ChainCatcher message, ZachXBT disclosed on platform X that a hacker has stolen approximately $500,000 over the past month by compromising more than 15 X accounts (Kick, Cursor, Alex Blania, The Arena, Brett, etc.). These accounts were targeted through phishing emails impersonating the X team to steal credentials, followed by initiating Meme coin scams. The attacker has been bridging transfers back and forth between Solana and Ethereum in an attempt to obfuscate the source of the funds.All email attacks seem to follow the same script:Send fake copyright infringement emails;Create a sense of urgency;Lure users to visit phishing sites and reset 2FA/password.

ChainCatcher News: A judge in Hartford, Connecticut, Michael P. Shea, recently sentenced 31-year-old West Hartford resident Dylan Meissner to 48 months in prison for stealing over $4.4 million from his former employer. Meissner worked as the Vice President of Finance at a cryptocurrency research company and had access to the company's cryptocurrency wallets and bank accounts.In early 2022, Meissner obtained a loan of 50 Ethereum (approximately $170,000) from the company, claiming he would use the funds to avoid personal cryptocurrency investment losses. However, between February and November 2022, Meissner began misappropriating company funds to cover personal trading losses and concealed his actions with false records. Ultimately, he stole approximately $4,461,828 through this scheme.Judge Shea also ordered Meissner to pay restitution of $4.63 million, which includes the stolen funds and the unpaid loan. Meissner was released on a $100,000 bond and is scheduled to report to prison on February 21.According to Cointelegraph, the U.S. Department of Justice did not mention Meissner's previous employer by name in the case, referring to it in court as "Company A" and "a cryptocurrency research company," but Meissner was employed by Delphi Digital at the time of the crime. Meissner's attorney also referenced "Delphi" multiple times in a sentencing memorandum submitted earlier this month, indicating that it is the name of the company.

ChainCatcher message, Slow Mist's Chief Information Security Officer 23pds posted a reminder that recently, the well-known cryptocurrency theft Trojan MacOS Stealer has been suddenly open-sourced.Previously, its attack source code was sold for 1 BTC, and now the open-sourcing means that more malicious attackers can easily access this tool. This not only potentially allows attackers to have "one tool per person" for attacks but may also give rise to more covert and complex attack methods, posing greater challenges to the security of cryptocurrency assets.

ChainCatcher news, a man impersonating an Uber driver in Scottsdale, Arizona, has been arrested for allegedly stealing a total of $300,000 in cryptocurrency from two passengers.According to the police, the man borrowed the passengers' phones while picking them up and used the phones to transfer funds and operate cold wallets, stealing crypto assets from multiple Coinbase accounts. In the case, the man also threatened one victim, telling them to "calm down, or bad things will happen."

ChainCatcher news, according to Forbes, researchers have confirmed that a malware attack targeting macOS users has been active for four months. This attack uses malware disguised as a video conferencing application to steal passwords from Keychain, as well as session cookies and cryptocurrency wallet information from browsers like Google Chrome, Brave, and Opera.According to Tara Gould from Cado Security Labs, the attackers use AI-generated content to create fake websites and social media accounts, posing as trustworthy businesses. Victims are often contacted through platforms like Telegram, discussing business opportunities related to blockchain or cryptocurrency. Once the file is installed, users are prompted to enter their macOS password, further facilitating data theft.Security experts advise users to remain vigilant, especially regarding unfamiliar links related to business. Using protective tools like Intego VirusBarrier can effectively defend against such threats.

ChainCatcher news, the Civil Court Daily published an article titled "Criminal Qualification of Illegal Theft of Virtual Currency," which points out that the act of stealing virtual currency constitutes theft. As an economic property, it must have value, including utility, scarcity, and disposability. Scarcity is reflected in the constant total supply of virtual currency, which is not infinitely available. Disposability is demonstrated by the use of asymmetric encryption technology for virtual currency, which exists in wallets (i.e., addresses), and once the address and private key are obtained, one can control the virtual currency. Utility is reflected in the fact that virtual currency, as a specific data encoding, must be generated through "mining," which condenses social abstract labor.The article also points out that the act of stealing virtual currency constitutes the crime of illegally obtaining data from computer systems, as virtual currency has data characteristics. The illegal theft of virtual currency constitutes the crime of illegally obtaining data from computer systems. Regarding the determination of the amount of stolen virtual currency, it is more reasonable to set the amount of virtual currency involved in the case at the time the defendant committed the crime rather than when the victim purchased the virtual currency.

ChainCatcher News: U.S. prosecutors have announced charges against a teenage hacker, Remington Ogletree, who is suspected of collaborating with a cybercrime gang to infiltrate telecommunications companies. According to the charges released on Wednesday, 19-year-old Remington Ogletree is accused of hacking into two telecommunications companies and a U.S. financial institution, stealing their data and customers' cryptocurrency, resulting in a loss of $4 million.Ogletree is alleged to have worked with Scattered Spider, a hacking group linked to attacks on companies such as MGM Resorts International, Caesars Entertainment, Coinbase, and Riot Games Inc.According to an indictment released last month, five alleged members of Scattered Spider have been charged by prosecutors for hacking attacks that led to the theft of sensitive data and at least $11 million in cryptocurrency. A 17-year-old boy was arrested by British police in July in the West Midlands, suspected of being involved in Scattered Spider's activities.

ChainCatcher news, according to The Washington Post, in the early hours of Tuesday local time, U.S. Secret Service agents fired a shot at a carjacker attempting to break into the vicinity of Treasury Secretary Yellen's home. No one was hit, and the suspect has not been arrested yet. (Jin Ten)

ChainCatcher news, Microsoft detailed a group of North Korean hackers in a blog post, known as "Sapphire Sleet," who disguise themselves as recruiters and venture capitalists with the aim of stealing cryptocurrency from individuals and companies. After contacting targets with bait or initial outreach, the North Korean hackers would arrange a virtual meeting, but the meeting is actually designed to load abnormally.In the scenario of impersonating VCs, victims are forced to download malware disguised as a fix for the virtual meeting tool. In the activities of impersonating recruiters, potential candidates are asked to download and complete a skills assessment, which actually contains malware. Once installed, the malware can access other information on the computer, including cryptocurrency wallets. Microsoft stated that within just six months, the hackers stole at least $10 million in cryptocurrency, and have stolen billions of dollars in cryptocurrency over the past decade.

ChainCatcher news, according to an investigation by ZachXBT, hacker Serpent initiated a meme coin scam by controlling 9 accounts, including McDonald's and Kabosu, on X platform and Instagram, stealing approximately $3.5 million, and using part of the funds for online casino gambling.Serpent was a professional Fortnite player in Australia and was released by the esports organization Overtime in 2020 for alleged cheating. In March 2022, he co-founded the NFT project DAPE, but the project later experienced a rug pull. In March 2024, Serpent launched another project called ERROR, which also experienced a rug pull, leading to his ban from the X platform.Previous news, ZachXBT stated that attacks on social media accounts of McDonald's and the owner of Kabosu over the past few months have resulted in losses exceeding $3.5 million.

ChainCatcher news reports that, according to the indictment, U.S. prosecutors have charged five members of the "Scattered Spider" gang with hacking dozens of companies and individuals, resulting in the theft of sensitive data and at least $11 million in cryptocurrency. Prosecutors stated that approximately $4 million of the stolen cryptocurrency has been recovered, and investigators are still calculating the total value involved in the data theft.California federal prosecutors said the defendants used various fraudulent methods, including SMS phishing and SIM swapping, to obtain legitimate credentials from employees in order to gain unauthorized access to their accounts and company networks from late 2021 to spring 2023. U.S. authorities indicated that the defendants exploited this access to steal confidential data and identify and access individuals' cryptocurrency accounts and wallets.It is reported that Scattered Spider is a decentralized organization that often uses social engineering techniques to trick IT staff into accessing company networks, with some members located in the United States and the United Kingdom.

According to ChainCatcher news, as reported by the Guangming Daily, the Ministry of State Security announced a case on November 8: Wang XX, a former public official at a sensitive unit, was considered a good young man by his unit and family. However, due to losses in virtual currency investments, he incurred huge debts and was lured and incited by foreign espionage intelligence agencies, gradually leading him down the path of crime.Through investigations by the national security agency, it was discovered that Wang XX provided top-secret and confidential national secrets to the other party, obtaining espionage funds equivalent to over 1 million yuan through methods such as virtual currency recharge and trading. Ultimately, Wang XX was sentenced to life imprisonment for espionage by the people's court, with lifelong deprivation of political rights.The unit where Wang XX worked did not strictly implement confidentiality management systems and protective measures, providing an opportunity for Wang XX to steal and supply secrets to foreign espionage intelligence agencies. The national security agency, in conjunction with relevant departments, will carry out joint law enforcement work on Wang XX's unit and order it to rectify within a specified time.

ChainCatcher news, researchers from the cybersecurity company Checkmarx have issued a warning about a dangerous malware uploaded to the Python Package Index (PyPI) that steals private keys. According to the company, this malware was automatically uploaded by suspicious users through several different packages, designed to mimic decoding applications of popular wallets and other mainstream industry products like MetaMask, Atomic, TronLink, and Ronin.The malware is cleverly embedded in various parts of the packages. Since this malware appears to be harmless code, it is essentially undetectable. However, upon closer inspection, once an unsuspecting user calls specific functions embedded in the package, certain parts of the data will allow hackers to control cryptocurrency wallets and transfer funds.

ChainCatcher News, the U.S. Department of Health and Human Services Cybersecurity Coordination Center (HC3) recently released an overview of the Trinity ransomware targeting sensitive data. Attackers use phishing emails, malicious websites, and software vulnerabilities to trick victims into installing the ransomware on their computers. It then searches for and collects sensitive information on the computer and sends it to the hackers. The ransomware also encrypts the victim's files using algorithms, rendering them unusable.After encrypting the files, the ransomware generates a notification informing the victim that it has extracted and encrypted their data and demands a ransom in exchange for the decryption key. The notification also tells the victim that they have 24 hours to pay in cryptocurrency, or their data will be leaked.HC3 stated that the Trinity ransomware targets critical infrastructure, such as healthcare providers. The government agency reported that seven organizations have already fallen victim to this ransomware. "According to HC3, at least one healthcare facility in the U.S. has recently become a victim of the Trinity ransomware," HC3 reported.

ChainCatcher news, the U.S. Attorney's Office stated in a release that Indiana man Evan Light pleaded guilty on Monday to charges of conspiracy to commit wire fraud and conspiracy to commit money laundering, and stole cryptocurrency worth over $37 million from nearly 600 victims.Court documents show that in February 2022, Light was involved in a cyber intrusion that targeted an investment holding company located in Sioux Falls, South Dakota. The documents also allege that Light was accused of stealing personal information, which he then used to steal assets from hundreds of victims.The statement said, "Under Light's control, the stolen cryptocurrency was subsequently transferred around the world, including to multiple mixing services and gambling websites, to conceal his identity and hide the virtual currency."

According to ChainCatcher news, as reported by Decrypt, Bitcoin company Swan has filed a lawsuit in the U.S. District Court for the Central District of California, accusing its former employees (including former executives) of colluding with Tether to steal its Bitcoin mining business worth billions of dollars. Swan claims that these former employees stole the company's highly proprietary Bitcoin mining monitoring software code, vendor and business partner resources, and collectively resigned to establish a competing company named Proton Management.The lawsuit alleges that Tether played a significant role in this conspiracy by sending Swan a "default notice," providing "legal cover" for this hostile takeover. Swan is seeking a permanent injunction from the court against Proton to prevent further interference with Swan's mining operations and is demanding that the former employees return the stolen equipment and "confidential materials." Swan has requested a jury trial, with the specific amount of damages to be determined at trial.

ChainCatcher News, the U.S. Department of Justice today released an indictment, accusing 20-year-old Malone Lam and 21-year-old Jeandiel Serrano of conspiring to steal and launder over 4,100 bitcoins, worth approximately $230 million.It is reported that the two suspects were arrested last night and will appear in U.S. District Courts in the Southern District of Florida and the Central District of California, respectively.The indictment states that since August 2024, Lam, Serrano, and their accomplices gained access to victims' cryptocurrency accounts through fraudulent means and transferred the funds to accounts they controlled. They then laundered the proceeds through mixing services, exchanges, and VPNs, using the funds for international travel, nightclubs, luxury cars, and other luxury goods. Currently, the FBI and the Criminal Investigation Division of the IRS are conducting an ongoing investigation into the case.

ChainCatcher news, an official at Seattle-Tacoma International Airport said on Wednesday that hackers demanded $6 million in Bitcoin from the airport operator in exchange for files stolen during a cyberattack last month, which were released on the dark web this week. The official stated that the Port of Seattle, which owns and operates the airport, has decided not to pay.The airport's aviation director, Lance Lyttle, said the airport previously linked the attack to a ransomware group called Rhysida, and the FBI is now conducting a criminal investigation. "On Monday, the hackers posted a copy of eight files stolen from the Port system on the dark web and sought 100 Bitcoins to purchase this data."Lyttle told a U.S. Senate committee that the airport appeared to have thwarted the attack, but the hackers were able to encrypt some data.

ChainCatcher news, recently, McAfee discovered a new type of Android malware named SpyAgent, which can steal users' private keys by taking screenshots and using optical character recognition (OCR) technology on text within images. This malware spreads through malicious links in text messages; when users click the link, they are directed to a page disguised as a legitimate website and prompted to download a seemingly trustworthy application. Once installed, the malware can access users' contacts, messages, and local storage permissions. Currently, SpyAgent primarily targets South Korean users and has been found in over 280 fraudulent applications. Additionally, malware attacks are on the rise in 2024. The Cthulhu Stealer, discovered in August, affected MacOS systems and stole users' cryptocurrency wallet information. In the same month, Microsoft patched a vulnerability in Google Chrome that had been used by the North Korean hacker group Citrine Sleet to disguise fake cryptocurrency exchanges and spread malware through fraudulent job applications. The Federal Bureau of Investigation (FBI) has issued a warning, alerting the public that the cryptocurrency industry is becoming a primary target for North Korean hackers.