested last Saturday in the Silesia region of Poland, and his lawyer stated that he had assisted in managing the exchange before BitBay was renamed Zonda. Roman Ż. denies the charges and has provided a detailed statement to investigators, with police seizing valuable watches and documents related to Zondacrypto during the search.The prosecutor's office stated that the arrest was ordered due to concerns that Roman Ż. would flee upon learning of plans to travel to China, with his lawyer describing the trip as a business trip and stating that he held a return ticket for September 13. The court will decide whether to continue detaining Roman Ż. during the investigation.Previously, BitBay was renamed Zondacrypto in 2021, and the exchange ceased trading in April, following customer withdrawal freezes, with estimated losses of at least 35 million zlotys (approximately 9.4 million USD). The Estonian Financial Intelligence Unit partially suspended the license of the brand entity BB Trade Estonia OÜ. The Polish prosecutor's office has launched an investigation into suspected large-scale fraud and money laundering, receiving over 3,600 complaints as of June.The case is also related to Suszek's disappearance in March 2022, with the prosecutor's office merging the Zondacrypto investigation with the Suszek missing person case in August.

According to data from platform X, the official Twitter account and contract for the new meme coin project "LAPTOP" by Hunter Biden, the son of former U.S. President Joe Biden, have been announced. The account is named Laptop (@Laptoptoken) and has also gained the official Twitter follow of Hunter Biden.The project description states "Coming to @base September 9" and discloses the relevant token contract address, consistent with previously disclosed information.ChainCatcher reminds users: The currently disclosed information is all community speculation and has not yet been officially confirmed. Please do not interact with any unfamiliar links to protect asset security.ChainCatcher previously reported that according to The Wall Street Journal, Hunter Biden, the son of former President Joe Biden, will launch a meme coin named LAPTOP, named after his laptop incident, scheduled to go live on the Base network under Coinbase on September 9.

According to on-chain analyst Ai Yi's monitoring, two wallets suspected to be related to the Ethena project (0x2993...7383, 0x969f...16aF) have transferred a total of 6.75 million USD worth of ENA to exchanges since September 3, and have deposited 19 million ENA, approximately 3.29 million USD, to Bybit in the past 15 hours.Both addresses received tokens transferred from the Ethena multi-signature address two years ago, and no transfers occurred since then, with recent price increases prompting bulk deposits.

According to on-chain detective Specter monitoring, Balancer is suspected to have encountered a V1 attack, with an attacker continuously transferring funds, currently profiting $250,000. The related address is 0x112...E0aE.

According to on-chain analyst Yu Jin's monitoring, the suspected largest HYPE holding institution of a16z continued to buy HYPE today. This institution previously spent 66.4 million USDC to purchase 816,000 HYPE at an average price of 81.3 dollars a week ago; 8 hours ago, it transferred 13.05 million USDC to Hyperliquid and purchased HYPE through a TWAP method.Currently, this institution has bought and staked 5.201 million HYPE, worth approximately 445 million dollars, with an average purchase price of about 67.2 dollars, and the current floating profit is approximately 95.18 million dollars.

According to monitoring by lookonchain, after Shivon Zilis forwarded a post containing the SLINK contract address and Musk subsequently replied, the market capitalization of SLINK soared to 80 million dollars. After Shivon deleted the related post, the price of SLINK plummeted by more than 80%.Analysis indicates that during this market event, over 30 suspected insider wallets bought SLINK in advance and quickly sold it, collectively profiting over 4.7 million dollars, with returns exceeding 1200 times. Meanwhile, many traders who followed the market trend and bought suffered losses.

According to on-chain data, Robinhood Chain is suspected to be down, having paused the generation of new blocks for over 4 minutes.

According to on-chain analysts' monitoring, the Ethena project's associated address, after being dormant for 2 years, is suspected to have liquidated its holdings. 14 million ENA (worth 6.89 million dollars at the time of receipt, with a coin price of 0.4928 dollars) was fully deposited into Bybit 6 hours ago, leaving only 2.41 million dollars, a decrease of 4.48 million dollars compared to the time of receipt, and a decline of over 8.735 million dollars from its peak.

According to Pie Shield citing Specter monitoring, the escrow contract of the fixed-rate lending protocol Notional Finance is suspected to have been attacked, resulting in a loss of approximately $1.7 million in DAI and USDC.The attacker subsequently exchanged the stolen funds for about 689.2 ETH and further deposited the funds into Tornado Cash. Currently, the reasons for the attack and the final scale of the losses are still pending further confirmation from the project team.

According to Bubblemaps, approximately 80% of the tokens for the Solana ecosystem's Trump parody meme coin CHUMP are concentrated in bundled addresses, with the project being promoted by several crypto Twitter KOLs.On-chain data shows that before the token surged, over 75 new wallets were injected with a similar amount of SOL in a short period, and then bought about 80% of CHUMP. These wallets had no prior on-chain activity, and the funds were transferred through multiple new addresses, Uniswap trades, and Relay.Bubblemaps stated that it is currently unclear who the actual controlling party of the tokens is, but the source of funds and trading patterns are highly similar, suggesting that a single entity may be in control, and advising investors to participate with caution.

According to Onchain Lens monitoring, a certain whale transferred 95 bitcoins to Galaxy Digital, worth approximately 7.32 million USD, suspected to be used for over-the-counter trading sales.

The Block's investigation shows that on the social trading app Fomo and Robinhood's self-custody wallet Robinhood Wallet, users can directly purchase Memecoin using credit cards via Apple Pay or Google Pay without completing a separate KYC identity verification. Transactions can also accumulate points or cash back rewards as normal credit card rewards. The media tested the purchase of WIF, and transactions on the Visa and Mastercard networks were classified under merchant category code MCC 5815 (digital goods media), rather than the cryptocurrency asset categories MCC 6012 or 6051 as stipulated by card organization rules, which typically come with crypto tags and do not earn rewards.These transactions are supported by the Token Checkout product from the crypto infrastructure company Crossmint. Crossmint insists that this classification is appropriate, citing the joint guidance released by the SEC and CFTC in March of this year, which views certain Memecoins like WIF as "digital collectibles." However, Chase stated that the Visa transaction was not marked as a cryptocurrency purchase and that the classification was incorrect, and they have initiated a case review with Visa; the New York Attorney General's office also stated that it is reviewing the matter. Vanderbilt University law professor Yesha Yadav and other payment experts believe that the SEC's position and card organization rules represent "two completely different systems."

According to on-chain analyst @ai_9684xtpa, a certain whale accumulated 280,000 HYPE at a low of $64.5 between June 11 and August 13, with a total value of $18.06 million.4 hours ago, this whale deposited 88,216 HYPE to Coinbase for the first time, worth $7.23 million. If sold, the return rate would reach 27%, with an expected profit of $1.538 million.

According to monitoring by Lookonchain, Huang Licheng (@machibigbrother) offered $1 million to acquire Friendtech after losing over $16 million on FRIEND, driving the price of FRIEND up nearly 30 times.The suspected insider wallet 0x2078, after being silent for 6 months, bought 2 million FRIEND for 1.88 ETH ($4,700) and sold it after the surge for a profit of 18.37 ETH ($46,000), achieving a return rate of nearly 10 times.