ChainCatcher news, according to IT Home citing Bloomberg, the U.S. Department of Justice is investigating a former ransomware negotiation expert from DigitalMint, who is accused of reaching secret agreements with hackers to extract commissions from ransom payments, severely harming client interests. DigitalMint is a Chicago-based incident response and digital asset services company that specializes in ransomware negotiations and cryptocurrency payment services, helping clients obtain decryption keys and prevent data breaches.The investigation focuses on whether the negotiation expert violated federal laws, including conspiracy, wire fraud, and money laundering. If convicted, this individual could face severe penalties. DigitalMint has stated that the employee involved has been immediately terminated, and their actions are considered an isolated incident.

ChainCatcher news, according to a report released by cybersecurity company Sentinel Labs on Wednesday, North Korean hackers are using a new type of malware targeting Apple devices to attack cryptocurrency companies. The hackers impersonate trusted individuals on instant messaging applications like Telegram, sending fake Zoom update files that actually install malware named "NimDoor."This malware is written in the rare Nim programming language, which can bypass Apple's memory protection mechanisms and deploy information stealers specifically targeting cryptocurrency wallets and browser passwords. The Nim language is becoming a new favorite among cybercriminals because it can run on Windows, Mac, and Linux without modification, compiles quickly, and is difficult to detect.The malware also includes scripts capable of stealing the encrypted local database and decryption keys from Telegram, and it waits for 10 minutes before activation to evade security scans.

ChainCatcher message, Slow Mist founder Yu Xian tweeted that the stablecoin protocol Resupply is calling out to the hacker address on-chain, requesting further communication. "Let's communicate through Blockscan."

According to ChainCatcher news, the Polyhedra ecosystem announced the launch of the Phoenix Revival Program after suffering a liquidity attack on June 15, to thank the users who supported them during this critical time.The program offers two exclusive benefits for users who staked ZKJ on-chain at the time of the attack: incentives and rewards for future Polyhedra products, as well as whitelist access for future ecosystem project airdrops. The proportion of future earnings for users will be calculated based on their SP (staking power) share at the snapshot time (June 15, 2025, 13:00 UTC).Future products from Polyhedra include ZKML (Zero-Knowledge Machine Learning), Regulatable Privacy-Stablecoin, and Dark Pool, among others. These projects aim to provide verifiable AI systems, privacy-preserving decentralized stablecoin systems, and privacy-protecting decentralized exchange protocols, etc.

ChainCatcher news, according to Lookonchain monitoring, a suspected hacker address bought back 4,958 ETH (approximately 12.37 million USD) for 2,495 USD about 30 minutes ago, currently at a loss of approximately 6.9 million USD.It previously obtained 12,282 ETH (approximately 23.72 million USD) from THORChain and Chainflip 3 months ago and sold it at an average price of 1,932 USD.

ChainCatcher message, Resupply released a hacker attack analysis report, which pointed out that the attack on the crvUSD-wstUSR trading pair of Resupply resulted in approximately 10 million USD in reUSD bad debt, but the vulnerability only exists in specific token trading pairs, and other token trading pairs are unaffected. The Resupply market is operating as usual.Currently, the debt limit for the affected token trading pairs has been set to 0, and withdrawals from the insurance pool have been suspended, requiring a formal governance vote to lift the suspension. Resupply noted that the problematic code segment has undergone multiple security audits, and independent researchers have been hired to review the codebase, but no reports of the issue were made. At this stage, the stolen funds remain on-chain, and they are monitoring the situation and will take necessary measures.

ChainCatcher news, on the X platform, on-chain detective ZachXBT stated that Pepe creator Matt Furie and his platform ChainSaw's associated projects Replicandy, Peplicator, etc., were attacked in mid-June, allegedly by mistakenly hired North Korean IT personnel.The attackers took over contract permissions to mint and sell NFTs, causing the floor price to drop to zero, with initial estimated total losses exceeding 1 million dollars, of which approximately 310,000 dollars were stolen from ChainSaw-related projects.

ChainCatcher news, Slow Mist founder Yu Xian stated that the attacker of the decentralized stablecoin protocol Resupply exploited an interest rate inflation vulnerability to steal assets. The attacker triggered price inflation by donating to the Controller contract of the new treasury, causing the exchangeRate to drop to 0, thereby bypassing collateral verification. Ultimately, the attacker was able to borrow a large amount of reUSD using only 1 wei of collateral. The hacker's funds have currently been converted to ETH, worth approximately over 9.5 million USD, and the hacker's Gas came from Tornado Cash.

ChainCatcher news, according to The Block, the U.S. Department of Justice disclosed that an FBI undercover agent had sent a private message to "IntelBroker," attempting to purchase a victim's data for $250 worth of Bitcoin (BTC), successfully identifying and arresting the suspected serial hacker Kai West (online alias "IntelBroker"), who is implicated in multiple corporate data breaches. The suspect primarily used Monero for black market transactions and was arrested in France in February this year, currently awaiting extradition.The FBI accuses him of attempting to sell data from at least 41 hacks between 2023 and 2025, causing losses exceeding $25 million in total. Blockchain forensics company TRM Labs stated that this case demonstrates a breakthrough in blockchain forensics in cryptocurrency crime investigations.

ChainCatcher news, according to Cointelegraph, South Korean internet security agencies have revealed that North Korean hackers are now using ChatGPT to automate cryptocurrency theft.

ChainCatcher message, the official website information of the cryptocurrency exchange XeggeX shows, "Notice: Due to the hacker attack in February and recent other issues, Xeggex is shutting down and applying for bankruptcy. More information and legal contact will be provided soon."According to previous news, the cryptocurrency exchange XeggeX suffered a hacker attack in February this year, and users were unable to log into their personal accounts.

ChainCatcher news, Binance founder Changpeng Zhao stated that two days ago it was CoinMarketCap, now it is Cointelegraph. Hackers are now targeting cryptocurrency information websites, and users must be cautious when authorizing wallet connections.Regarding CoinMarketCap, according to preliminary on-chain analysis, there are 39 victims with a total loss of $18,570.

ChainCatcher news, according to Decrypt, the threat intelligence research company Cisco Talos reported on Wednesday that North Korean hackers are targeting cryptocurrency professionals by deploying a new Python remote access Trojan named "PylangGhost" through fake interviews disguised as recruiters from companies like Coinbase and Uniswap. This malware is associated with the notorious North Korean hacking group "Famous Chollima" (also known as "Wagemole").The malware can steal credentials from over 80 browser extensions, including Metamask and 1Password, and achieve persistent remote access. The attacks primarily target Windows systems and macOS users, while Linux systems have not been affected by the current wave of attacks.

ChainCatcher message, the Israeli-linked hacking group Gonjeshke Darande announced that it has made the entire source code of Iran's largest cryptocurrency exchange Nobitex public, and related asset information has now been fully exposed. The organization warned that user assets remaining in Nobitex are facing extremely high risks and showcased details of Nobitex's internal system on social media platforms.

ChainCatcher news, according to CoinDesk, the blockchain security company Elliptic stated that the attack on the Iranian cryptocurrency exchange Nobitex by the hacker group Gonjeshke Darande, linked to Israel, resulting in a loss of $90 million, was not motivated by financial gain, as the related funds were sent to a Vanity Address, essentially destroying the tokens.Previous news, the hacker group "Gonjeshke Darande" (Persian for "Fierce Sparrow") announced that it had launched a cyber attack on the Iranian cryptocurrency exchange Nobitex and warned that it would release the exchange's source code and internal network information within 24 hours.

ChainCatcher news, the hacker group Gonjeshke Darande (Persian for "Fierce Sparrow") announced that it has launched a cyber attack on the Iranian cryptocurrency exchange Nobitex and warned that it will publicly release the source code and internal network information of the exchange within 24 hours.The group accuses Nobitex of being a key tool for the Iranian regime to evade international sanctions and fund terrorism, even openly guiding users on how to use its infrastructure to bypass sanctions. The hacker group also claims that working at Nobitex is considered effective military service by the Iranian government, highlighting the exchange's importance to the Iranian regime.Previously, this hacker group had targeted the Iranian Revolutionary Guard's "Bank Sepah." The hackers warned Nobitex users to withdraw their assets as soon as possible, stating that "any assets remaining on the platform after this point will be at risk."Earlier reports indicated that the Iranian cryptocurrency exchange Nobitex was suspected of being hacked, resulting in a loss of $48.65 million.

ChainCatcher news, according to on-chain analyst Onchain Lens (@OnchainLens), the Bitrue hacker bought 5,917.82 ETH in the past two hours, worth about 16.34 million dollars, at an average price of 2,762 dollars. Subsequently, the hacker transferred a total of 11,029 ETH through TornadoCash, worth 30.29 million dollars.

According to ChainCatcher's message, on-chain data analyst Yu Jin has monitored that the Bitrue hacker has currently used 8.304 million DAI to purchase 3,000 ETH and has laundered 4,600 ETH (approximately 12.65 million USD) through Tornado Cash. The address still holds 8.04 million DAI and 3,510 ETH.