theft

According to Apnews, a young cryptocurrency scam gang stole over 4,100 BTC in August 2024 through "social engineering" attacks, which was worth over $240 million at the time.After the theft, gang members quickly began extravagant spending, including purchasing sports cars, renting luxury homes, flying on private jets, and hiring security personnel. Among them, the alleged mastermind, a 22-year-old Singaporean named Malone Lam, reportedly spent over $569,000 in one night at a nightclub in Los Angeles.Investigations revealed that the suspects impersonated employees from Google and the cryptocurrency trading platform Gemini to trick victims into giving up their Google Drive access and security codes, allowing them to transfer the victims' bitcoins. They then moved the funds through multiple trading platforms and money laundering intermediaries. Their lavish lifestyle eventually drew the attention of law enforcement.One suspect was exposed when their IP address was revealed while hiding nearly $30 million in stolen cryptocurrency assets, leading police to trace it back to the luxury home they rented in California. Another suspect was found with $37 million worth of stolen cryptocurrency assets. Lam was accused of using the stolen funds to purchase a $2 million watch and over 30 vehicles including Porsches, Lamborghinis, and Ferraris.Currently, 18 defendants have been charged, and Lam is expected to attend a plea agreement hearing this Tuesday. The U.S. Department of Justice has already issued rulings against several accomplices, and related cases are still ongoing.

The Ukrainian police and the Security Service of Ukraine (SBU) recently dismantled a scam network that used a fake investment platform to steal cryptocurrency. This network disguised itself as an investment platform website, luring users to connect their main cryptocurrency wallets and approve a small test transaction when withdrawing funds. Subsequently, it used a "wallet stealer" hidden within the website to automatically transfer user funds to wallets controlled by the operators, kicking victims off the platform. Investigators have currently confirmed 62 victims, with over 46 Ukrainian citizens involved, and the network could steal up to $1 million per month.The police stated that the false profits displayed on the platform are part of the scam, with operators manually creating transactions and adjusting user account balances to create the illusion of investment growth. In addition to cryptocurrency, the platform also collected victims' passport information, phone numbers, email addresses, login credentials, and photos during the registration and identity verification process. The main organizer of the network is a 25-year-old IT expert who recruited over 46 Ukrainian citizens and operated multiple offices in Kyiv and surrounding areas, with members responsible for building and maintaining fake websites, contacting potential victims, and providing security.Victims come from multiple countries, including Germany, Poland, Lithuania, Latvia, Spain, France, the United Kingdom, Canada, and Israel. The police traced the gang's server equipment located in the Netherlands and obtained a database stored there, which included a list of victims, cryptocurrency wallet addresses, suspected stolen amounts, internal communications, and platform operation information. The Ukrainian police and SBU subsequently executed 34 searches in Kyiv and surrounding areas, seizing over 100 computers, more than 100 mobile phones, 79 SIM cards, documents, cash, and 15 vehicles.

According to a report by Malwarebytes, scammers are using the hype around "GTA 6" to set up phishing websites, claiming to sell leaked versions of the game for $50 or 1 SOL, luring visitors to connect their wallets and sign malicious transactions. The website contains approximately 2.4 MB of malicious scripts that can identify wallet assets on seven chains: Ethereum, Polygon, BNB Chain, Avalanche, Arbitrum, Base, and Fantom, and immediately transfer assets or gain permissions for subsequent transfers of tokens and NFTs based on the permissions signed by the victims.Before triggering, the script checks the visitor's IP to evade ten countries, including Armenia and Russia. Malwarebytes advises users to be cautious of any websites claiming to sell leaked versions of GTA 6, to carefully verify the authorization content before signing transactions, and to refuse operations that transfer the entire balance or request token access permissions.

According to monitoring by Catcher Predict, in the event "GTA VI First Week View Count" on the prediction market Polymarket, the "Yes" option in the sub-market "20-22M" experienced a sharp fluctuation in winning probability, soaring from 56.5% an hour ago to the current 81% (a fluctuation of 24.5%). Please note the impact of relevant breaking news.

According to SlowMist's monitoring, the GebProxyActions contract suffered a loss of approximately 5.9436 ETH due to a lack of caller access control. Affected users previously called GebProxyActions.quitSystem directly instead of through a DSProxy delegated call, resulting in ownsSAFE[safe] being set to the GebProxyActions contract.The attacker directly called GebProxyActions.quitSystem(manager, safe, dst), bypassing the safeAllowed check of GebSafeManager and transferring the collateral to themselves.

According to The Defiant, the Fogo mainnet has stopped producing blocks for about 46 hours since Saturday afternoon due to an attack on the Fogo Foundation, resulting in 4 million FOGO tokens (approximately 10.3% of the circulating supply) being transferred to the attacker's address. The foundation initially stated that the chain itself was unaffected, but 15 hours later, the network was actively paused, and plans were made to restrict the related addresses through an upgrade. Currently, the Fogo official explorer shows the last block as 718,525,971, and the RPC endpoint returns a 502 error, while the on-chain TVL tracked by DefiLlama has been frozen at $987,000 for three consecutive days.This downtime is attributed to Fogo's validator design: the chain is managed by a council of 7 voting validators, with the foundation staking evenly among 7 operators, allowing for coordination to pause and implement a client-level address blacklist within minutes. On the exchange side, both KuCoin and Gate have disabled FOGO deposits and withdrawals but retained trading, with a 24-hour spot trading volume of approximately $2.3 million. Meanwhile, a Twitter account impersonating the Fogo Foundation, @FcgoFNDN, posted a false compensation voting link, and Fogo officials reminded users to rely only on information from official channels.Fogo is the second network to actively pause over the weekend, following Cronos, which rolled back its state due to an attack on the Tectonic lending protocol. Fogo raised approximately $7 million by selling 2% of its supply through Binance before launching its mainnet in January, with a valuation of $350 million. The foundation has not yet disclosed details of the attack, compensation plans, or a restart timeline.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

On-chain detective Specter posted on the X platform, stating that considering the time period covered by the stolen data, this could mean that the data breach occurred as early as April, and no later than early May. However, the parties involved chose to remain silent until recently, roughly at the same time Trezor announced its own data breach.Some users had already received phishing attacks and suffered asset losses at that time, but the parties involved did not maintain transparency, warn users, or provide risk alerts, instead denying the data breach.

A wallet security incident involving approximately $130 million in Bitcoin losses is reigniting discussions in the crypto industry about asset custody models: should Bitcoin holders rely on personal self-custody or turn to institutional custody? Hardware wallet manufacturer Coldcard had a vulnerability in its firmware in 2021 that led to some mnemonic phrases generated by the device being predictably risky. This vulnerability was discovered years later, and approximately 5,200 addresses and about 2,000 BTC have been stolen, with losses amounting to around $130 million.After the incident, some investors began to turn to Wall Street custody products. Data shows that the U.S. spot Bitcoin ETF saw a net inflow of about $626 million within days of the incident. Bloomberg ETF analyst Eric Balchunas stated that such security incidents could further drive funds into ETFs. However, the Bitcoin core community still insists on the self-custody concept. Casa co-founder Jameson Lopp stated that recent events should not undermine users' confidence in self-custody and pointed out that third-party custody also carries risks. Bitcoin Core early developer Peter Todd also believes that self-custody has a better long-term safety record than centralized institutions.Onramp co-founder Michael Tanguma believes that both options have flaws. He stated that concentrating a large amount of assets in a single institution creates a "honey pot," while hardware wallets face risks related to supply chains, firmware, and random number generation. Tanguma proposed a "multi-institution custody" solution, where multiple regulated institutions hold keys through a multi-signature mechanism, requiring multiple institutions to jointly sign any transaction to reduce single points of failure. However, this model has also sparked controversy. Critics argue that while multi-institution custody enhances security, it also introduces permissioned management, conflicting with the decentralized ideals originally pursued by Bitcoin. As Bitcoin gradually enters the fields of pensions, trusts, and institutional asset allocation, the industry is seeking new custody solutions suitable for long-term wealth management. The Coldcard vulnerability incident once again highlights that achieving a balance between security, decentralization, and usability remains a core challenge facing the Bitcoin ecosystem.

Christopher Smith, founder of the blockchain startup Quantus, stated that the first quantum attack may manifest as a series of unexplained thefts of cryptocurrency wallets, rather than directly stealing the approximately $63 billion worth of dormant Bitcoin expected from Satoshi Nakamoto. He pointed out that sufficiently powerful quantum computers could derive private keys from public keys exposed on the blockchain, allowing attackers to transfer funds without needing to breach wallets, devices, or internal systems of exchanges.In theft incidents at highly secure institutions, the only forensic evidence may be the absence of intrusion traces. Smith indicated that the initial targets of quantum attacks could be military systems and national secrets; in the blockchain space, the minting keys of stablecoin issuer Tether may be of greater value. Attackers could mint tokens out of thin air through managed wallets and sell them off before the issuer responds. Google has accelerated its post-quantum migration timeline to 2029; Smith believes the probability of quantum computers breaking modern cryptography around 2028 is "50-50." Relevant blockchains have begun migrating to post-quantum signatures.

In 2025, the amount of cryptocurrency theft reached $3.4 billion, with Bybit suffering a loss of $1.5 billion, accounting for 44% of the total for the year. In the first half of 2026, there were 212 related incidents, resulting in losses of approximately $1.1 billion, with about 55% involving the Lazarus-linked group. KelpDAO was attacked in April, resulting in a loss of $293 million.Stolen funds typically undergo a three-phase transfer process lasting about 45 days: the first 5 days involve exchanging through DeFi protocols and entering mixing services, followed by cross-chain bridging and flowing through trading platforms with lower KYC requirements. During the 20 to 45 days period, funds are further cashed out in batches through non-KYC platforms, instant exchangers, and over-the-counter trading networks. Once funds cross multiple blockchains, mixing services, and jurisdictions, tracking may still be possible, but the difficulty of recovery significantly increases. The recovery rate of stolen funds from Bybit is less than 5%; Tether and Circle can freeze USDT and USDC addresses, and attackers typically exchange stablecoins for Ethereum or Bitcoin within minutes after the attack.

According to monitoring by Bitcoin News, Galaxy Research stated that the largest known COLDCARD theft involved 1159 BTC, spread across seven attacker addresses, which have not yet been utilized, with 0 BTC cashed out or transferred through mixers. The related BTC was stolen within 41 minutes, but approximately 600 attacker addresses have been flagged by law enforcement, exchanges, and blockchain analysis companies.Meanwhile, a smaller-scale attacker seems to have begun laundering funds. On-chain analysts tracked 64 BTC entering a mixer, of which only about 10 BTC were initially mixed, and 54 BTC were returned as change, which was then split into outputs of about 7 BTC for further mixing. Analysts noted that these unusually large outputs remain easy to trace, making this laundering attempt relatively transparent.

According to monitoring by the head of Galaxy Research, less than 1 BTC was stolen overnight through a victim's report, identifying a new attack where the attacker transferred 12 BTC from 126 addresses, with the attack footprint marked as "footprint O."

According to Bits Media, Russian law enforcement conducted a series of searches at a cryptocurrency exchange office located in the Federal Eastern Tower of the Moscow City Business Center. The police stated that the searches are related to a theft case involving 144 million rubles, with the funds suspected to have been circulated through related exchanges. They are currently tracking the transactions and investigating whether the office staff are involved.During the investigation, dozens of employees were detained, and a Moscow court has ordered pre-trial detention for eight of the defendants, while the procedural status of the remaining detainees has not been disclosed. The office temporarily ceased operations during the searches.

In the security incident involving Coldcard, a hardware wallet company under Coinkite, the amount of stolen Bitcoin has risen to approximately 1359.882 coins. The Coldcard Sweep Watch dashboard statistics show that most of the identified Bitcoin still remains in a few addresses controlled by the attacker.On August 1, a holding address of the attacker received a transaction containing OP_RETURN information. This information publicly offered "cleaning" Bitcoin, KYC assistance, and cash-out services for a 10% fee, along with a Telegram contact.Coinkite has released an emergency firmware update to eliminate the weak random number generation issue that caused the original vulnerability. The company stated that the new firmware only protects wallets created in the future and cannot fix seeds generated in the affected versions.Some users reported that after installing the update, their devices remained on an error page, failed to start, or appeared to be bricked, mainly involving Mk4 and Q devices, with some Mk3 users reporting similar issues. As of August 2, Coinkite has not publicly confirmed the existence of widespread firmware defects.

The Slow Mist security team issued an alert that an unverified contract exposed an unrestricted low-level call vulnerability due to selector 0x42be3129, lacking access control and target data validation, resulting in approximately 16.6 WETH being stolen.The attacker exploited the existing ERC20 allowance of the contract to bypass the owner check and execute unauthorized transferFrom operations.

According to monitoring by Blockaid, Garden's HTLC is currently under attack, with approximately $450,000 USDT stolen on Ethereum, Base, Arbitrum, and BNB Chain.In response, Garden tweeted that they have detected unusual activity, temporarily shut down the application, and launched a comprehensive investigation. More information will be released later.

On-chain data shows that cryptocurrency theft suspect Dritan Kapllani Jr laundered 126.7 ETH again on July 22, worth approximately $239,000.Previously, on-chain detective ZachXBT revealed that Dritan Kapllani Jr is suspected of stealing assets from cryptocurrency holders through social engineering techniques, with a total amount involved reaching $19 million. Dritan Kapllani Jr has long showcased a lifestyle featuring luxury cars, high-end watches, and private jets on social media, and publicly displayed assets worth $3.68 million in his Exodus wallet during a Discord call on April 23, 2026.

Cardano ecosystem wallet SecondFi stated that approximately 16.1 million ADA were stolen due to a vulnerability in the wallet software, valued at about 2.6 million USD. The platform will gradually shut down SecondFi and Yoroi wallet services. This incident affected 374 wallets.SecondFi indicated that an independent investigation by blockchain intelligence agency Groom Lake identified the attacker as a sophisticated external actor and found indicators possibly related to North Korea's Lazarus Group, but attribution has not yet been confirmed. SecondFi is developing a recovery tool based on zero-knowledge proofs to help affected users recover their assets and limit the information that needs to be shared. The tool is still in testing and will undergo third-party auditing before its planned release in August. SecondFi is also preparing a wallet export feature that allows users to migrate their assets to other services. The platform has not announced a direct compensation plan and has not specified whether it will use its own funds to compensate users.