Search: “cryptocurrency traders”

Meme Coin Factories: Uncovering Large-Scale Manipulations on pump.fun

Large-scale pump.fun study of 15 million meme coins identifies five manipulation classes including wash trading and a Market-Manipulation-as-a-Service ecosystem.

Researchers analyzed all 15 million coins launched on pump.fun over the last two years plus large random samples of transaction data, identifying five manipulation classes: wash trading, creator address obfuscation, coordinated sells, copycat coins, and social media manipulation. Strategic actors bypass the platform interface and implement strategies in a highly automated, low-latency way by interacting directly with the blockchain. The study also uncovers Market-Manipulation-as-a-Service (MMaaS) third-party tools that let non-technical users run these manipulations, and proposes mitigations for traders, pump.fun, and regulators.

arXiv cs.CR·Sep 9, 14:35 UTC · 7d agoResearch

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.

Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.

The Hacker News·Sep 7, 07:53 UTC · 9d agoMalware in the wild1

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Talos tracks a crypto-theft campaign abusing the Google Visualization API for C2, using browser-based ClickFix lures to inject web-skimmer JavaScript.

Criminal actors convinced targets to paste JavaScript into Chrome's address bar or install it in the Tampermonkey extension, injecting a web skimmer into sessions on two cryptocurrency trading websites; Tampermonkey also provides persistence. Since March 2026 the campaign retrieved obfuscated scripts via the Google Visualization API from public Google Sheets documents, hooking the fetch API and replacing cryptocurrency deposit addresses in responses and the clipboard. Lures pose as leaked reports of a nonexistent API flaw at cryptocurrency swap services and spread via Telegram, DarkForums, and paste sites since early October 2025. Talos warns the legitimate-service-abuse techniques could enable wider supply-chain attacks on e-commerce and customer-facing systems.

Cisco Talos·Sep 8, 10:00 UTC · 8d agoPhishing & fraud in the wild

ClickFix Moves into the Browser to Steal Cryptocurrency

Cisco Talos details a ClickFix campaign injecting browser JavaScript via Google Sheets to skim crypto deposits, stealing at least ~0.159 BTC since October 2025

Cisco Talos reported a months-long ClickFix campaign that shifted from OS command execution to injecting JavaScript through Chrome's address bar or the Tampermonkey extension into sessions on two cryptocurrency trading sites. Since March 2026 the operators fetch obfuscated payloads via the Google Visualization API from public Google Sheets, replacing displayed deposit addresses and amounts and overriding the fetch API, and the campaign survived two disruption attempts. Talos observed 49 Bitcoin addresses with 24 receiving at least 0.159 BTC (~$10,000) by early August, with proceeds routed through roughly 30 wallets and more than 3,000 addresses in apparent mixing. Lures posed as leaked vulnerability reports describing non-existent API flaws at crypto swap services, promising payouts up to 38% higher.

Infosecurity Magazine·Sep 9, 13:45 UTC · 7d agoPhishing & fraud in the wild

Week in review: Cisco fixes IMC bug, Patch Tuesday forecast, Black Hat USA 2026

Help Net Security·Aug 9, 00:00 UTC · Aug 9, 2026VulnerabilityCVE-2026-66066CVE-2026-185771

Heterogeneous Cross-Chain Transaction Tracing for Solana Bridges via Candidate-Set Selective Decision

SolTracer traces cross-chain transactions onto Solana bridges, improving open-world association F1 by 20.16% over the strongest baseline for illicit-fund tracing.

The paper formalizes four Solana-bound cross-chain transaction modes and proposes SolTracer, which maps heterogeneous execution semantics into a unified event space and uses candidate-set selective decision-making with abstention when valid targets are absent. In the challenging open-world setting with a 50% TA ratio, SolTracer improves F1 by 20.16% over the strongest baseline. An empirical study of real-world transfers examines count-value divergence across bridge mechanisms, cross-asset shifts, and decoupling between on-chain settlement and explorer visibility.

arXiv cs.CR·Sep 10, 11:43 UTC · 6d agoResearch

Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Cisco Talos details a crypto-theft ClickFix campaign abusing Google Sheets to swap wallet addresses, with about $10,000 in observed Bitcoin losses.

Cisco Talos tracks a ClickFix-style campaign that tricks cryptocurrency traders into pasting JavaScript into Chrome's address bar or a Tampermonkey extension, promising fake bonuses on SwapZone and SimpleSwap. The loader pulls obfuscated JavaScript from cells in a public Google Sheet via the Visualization API, then behaves like a web skimmer, rewriting deposit addresses on screen, in web responses, and in the clipboard. Researchers counted 49 attacker-controlled Bitcoin addresses, with 24 receiving a combined 0.159 BTC, roughly $10,000, by early August 2026. A Tampermonkey variant re-injects the payload on every return visit, giving the attackers persistence despite takedown efforts.

Cyber Security News·Sep 9, 10:57 UTC · 7d agoPhishing & fraud in the wild

Hackers Abuse Google Sheets as C2 in ClickFix Attacks to Steal Cryptocurrency

Cisco Talos tracks a ClickFix crypto-theft campaign using Google Sheets as C2 to swap deposit addresses in Chrome.

Cisco Talos uncovered a cryptocurrency theft campaign that abuses Google Sheets and the Google Visualization API as a covert C2 channel, delivering obfuscated JavaScript into victims' Chrome browser sessions via ClickFix-style social engineering. Victims are lured with a fake "API Logic Flaw" report promising 25-38% bonuses on SimpleSwap and SwapZone swaps; the injected payload acts as a browser-based web skimmer that replaces deposit addresses, overrides the fetch API, and hijacks the clipboard. Later variants use the legitimate Tampermonkey extension with a user script for persistence without OS-level compromise. Talos identified 49 Bitcoin wallets, with 24 reused addresses receiving about 0.159 BTC (~$10,000) before mixing through more than 3,000 addresses.

GBHackers·Sep 9, 06:22 UTC · 7d agoPhishing & fraud in the wild

Singaporean Ringleader of $245 Million Cryptocurrency Racketeering Enterprise Pleads Guilty in Washington D.C.

Singaporean Malone Lam pleaded guilty in Washington D.C. to leading a social-engineering conspiracy that stole and laundered over $245 million in cryptocurrency.

Malone Lam, a 22-year-old Singaporean citizen residing in Miami, pleaded guilty in U.S. District Court in Washington D.C. for his role as ringleader of an international cybercrime conspiracy. The group used social engineering to steal cryptocurrency valued at more than $245 million and launder the proceeds. U.S. Attorney Jeanine announced the plea, which marks a major milestone in the prosecution of the crypto theft ring.

DataBreaches.net·Sep 8, 18:04 UTC · 7d agoPolicy & legal

$245 million in stolen crypto funded racketeering crew’s lavish lifestyle

Malone Lam pleaded guilty in D.C. federal court to a racketeering conspiracy that stole and laundered over $245 million in cryptocurrency via social engineering.

Malone Lam, a 22-year-old Singapore citizen, pleaded guilty in Washington D.C. federal court to running a racketeering conspiracy that stole and laundered more than $245 million in cryptocurrency. The operation ran from at least October 2023 through May 2025, grew out of online gaming platforms, and relied on social engineering to trick victims into surrendering wallet access, sometimes including break-ins to victims' homes. Lam was arrested on September 18, 2025 in Miami; prosecutors said members spent lavishly on nightclubs, private jets, and exotic cars priced from $100,000 to $3.8 million.

Help Net Security·Sep 9, 12:11 UTC · 7d agoPhishing & fraud

Violent Physical Crypto Thefts Surge to $30m in Losses

Infosecurity Magazine·Aug 6, 12:00 UTC · Aug 6, 2026Data breach

Signing the Transaction but Not the Decision: Whisper Attacks and a Binding Defense for AP2

Research shows AP2 agent-payment signatures can be manipulated into valid but wrong carts; proposed A-VIP defense binds signed intent to purchases.

A study demonstrates Whisper attacks on the AP2 agent payment protocol, where ordinary product-description text steers shopping agents into carts that pass every cryptographic check but no longer match user intent. Using Gemini Flash-Lite models specified by AP2's default sample agents, three attacks succeeded at 90%, 56%, and 73.3%, with the vulnerability spanning seventeen Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant. The proposed A-VIP defense treats signed intent as a capability grant, binding credential lookups to sessions and cart lines to seen listings, blocking the first two attacks with zero false positives while surfacing unauthorized spending. The authors release A-VIP code, machine-checked invariants, and AP2-WhisperBench with 1,544 evaluation scenarios.

arXiv cs.CR·updated Sep 10, 16:51 UTC · 6d ago·first Sep 10, 16:11 UTC · 6d agoAI safety & security 2 sources1· 1 read

Party’s over for scammers who went on spending spree after $240M bitcoin theft

AP report on scammers' spending spree after a $240 million bitcoin social engineering theft, as ringleader Malone Lam nears a plea agreement.

DataBreaches.net syndicates AP reporting on the $240 million bitcoin theft from a Washington, D.C. resident via social engineering calls impersonating Google and Gemini. Alleged ringleader Malone Lam, 22, faces a plea hearing; the scam network spent stolen funds on cars, jets, and mansions before FBI arrests. Crypto investment fraud complaints to the FBI rose nearly 50% in 2025.

DataBreaches.net·Sep 8, 11:32 UTC · 8d agoPolicy & legal

Party’s Over for Crypto Scammers Who Went on a Spending Spree After a $240 Million Bitcoin Theft

Malone Lam's plea hearing approaches in the $240 million bitcoin social engineering theft; the case highlights surging crypto fraud and limited enforcement.

Malone Lam, accused of organizing a social engineering attack that stole over $240 million in bitcoin (4,100+ BTC) from a Washington, D.C. resident in August 2024, has a plea agreement hearing set. Callers impersonating Google and Gemini staff tricked the victim into revealing security codes. Lam and 17 co-defendants spent lavishly before FBI arrests; crypto investment fraud complaints to the FBI rose nearly 50% in 2025 while DOJ disbanded its crypto crimes unit.

SecurityWeek·Sep 8, 13:00 UTC · 8d agoPolicy & legal

Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023

FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.

FinCEN analyzed more than 33,000 cyber fraud incident reports filed by roughly 1,300 financial institutions between September 2023 and December 2025, finding about $12.7 billion in losses to cryptocurrency investment scams across all 50 states. Traditional banks reported about $6.4 billion in suspected scam activity and crypto firms about $5.5 billion. Scam activity is growing, with monthly reports rising nearly 11% as centers expand beyond Myanmar, Cambodia, and Laos. The US later sanctioned Xinbi Guarantee, a Telegram-based marketplace used to launder over $36 billion.

The Record·Sep 10, 21:15 UTC · 5d agoPhishing & fraud 4 sources

Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline

Rapid7 exposed infrastructure behind a cryptocurrency fraud pipeline using phishing panels, voice-dialing scripts, fake wallets, and AI coding assistants.

Rapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation tracked as Operation ASTERIX. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialing scripts, fake wallet applications, persistence mechanisms, and Telegram exfiltration code. Recovered prompts, shell history, and project files show the operator relied on AI coding assistants to package Electron applications, obfuscate code, troubleshoot builds, and modify phishing infrastructure.

Rapid7 Blog·Aug 17, 11:29 UTC · Aug 17, 2026Phishing & fraud

Crypto theft in 2025: North Korean hackers continue to dominate

Help Net Security·Aug 6, 12:50 UTC · Aug 6, 2026Vulnerability

The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications

Unit 42 analyzes the Aeternum botnet loader, which uses Polygon blockchain smart contracts for resilient decentralized C2 and payload execution.

Palo Alto Unit 42 published a technical analysis of Aeternum, a botnet loader that leverages Polygon blockchain smart contracts as its command-and-control infrastructure. The decentralized C2 design makes takedown difficult, giving the threat a persistent, 'permanent' communication channel for payload delivery and execution. The analysis covers the smart contract mechanics and communication protocol used by the operation.

Palo Alto Unit 42·Aug 10, 22:00 UTC · Aug 10, 2026Malware

Ready-made $500 kit puts a crypto scam within anyone's reach

A $500 ready-made scam kit sold on a cybercrime forum builds fake Tesla $TSLA presale pages that harvest wallet recovery phrases and cryptocurrency deposits.

Malwarebytes found a $500 scam-in-a-box kit by seller xrep on a cybercrime forum, bundling a fake Tesla-style $TSLA presale site, a victim-tracking admin panel, and controls to inflate fake balances. The kit harvests 12-word wallet recovery phrases via wallet-connection prompts or accepts direct transfers in Bitcoin, Ethereum, USDT, or Dogecoin. The admin panel lets operators check stolen wallets' value before draining them, raise displayed balances to encourage further deposits, and send follow-up messages demanding fake network fees.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Phishing & fraud

Fake IRS letters direct crypto holders to bogus compliance portal

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026Phishing & fraud

PDoS: A Profitable Denial-of-Service Attack against Proof-of-Work Blockchain Liveness

PDoS attack disrupts Proof-of-Work blockchain liveness profitably by combining miner deterrence signals with parasitic revenue extraction from victim pools.

PDoS is a hybrid incentive-driven denial-of-service attack that combines block header signal deterrence with parasitic revenue extraction from a victim pool's share-reward mechanism. By subsidizing attack costs through the victim pool, it lowers the hash-power threshold required to induce rational miners to shut down, unlike prior attacks such as BDoS that demand sustained attacker losses. The authors show a counterintuitive result: in high-fee or high-MEV environments, higher block value increases the attacker's parasitic revenue and can push the attack past break-even into a self-sustaining or even profitable regime. PDoS is claimed as the first attack demonstrating that disrupting PoW blockchain liveness can be economically self-sustaining.

arXiv cs.CR·Sep 11, 05:16 UTC · 5d agoResearch

LLM-Based Social Engineering Scams

OpenAI disrupted a Cambodia-based ChatGPT-powered scam network running romance, crypto-investment, gambling, and fake law-enforcement fraud campaigns.

OpenAI disrupted a social engineering network operating from Cambodia that used ChatGPT to run multiple scam types simultaneously. Operators built trust with fake dating personas before pitching fraudulent cryptocurrency and spot gold investments, posed as gambling platforms offering fake bonuses, or impersonated law enforcement agencies demanding fine payments. The network also generated images of forged documents including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.

Schneier on Security·Aug 27, 09:57 UTC · 20d agoAI safety & security in the wild

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes Labs·Sep 15, 08:40 UTC · 1d agoPhishing & fraud

Scammer behind $245 million crypto heist pleads guilty to RICO charges

Malone Lam, leader of a social engineering ring that stole over $245 million in cryptocurrency, pleaded guilty to US RICO charges.

Singaporean national Malone Lam, 22, pleaded guilty to RICO conspiracy charges for leading the 'Social Engineering Enterprise,' which stole more than $245 million in cryptocurrency. The group posed as Apple and Google customer support, tricked victims into installing remote desktop software, and even burgled homes to steal hardware wallets, including $263 million from a single Washington, D.C. victim. At least nine others have already pleaded guilty; Lam faces a December 8 sentencing hearing and a possible 7-to-20-year term.

The Record·Sep 8, 20:52 UTC · 7d agoPhishing & fraud

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42·Aug 19, 12:05 UTC · 28d agoMalware in the wild

Liquid Hackers Return 3,400 Bitcoin Taken via Elements Bug, Still Holding $47M in BTC

Hackers exploited an Elements bug to take ~4,000 BTC from Liquid Network, returned 3,400 BTC (~$265M), and still hold ~598.5 BTC (~$47M).

Attackers exploited a bug in Elements, the software behind Blockstream's Liquid Network Bitcoin sidechain, to create L-BTC and withdraw roughly 4,000 BTC (about $320 million) via SideSwap's Peg-out Authorization Key, roughly 95% of Liquid's reported reserves. They returned 3,400 BTC (about $265 million at ~$78,000 per BTC) to the federation address on September 7, keeping about 598.5 BTC (roughly $47 million). The group called itself white hats, demanded node patches before returning funds, and negotiated via on-chain and PGP-encrypted messages; Ledger CTO Charles Guillemet characterized the arrangement as extortion. Blockstream says the peg-out key and other keys were not compromised, updated software is deployed, and the network remains paused pending a coordinated restart.

The Hacker News·Sep 8, 14:54 UTC · 8d agoExploit / PoC in the wild

Hackers drain $320M in Bitcoin from Liquid Network, claim they’re the good guys

Hackers withdrew roughly 4,000 BTC (about $320M) from the Liquid Network federation wallet backing the Blockstream-developed Bitcoin sidechain, claiming benign intent.

Blockstream said Sunday that around 4,000 BTC, roughly $320 million, was withdrawn from the federation wallet backing Liquid Network, a Bitcoin sidechain used by exchanges and financial institutions. The attackers publicly claimed they were 'the good guys'; no attribution or recovery details are provided. The theft affects infrastructure that backs custodial Bitcoin transfers for exchanges.

DataBreaches.net·Sep 7, 16:37 UTC · 9d agoData breach in the wild

Crypto customers targeted by scammers after email marketing provider breach

Attackers exploited a Brevo SAML SSO flaw to access 138 accounts and phish crypto customers of Trezor, CoinTracking, and BitBox.

An attacker exploited a flaw in Brevo's SAML SSO handling to access 138 customer accounts on September 10; six accounts were used to send phishing emails and contacts were exported from 43 accounts. Crypto firms Trezor, CoinTracking, and BitBox confirmed customers received phishing emails, with Trezor warning roughly 347,000 newsletter subscribers. The Trezor-themed email cited a fabricated STM32 microcontroller entropy bug and urged recipients to enter wallet backups through a malicious link. Exported contact lists could fuel future targeted phishing attacks.

Malwarebytes Labs·Sep 11, 15:01 UTC · 5d agoData breach in the wild 6 sources