victims

As the "leader" of the Prince Group of Cambodia, Chen Zhi has been apprehended, prompting various judicial jurisdictions to initiate the disposal of assets related to the Prince Group. Local courts have appointed Joint Provisional Liquidators (JPLs) to investigate and preserve the corresponding assets surrounding the 30 British Virgin Islands (BVI) entities actually controlled by Chen Zhi. The bankruptcy proceedings in the British Virgin Islands are collective in nature, and the eligibility for creditor claims is not determined by nationality or jurisdiction; potential victims from any jurisdiction can file claims, which means that victims of online fraud and gambling from China can also submit claims at some point in the future.It is reported that the liquidation list includes 30 BVI companies, including Prince Global Group Ltd, most of which are actually controlled by Chen Zhi, while only 28 BVI companies are listed on the U.S. Treasury's sanctions list. Furthermore, "the scope of liquidation is not solely determined by sanctions," as two companies not sanctioned but included in the liquidation list, Amber Hill Ventures Limited ("AHV") and Lateral Bridge Global Limited ("LBG"), have been mentioned in U.S. judicial proceedings and are considered entities within the widely associated network of the Prince Group, accused of having no other practical use besides participating in money laundering. The prosecution claims that of the more than 120,000 bitcoins confiscated in the U.S., over 90,000 flowed through AHV, LBG, and another company registered in the Cayman Islands, Future Technology Investment; among them, the chairman and shareholder of AHV is Fan Yang, and the chairman and shareholder of LBG is Minyi Tang, who are referred to in the U.S. indictment as "Co-conspirator 6" and "Co-conspirator 7," respectively. Regarding the claims of victims of online fraud and gambling, a claims filing and distribution process has not yet been established. If a liquidation process is initiated in the future and there are sufficient funds to support distributions to creditors, the liquidators will establish a claims process, adjudicate claims, and make distributions in accordance with the British Virgin Islands bankruptcy law.

According to Caixin, as the "leader" of the Prince Group in Cambodia, Chen Zhi, has been captured, various judicial jurisdictions have successively initiated the disposal of assets related to the Prince Group.Regarding the 30 entities in the British Virgin Islands (BVI) actually controlled by Chen Zhi, local courts have appointed Joint Provisional Liquidators (JPLs) to investigate and preserve the corresponding assets.

According to monitoring by Onchain Lens, Bloomtrading users reported that their wallet assets were stolen, with approximately $954,000 in funds transferred to a suspected theft address. A hacker stole 9,408 SOL from 49 victims through a theft wallet, and the final amount may be higher.The highest single stolen amount was 1,636 SOL, approximately $166,000. Users are reminded to disconnect immediately and transfer their funds to a new wallet.

According to Caixin, just four days after the High Court of England ruled that the property rights dispute over more than 60,000 bitcoins in the Qian Zhimin case is subject to Chinese law, approximately 16,000 Chinese victims participating in the UK recovery have been given the opportunity to continue challenging this ruling.The High Court of England has held another hearing, and the judge has approved the Chinese victims to appeal the legal applicability ruling made on October 12. Lawyers from both sides also discussed issues related to the litigation costs of the previous legal applicability dispute, whether the approximately 16,000 individual applicants would continue to pursue recovery, and how to withdraw, among other matters.

According to The Defiant, Blockaid data shows that from January to August 2026, the 60 cryptocurrency attack incidents it tracked involved approximately $1.18 billion in funds, with victims recovering about $9.8 million, accounting for less than 1%.The report pointed out that all frozen or returned funds were achieved through on-chain governance or validator actions, and the blacklist mechanism of stablecoin issuers did not recover any funds in these 60 incidents.

According to reports from Strait News, in March 2025, Zheng Mouyi, Zou Moumou, and others exploited the weak regulation and difficulty of evidence collection in offline USDT over-the-counter trading to plan a "black eat black" robbery crime under the guise of virtual currency offline trading.The gang raised over 340,000 yuan and invited virtual currency merchants for offline transactions. During the transaction, after the merchant transferred over 40,000 USDT into the virtual wallet controlled by the gang, Zheng Mouyi sprayed the victim's eyes with chili water on the spot and, along with others, violently seized all the transaction funds. After the incident, six involved individuals divided the stolen money. The day after the incident, the public security authorities quickly arrested all involved individuals, recovering most of the stolen funds and returning them to the victim.The Jin'an District Prosecutor's Office legally prosecuted Zheng Mouyi, Zou Moumou, and four others for robbery. In 2026, the court heard the case and sentenced the five defendants to fixed-term imprisonment ranging from five years and seven months to ten years and four months for the crime of robbery.

An important ruling has been made by a UK court regarding the cross-border asset recovery dispute involving over 61,000 Bitcoins related to the illegal fundraising case of Tianjin Blue Sky Ge Rui in China. On October 12, local time, a judgment obtained by Caixin from the High Court of England and Wales indicated that the UK High Court determined that the property rights claims made by Chinese investors regarding the Bitcoins in question should be judged according to Chinese law rather than UK law.This means that approximately 16,000 Chinese victims who have participated in the UK recovery process may not be able to share in the substantial appreciation gains brought about by the soaring Bitcoin prices under UK law, and can at most recover their principal and interest.

According to The Block, the UK's Financial Conduct Authority (FCA) has obtained a court order requiring two individuals involved in a fraudulent cryptocurrency investment scheme to jointly repay £851,402, with plans to return the funds to the victims.At least 65 investors have collectively lost £1.54 million, and the amount being recovered is approximately half of that.

According to monitoring by the head of Galaxy Research, the COLDCARD Seed Entropy theft incident has resulted in 1,830 BTC being stolen, involving three rounds of attacks and over 30 smaller related signs.A total of 256 victims have reported their situations to GLXY Research, with a median loss of 1.1 BTC, and the tracking of the attackers is still ongoing.

On September 14, blockchain intelligence company TRM Labs released a report revealing that fake YouTube tutorials lured 224 victims into deploying and funding malicious smart contracts under the guise of building AI-based crypto arbitrage bots, resulting in the theft of 274.6 ETH. TRM identified a total of 234 contracts deployed by the victims, with funds ultimately flowing into six collection addresses controlled by the operators. The stolen ETH was worth approximately $517,000 at the time of the transfer, with a median loss of 1 ETH per incident.Unlike common wallet theft attacks, this scam did not involve phishing links, spoofed domains, or malicious authorization prompts. Victims chose the tutorials themselves, copied the code, deployed the contracts, and funded them from their own wallets, with each step authorized by the victims themselves. As a result, wallet security warnings and phishing blacklists could not be triggered. TRM discovered nine nearly identical YouTube tutorials disguised as different creators, using AI-generated virtual hosts and voiceovers, promising to build fully automated crypto trading bots with Claude, and guiding victims to a compiler website controlled by the operators, some of which mimicked the commonly used Remix development environment.In one variant analyzed by TRM, a backend script would discard the source code pasted by the victims and retrieve another contract from the operator's server, with the clean code displayed on the screen never being on-chain. The replaced contract accepted deposits and transferred any balance over 0.05 ETH to the operators when the victims pressed Start or Withdraw, with no arbitrage logic or AI functionality included in the contract.

On-chain investigator ZachXBT posted on X accusing user "Mr Austin Fine" (account "@xmrfine") of exchanging the stolen cryptocurrency assets of victim Malone for luxury goods in exchange for fees, stating that he "may be a whistleblower." ZachXBT indicated that until the victim is compensated, he will consider him "disassociated," which will negatively impact all current and future brand collaborations.ZachXBT later added that he has traced part of the funds on-chain flowing through Monero to purchase cars from the luxury car dealer TBTFW in Los Angeles.

On-chain analyst Specter revealed that a series of address poisoning attacks occurred on the Tron network over the past 4 weeks, resulting in a total loss of approximately $9.4 million for 15 victims. Among them, two victims had $2.5 million stolen each, while another lost $2 million.After the attackers succeeded, they quickly exchanged all the stolen assets for the stablecoin USDD and transferred them to a collection address, where all the funds remain. Specter urges Tron ecosystem wallet service providers to take interception measures as soon as possible and reminds users to carefully verify addresses when making transfers.

The Arizona Attorney General Kris Mayes' office assisted 35 cryptocurrency ATM scam victims in obtaining full refunds totaling $171,332. The related funds stemmed from scam-induced transactions, and the refunds covered all fees.According to Arizona law, only new customers who have been dissatisfied with an ATM operator for less than 10 days are eligible for a mandatory full refund. Victims must contact the operator and law enforcement or the Attorney General's office within 30 days of the transaction date and submit an official report confirming the scam. FBI data shows that in 2025, there were 460 complaints related to cryptocurrency kiosks in Arizona, with adjusted losses of $14.53 million; nationwide, there were 13,460 related complaints, with adjusted losses exceeding $388.98 million, of which individuals aged 50 and above lost over $302 million.

According to the monitoring by the head of Galaxy Research, it has communicated with over 190 victims of Coldcard vulnerability attacks and has asked victims who have not yet contacted them to reach out via private message so that they can provide tracking information and assist in reporting losses to the relevant authorities.Since August 6, no new attack incidents have been confirmed, but this does not mean that new attacks will not occur, and vigilance is required.

FlashRescue co-founder @DarcyAri posted on the X platform that on July 28, 2026, the funding project ODY targeting victims in China issued an additional 10 billion tokens and absconded with approximately 15 million USDT from the trading pool. Currently, it is known that there are over 10,000 victims, and the case has been accepted and is under investigation.Including subsequent transfers and transaction fees, ODY has aggregated at least 15,669,118 USDT. Further tracking revealed that the same main aggregation address previously received 5,383,428 USDT transferred from the KXG wallet, confirming that ODY and KXG share a common fund pool.

According to SBS, the Financial Supervisory Service (FSS) of South Korea has begun a comprehensive reform of its system to address compensation issues related to financial fraud, including voice phishing involving virtual assets. The FSS launched the "Financial Fraud Loss Compensation System Improvement Project" on August 6. This project aims to reform the existing compensation calculation system centered on the Korean won, in preparation for including virtual asset losses in the compensation scope starting in October this year.The current system primarily calculates compensation amounts based on losses valued in Korean won, but after the reform, a compensation ratio will be adopted, taking into account the type and quantity of virtual assets involved. Additionally, during payment suspensions, the Korean won exchange value of virtual assets will also be included in the calculations.

According to a post by Galaxy Research, as of now, approximately 1719 BTC have been confirmed stolen in the Coldcard hardware wallet vulnerability attack, valued at around 111 million USD. Several other transactions are still under verification, and the total loss is expected to exceed 130 million USD. If the unverified portion is ultimately confirmed, the scale of theft could reach over 2300 BTC. In addition, collaborating researchers have received reports from more than 250 victims. Based on the loss situation from the first three waves, most victims are ordinary Bitcoin holders rather than whales.Galaxy Research stated that it is currently tracking over 25 independent attack patterns, including the previous first to third waves, indicating that multiple different threat actors are actively exploiting the vulnerability. All addresses corresponding to the stolen coins were created after the affected firmware was released on March 17, 2021. There is currently no evidence that the vulnerability affects other signing devices or wallets outside of the Coldcard Mk3, Mk4, Mk5, and Q series firmware released after that date.

The Galaxy research director posted on platform X, stating that please continue to share your victim experiences with him via private message. His private messages are full, with over 200 Coldcard victims having contacted him. He is categorizing them using clanker and will eventually reply to everyone.He stated, "You will get through this, Bitcoin will get through this, we will not leave."

Galaxy Research Research Director Alex Thorn tweeted that among a Coldcard attack victim holding nearly 30 BTC, 17 BTC were split and converted to ETH via THORChain, and then deposited into the offshore betting platform Duel.com.Upon tracking, this portion of funds corresponds to approximately 229.72 ETH (worth about $445,000). The victim and the research team have emailed all known addresses of Duel.com, providing all transaction and deposit information and requesting to freeze the funds, but the response stated that the victim should have the police contact them, even though the platform's anti-money laundering policy claims it implements KYC and complies with relevant laws.Thorn stated that this response is unacceptable, and most of the Western regions have passed midnight, meaning the police report cannot be advanced until at least Monday; he believes that if the platform refuses to freeze the funds after receiving notification that they originated from an ongoing cyber attack, it constitutes complicity in theft.Since Duel.com's X account has been banned, Thorn turned to @ several individuals associated with the platform, urging them to push the platform to take the correct actions, and stated that if the funds are not frozen, the platform will face significant legal action.

According to Jinshi, U.S. Treasury Secretary Ben S. Bernanke stated that the United States will actively track down Iranian assets globally to ensure compensation funds for the victims of terrorism supported by Iran. Bernanke emphasized that the U.S. government's military and economic blockade measures against the Iranian regime will continue to advance without any slackening.