Topic
Theft of digital assets from individuals, exchanges and custodians, usually followed by attempts to move the proceeds beyond the reach of tracing tools.
Joe Grand told Trezor in August that two of its wallets carried hardware implants, zetter-zeroday.com reports. Trezor's commercial chief has since written that there is no evidence of compromise as the company trims its authorized sellers.
Reality
Ledger told owners of Nano X wallets bought from CryptoBilis to discard them after spy chips were linked to more than $86 million in thefts. A Nano X bought in Europe and a Ledger Flex have since been reported with the same implant.
Reality
Malaysian police are investigating unauthorized transfers of about $3.05 million in crypto from a Teluk Intan man's wallet. Officers have yet to name the attacker, the coins taken or how the attacker got in.
Reality
Inner London Crown Court jailed Ajay Shinjin for two and a half years for helping steal nearly $260,000 in crypto through SIM swaps. Once the victims' numbers moved, their texted security codes went to the thieves, and BT was the one that noticed.
Perspective Coverage
3 publishersReality
Zscaler ThreatLabz says North Korea's TraderTraitor hid a malware loader inside a fake HashiCorp Terraform provider that runs the moment Terraform loads it. The crypto-theft group has pushed its operation into infrastructure-as-code, the tooling that provisions cloud environments.
Reality
Scammers wrapped the leaked DarkSword exploit chain in a fake iPhone Duo preorder page that attacks the moment it opens, before any form, tap, or download. Apple has already patched the flaws it uses, so a current iOS build is what protects a phone here.
Reality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
North Korea's WaterPlum stole $10.7 million in crypto from IT workers by posing as recruiters, infecting at least 30,000 devices. The FBI is investigating a separate ShinyHunters claim that agent data left its FBIjobs recruiting site.
Reality
Check Point's deobfuscation of 23 compiled V8 bytecode samples shows JSCeal replaying stolen cookies inside the victim's own browser profile, then stuffing local credentials at any password prompt until it holds a fresh OAuth token.
Reality
The 11-of-15 federation multisig held and no key was stolen; the node software that tells signers whether a peg-out is backed carried a week-old bug, and about $320m walked out of Blockstream's sidechain.
Perspective Coverage
5 publishersReality
Prosecutors valued the take at 4,100 bitcoin, more than $245 million, drained after one Washington holder granted Google Drive access and read out security codes; every other victim named in the case totals about $14.8 million.
Perspective Coverage
5 publishersReality
A joint advisory ties about $10.71 million of stolen cryptocurrency to more than 30,000 infected devices in over 100 countries. That works out near $357 a machine, and the payroll half of the same operation ran for years.
Reality
Seven agencies across four countries tied fake recruiters and take-home coding tasks to eight months of infections and drained cryptocurrency wallets.
Reality
The joint research argues that constant reorganization under the GRIB and NIA is a control mechanism rather than administrative noise, and that treating Lazarus as one actor hides the revenue mandate driving most of the intrusions.
Reality
The 4,100 coins left a Washington wallet after two callers talked their way into the holder's Google Drive, and the arrests followed an exchange signup made from a home IP plus a month of spending loud enough to advertise itself.
Reality
Eighteen defendants are charged over the August 2024 heist, and the alleged ringleader reaches a plea agreement hearing on Tuesday. Prosecutors describe laundering built to hide the money, but one account signup exposed it.
Reality
Cisco Talos traces a crypto skimmer running since October 2025 that keeps persistence in a Tampermonkey userscript and pulls its code from a public Google Sheet. Talos says most organisations are not the target.
Reality
Malone Lam's plea hearing closes a case that started with a phone call and unravelled over a nightclub tab, at a moment when FBI crypto fraud complaints have risen nearly 50% and the DOJ's crypto unit is gone.
Reality