From hereon, this month shall be called SpookITober. In yet another high-profile cybersecurity incident this month, Binance.com, the world's largest cryptocurrency exchange, has been hacked, to the tune of $5.6 billion taken in various cryptocurrencies. As of this writing, withdrawals at the exchange are suspended until the company sorts out the situation, though it has stated repeatedly that "user funds remain safe," adding that it "will cover all losses." The U.S.-specific Binance.us website is so far reportedly unaffected. At least two security agencies, including TRM, have pinned the attack on an elite North Korean hacking unit.

"Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach," the company said in an update on Friday. "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them."

"TRM attributes this attack to TraderTraitor, North Korea’s premier hacking unit," the security firm said. "We base this assessment on robust on and off-chain intelligence sources," continuing to note that the group has been named responsible for a $1.5 billion Bybit hack last year. Per TRM, this latest instance bears many of the same hallmarks as earlier North Korean heists. According to CNN, an unnamed analyst at Pangolin Intelligence corroborated this story by "Analyzing the on-chain activity related to this hack and correlating with information gathered from previous known incidents [involving the North Korean cyber unit]."

Preliminary info breaks down the stolen amounts like so: $1.57b in Tether dollars (USDT), $1.45b in Bitcoin (BTC), $875m in Ethereum (ETH), $823m in Circle dollars (USDC), $234m in Tron (TRX), $88.5m in Ripple dollars (RLUSD), $75M in Wrapped-Beacon Ethereum (WBETH), $50m in Tether Gold (XAUT), and $447.5 million in other cryptocurrencies. The "dollar" currencies are all stablecoins, meaning they're pegged to $1 to represent dollars in the virtual space. Meanwhile, Tether Gold is pegged to the value of one troy ounce.

The stablecoin issuers all moved to blacklist the thief's main wallet (you can see it here on the Ethereum blockchain) in their smart contracts, a move that means the amounts in USDT, USDC, and RLUSD are frozen in place, totaling around $2.4 billion. It's possible, but not guaranteed, that the gold-pegged XAUT will also be frozen.

Note that this does not mean those funds have been recovered — the thief simply cannot do anything with those tokens, be it moving or exchanging. Normally in these situations, restitution from the frozen funds happens only after complainants provide proof of ownership, something that usually means copious time spent in courts.

The situation is a lot more grim for the amounts in pure cryptocurrencies like Bitcoin and Ethereum, among others. Since there is no governing entity for their blockchains, the most likely prospect is that the remaining $3.2 billion or so is forever lost in the ether — though some networks incorporate clawback mechanisms. Exchanges may block the thief when he eventually tries to cash out his virtual dough, but historically this hasn't been a reliable means of recovery.

Note that this is a developing story, so the tallies are subject to change. Should that amount be final, this heist would exceed the $1.5b stolen from Bybit in February 2025, of which only a paltry portion has so far been recovered. There's little info so far on the miscreant's means of larceny. Apparently, the Binance 14 , Binance 16, and Hot Wallet 34 hot wallets, which hold pooled customer funds, were drained. It's currently not known if this happened via stolen private keys, a compromised signing process, or another type of intrusion.

Binance has assured users that their funds are safe, and most importantly, that it will cover all losses. For what it's worth, the company has a means of insurance and a reasonable track record in these situations, though the amount of bullion pilfered today is exorbitant.

The company created its SAFU reserve fund in 2018, where it deposits 10% of its trading fees to cover any losses incurred from security issues. That fund currently sits at 15,000 BTC in it (verifiable here), or about $1.17b at the current BTC-USD price of $77,858. SAFU is a cold wallet, meaning its private keys are stored offline.

Back in May 2019, thieves made out with 7,000 BTC from Binance, amounting to around $40 million at the time. The company covered the entirety of the losses with SAFU funds.

However, while $1.17b is certainly a tidy sum, 'tis but a morsel of what currently looks like a multi-billion loss. Binance co-founder, shareholder, and former CEO Changpeng Zhao (CZ) stated in a tweet that he too expects that users will be made whole.

As a final note, Binance is alerting everyone to be on the lookout for contact attempts impersonating the company and/or referencing the current situation. Expect a flood of emails, SMS, and phone scams in the coming months. Be especially wary of any "compensation" or "withdrawal restoration" offers, and never click any e-mail links or otherwise offer any account information — always use the official website or applications yourself directly.

A hacker has successfully breached a vulnerable server, claiming a prize pot worth $2,021.22 in Bitcoin after exploiting PHP2Shell vulnerabilities, a posting on the Steal My Bitcoin website has shown. The challenge's creator confirmed the win on October 25, ending an experiment designed to test claims that exploiting critical software vulnerabilities is becoming easier.

The challenge, hosted on the website a day earlier and announced through a forum post, initially offered approximately $502 worth of Bitcoin. Donations subsequently increased the pot to 0.02511679 BTC, worth $2,021.22 at the time of the win. The creator's website recorded the successful claim at 15:47 UTC on October 25, after the challenge had been running for approximately 19.28 hours.

The experiment follows the disclosure of CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that can allow remote code execution under certain conditions. The flaws received critical severity ratings, and fixes were released on October 21. Turning the vulnerabilities into a reliable attack, however, requires more than simply running a publicly available exploit against an arbitrary server.

The challenge's creator, posting under the name ‘cloudlandsdev’, had said the project was designed to see whether anyone could use the vulnerabilities to compromise the server and claim its Bitcoin. “Made this because I'm curious if anyone out there has figured out how to actually use this PHP RCE, we spent the last few days panicking. Have fun!” the creator wrote.

PHP2Shell refers to two vulnerabilities in PHP’s request-handling and memory-management processes. Under vulnerable configurations, an attacker could potentially exploit these flaws to execute code with the privileges of the web server account.

The experiment quickly attracted attention, but the resulting traffic also became a problem. In an update, the creator said visitors were exhausting the server's available computing resources shortly after each capacity increase. Limited storage also prevented the server from retaining all its logs, complicating efforts to document a successful attempt.

The winner, ‘KillaBoi’, published a proof of concept on GitHub describing the attack against the live challenge and providing a local test environment. The exploit took advantage of PHP's handling of multipart uploads and session data, where, by pushing a PHP worker beyond its memory limit, the attacker could leave internal state in an inconsistent condition. Subsequent requests then exposed memory contents through session cookies, providing information about the locations of PHP's memory structures and executable code.

Notably, the attacker used those addresses to construct a forged PHP data structure that triggered command execution during cleanup. The final request returned evidence that the command had run inside the PHP process. Although the server was successfully compromised, the recovered private key did not match the advertised prize address. However, on-chain data shows the funds were subsequently sent to an address “bc1qr4…lk7a9”, labeled as a Kraken cold wallet.

Bitcoin recovery efforts have previously involved reverse-engineering software rather than exploiting a live server. In 2024, hardware hacker Joe Grand, known as ‘Kingpin”, and researcher Bruno recovered access to 43.6 BTC belonging to an owner identified as Michael, who had forgotten a 20-character wallet password.

The researchers reverse-engineered an older version of RoboForm's password generator and identified a flaw that made the password predictable. They recovered the wallet in November 2023, when the Bitcoin was worth approximately $1.6 million. Its value had climbed to nearly $3 million by the time the recovery was reported in May 2024.

A more recent case involved a Bitcoin holder who recovered five BTC worth roughly $400,000 in May 2026 after losing access to the wallet for years. The pseudonymous owner, known as ‘cprkrn’, said Anthropic's Claude AI helped identify a backup file from December 2019, which could be decrypted using a password the owner had previously written down in a notebook. The backup contained the keys needed to access the Bitcoin.

The latest event comes as security teams face pressure to patch PHP installations following the public disclosure of PHP2Shell. A separate report on the vulnerability disclosure controversy detailed how premature publication disrupted the coordinated release process. That said, for now, evidence of the latest successful attack suggests that exploiting these PHP vulnerabilities may not be that hard after all.

A developer using Claude Code to help build a temperature monitor app got a friendly warning from the coding agent. “Your Mac is running a crypto miner that I didn’t put there,” flagged the helpful agent. “I saw xmrig using about 1175% CPU, roughly 12 cores,” it informed its human master. Perhaps developer and Redditor UntilHEX should have sensed the crypto miner’s presence without AI help, as they admitted the malware’s presence “explains why my Mac has been running like s**t.”

Ironically, the cryptomining malware’s nefarious CPU cycle hogging activity is what may have led to its discovery and demise. Pondering over a screenshot of the Claude Code window, we see that this malware was probably added to the Mac’s startup roster on August 29. It looks like UntilHEX was inspired to develop a Mac temperature monitor app after this infection to track and diagnose why the computer was running so hot.

Claude stepped in after the Redditor was concerned about a dump of the Mac’s raw temperature sensor readings. “They seemed far too high,” commented UntilHEX in the social media post. Indeed, the well-known coding agent pointed out that the CPU was peaking at a very toasty 112 degrees Celsius. It explained this was due to a sustained heavy load, specifically “xmrig using about 1175% CPU, roughly 12 cores.” We don’t know how many cores the Mac being used had, but maybe 12 were all of them.

Claude Code went on to describe how the crypto miner software had hidden itself on the Apple computer and ran at startup. It cautiously decided not to kill or remove anything from the Mac, but offered to clean up the CPU-hogging crypto miner, which was sucking all the power from the Apple Silicon computer. “Can I clean it up now?” Claude inquired. “I’d stop the startup item and the miner, and move the files into a quarantine folder.”

Later in the comments, UntilHEX informed the social media throng that Claude was indeed tasked with cleaning up the unwanted crypto miner software. “I only had to delete 1 file manually because Claude had an access issue, but it was very effective,” the Redditor said. After that, a Malwarebytes scan was run to check to see if the AI coding agent-driven clean had really been successful.

Ledger is reviewing its sales policies and how its devices reach customers after the “Cryptobilis incident,” in which physical tampering along its supply chain led to $93 million in cryptocurrency theft from user wallets, according to a Bloomberg report on October 13. The crypto hardware manufacturer’s CTO, Charles Guillemet, confirmed in a social media post that it is also reviewing anti-tampering protection on its devices following the incident. He told users with tampered signers (hardware wallets) to contact Ledger support for shipping instructions to send the devices in for further examination. Guillemet also advised users who wanted to physically open their signers to check for tampering to review the company's guidelines on how to do so safely.

In a separate post, Ledger CEO Pascal Gauthier said, “Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can,” confirming the company's plan to review its chain-of-custody and tamper detection practices. The company is inviting researchers and other vendors to collaborate in assessing these practices.

The incident that prompted the reviews was first noticed on Friday, October 9, when hundreds of otherwise secure wallets drained simultaneously across the Bitcoin, Ethereum, and Tron networks, triggering a massive alert across social media and blockchain security networks. Several victims came online to report losses and try to figure out what was happening. Early investigation revealed that almost all the affected wallets had been procured from CryptoBilis, an authorized third-party reseller covering Malaysia and Southeast Asia. Ledger ordered CryptoBilis to immediately halt all sales and shipments.

After further investigation, Ledger officially announced on October 10 that it had discovered a physical, unauthorized hardware implant equipped with a cellular/LTE module inside an affected user's device. It turns out that the attackers had manually installed the chips in brand-new devices at some point in the supply chain. When a new user is generating or verifying their 24-word recovery seed phrase on the wallet's screen during initial setup, the rogue chip records the OLED output or reads the raw hardware data lines carrying the text.

The integrated cellular chip then silently transmits the unencrypted recovery phrase over LTE networks directly to the attackers' external command servers, granting them full remote access to clone the private keys and drain the associated cryptocurrency funds. The hardware modification completely bypassed Ledger's standard automated “Genuine Check” software protocol, as it sat entirely outside the microchip running Ledger's standard firmware.

Ledger has stressed that its internal infrastructure, firmware code, and direct-to-consumer sales channels through Ledger's Official Store remain entirely uncompromised. The company has advised users with wallets from third-party resellers to transfer funds to a separate wallet secured by a freshly generated, uncompromised 24-word recovery phrase while it conducts further investigations. It is also restructuring its vendor verification and supply chain requirements, instructing distributors to enforce tighter tracking, source only through approved channels, and strictly ban the restocking or resale of returned units.

Cryptocurrency enthusiasts are often advised to acquire a hardware wallet like one of the Ledger models, theoretically adding the ultimate layer of security. And yet not even that approach is 100% safe, as a currently unfolding investigation revealed that Ledger resellers in Southeast Asia and Europe are carrying hacked wallets laden with eSIM and LTE modules for exfiltration of recovery phrases. At least $93 million (and going) has already reportedly been siphoned off users' balances. Hardware sold directly by Ledger is so far unaffected.

The first booby-trapped wallet originated from reseller Cryptobilis, which has currently ceased all sales of hardware wallets of all brands. The offending unit came from a store in Malaysia, though Cryptobilis also sells in Indonesia and the Philippines. Researcher Mark Karpelès has been looking into hacked wallets for a while now, and one of them came via Amazon Japan, bought from a Chinese seller and shipped from Malaysia. Cryptobilis also sells other brands of wallets such as Trezor, Coolwallet, and Tangem, though so far there is no news of contamination beyond Ledger.

Ledger recommends that users who bought wallets from Cryptobilis in the past 90 days do not perform their initial setup, as that's where the private key exfiltration reportedly occurs. To those who have already done so, Ledger recommends moving their assets to a new wallet with a new seed. The data theft is performed by hiding a flexible PCB under the display assembly to capture the pixels showing the private key entered during the first setup. The information then heads off to the aforementioned eSIM+LTE combination for exfiltration.

Meanwhile, new reports have come in from Europe, as techie Johannes, seemingly located in Germany, found at least two hacked wallets at MediaMarkt, a well-known tech and appliances retailer. He bought one unit and found that it had the same exact hardware modifications as its Asian counterparts, suggesting that the Asian and European events may be related. Johannes then bought a second one at a different MediaMarkt location, and sure enough, it was also modded.

Notably, most hacked wallets found so far are confirmed to be brand-new units instead of returns. Malfeasants will often buy new hardware and return it to the store with modifications, so that the next unsuspecting customer gets bit.

Johannes had a MediaMarkt employee at one of the stores look up the wallets' stock information, and at least the one unit came from Aqipa GmbH, a Europe-wide distributor — meaning the blast radius may be much wider than MediaMarkt or Germany. Since this is a recent development, Ledger hasn't published any guidance, though we imagine it'll be similar to the aforementioned steps.

In his blog post, Mark Karpelès notes that earlier iterations of hacked wallets with eSIM cards had hand-made implants, but that, concerningly, the hardware bolt-ons inside the latest finds appear to be manufactured to order. If true, this might mean that there's a production line somewhere intercepting Ledger wallets and manufacturing hacked wallets in bulk.

Ledger publishes instructions detailing how users can verify the physical integrity of their wallets, including pictures of every component, for every model of wallet the company offers, so they can closely inspect for add-ons. Likewise, prospective users should only download software from the official Ledger website URL — a task made harder by numerous scam sites with booby-trapped software, pretending to be the official ones.

North Korea may be behind a hack that drained over $387 million from crypto exchange Bitget, according to the company’s CEO Gracy Chen. Speaking during an X livestream on the evening of the September 24 hack, Chen said that the attack — the biggest in 2026 so far — bore the hallmarks of North Korean state-sponsored threat actors, citing suspicious IP addresses tied to VPN infrastructure previously used by North Korean hacker groups.

According to Chen, Bitget detected abnormal transfers from some hot wallets on Thursday afternoon Eastern time. The hackers exploited a backend wallet system that processes wallet transactions, forging transfer approvals that tricked the system into authorizing the fraudulent transactions. She confirmed that cold wallets and private keys remained safe and uncompromised. The stolen assets include Ether, XRP, USDT, USDC, Avalanche, and BNB across the Ethereum, XRP Ledger, Avalanche, BSC, and Arbitrum networks. Early independent on-chain analysis initially put the total stolen value at $170 million to $183 million, before Bitget announced an initial official value of $351.6 million. Comprehensive audits revised the final official value to $387.5 million.

Bitget temporarily froze user withdrawals, while deposits and trading remained functional. The company announced that its over $464 million User Protection Fund would cover the full loss. It says it has fixed the backend vulnerability and is rolling out a staggered withdrawal schedule — starting Monday, September 28 — to manage network traffic and ensure complete infrastructure security.

After the attack, the hackers quickly converted the USDT, USDC, and tokenized gold (XAUt) directly into ETH on decentralized exchanges within minutes of the theft to circumvent on-chain blacklisting or freezing of the stablecoins. Native layer-1 assets like XRP, ETH, BNB, and TRX, which cannot be frozen or reversed, were quickly fragmented and distributed across dozens of new attacker-controlled wallets. Meanwhile, Bitget launched a recovery-bounty program offering rewards of up to 5% for funds successfully frozen or recovered.

The incident is the latest in a series of hacks in the crypto industry. Earlier this month, attackers drained $320 million in Bitcoin from the Liquid Network, emptying nearly 95% of its federation wallet. A similar incident occurred in April when crypto platform Drift lost $270 million in a hack. Many of the hacks that have plagued the crypto industry have been linked to state actors, with North Korea leading the pack. In February 2025, the FBI identified the North Korean hackers as the perpetrators behind the biggest crypto hack in history, stealing over $1.5 billion from Bybit.

An Nvidia-backed startup plans to establish a Bitcoin mining operation in space before the year is out. Starcloud will fire up its cryptocurrency mining ASICs after its second spacecraft reaches orbit later this year. “We’ll be the first to mine Bitcoin in space,” claimed Starcloud CEO Philip Johnston in a recent interview with Documenting Bitcoin.

Starcloud was founded in 2024 with the headlining goal of moving data centers to space. “As launch costs fall, data centers in space will leverage continuous solar energy and radiative cooling, rapidly scaling to gigawatts while avoiding permitting constraints on Earth,” reads its mission statement. The firm spells out its proposition in far greater detail in a white paper on its website, highlighting the appeal of training AI in space. However, the ample supply of solar energy is also great for cryptomining.

So, when Starcloud-2 reaches orbit, it will be tasked with raising some crypto-cash. In the embedded interview segment, Johnston said: “We’ll have some Bitcoin mining ASICs on the second spacecraft launching later this year.” At the time of writing 1BTC is worth roughly $86,000, quite a way down from highs several months ago.

Starcloud-2 is just the second of four currently planned satellite launches from the startup. It is framed as the company's first commercial mission, and like the prior satellite, will feature a GPU cluster. Interestingly, the official Starcloud-2 project page doesn’t mention Bitcoin mining or ASICs, so Johnston’s reveal is quite eyebrow-raising. Moreover, for something that seems a bit like an afterthought, “Potentially it [Bitcoin mining] is one of the most compelling use cases of space compute,” the Starcloud CEO told Documenting Bitcoin.

Johnson provided some financial insight into why there is now a Bitcoin side gig or pivot being considered. He cited the lower costs of ASICs vs. GPUs: they are about 30x cheaper than GPUs per kilowatt, he told the host. A specific example given was a 1KW Nvidia B200 chip at $30,000 vs. a 1KW ASIC at $1,000. Solving the energy supply situation in space for GPUs, or for ASICs, isn’t relevant to the business, said Johnson. We wonder what Nvidia will think about that.

While the availability of near-uninterrupted solar power is a big attraction of space-based compute, there are downsides. For example, satellites aren’t easy to service, and convection cooling doesn’t work in a vacuum. Commercial space-based data centers are so new that some of the problems and solutions will only become entirely clear after pioneering deployments like the Starcloud-2.

A project claimed to represent “the first organic neuron Bitcoin miner based on the fly brain” has gone live. Yes, this is a cryptomining project that leans on the fruit fly connectome recently shared by Google. FutureBit, the company behind the Apollo series of ASIC miners, introduced the world to its HashFly this week. However, HashFly is merely a proof of concept for now.

If you open the dedicated HashFly site, you can also participate in this agitation of fruit fly brains in the (vain) hope of a crypto payout. I clicked the 'Mine' button and left it running for an hour, for science, and periodically flipped back to the tab to see the gently rotating fly brain’s neuron traces firing. Looking at the website overlay, one can see the web app represents “2,914 traces firing” within the fly’s brain. It is worth mentioning that this figure is just a small subset of the full 165,122 reconstructed neurons in the MaleCNS v1.0 fruit fly connectome.

We understand that FutureBit’s HashFly focuses on the simulated photoreceptors that would usually sense light in the fly’s eye. These read a block header, and neurons called PPL101 cells light up when a double-SHA-256 target is computed. You can make the target harder and easier by adjusting the ‘zeros’ up and down. Even at maximum difficulty in this proof of concept (level 6), it is far, far easier than finding a real Bitcoin hash, and I saw about 80 blocks checked off in an hour or so.

What’s the point of this proof of concept? According to its designers, it provides some more insight into the potential efficiency of organic computing, or wetware. “Fun fact,” teases FutureBit. “If this could be scaled on real organic neurons, it would hash at ~ 1 watt per terahash... 10x the efficiency of the best silicon 3nm ASICs!” These guesstimates are based on “total power used by the fruit fly, and assuming all neurons could be used to hash Bitcoin functions and continually keep firing,” says the Bitcoin mining hardware maker in a follow-up tweet.

Those who find this experiment interesting may be happy to hear that the HashFly demo will be scaled up to its logical conclusion. “We are working on simulating all neurons in the dataset with the sha256 hash function and will publish all our findings,” says FutureBit. It certainly needs scaling up if my HashFly web performance of ~100 kH/s is typical. Compare that to the firm’s 5-inch cube Apollo III, which is claimed to deliver “up to 18 TH/s of Hashpower.”

We’ve seen a few other fly brain connectome mapping-inspired projects from the fevered minds active on social media over the last week or so. Almost immediately after Google announced it had published the complete brain and central nervous system of an adult male fruit fly, we saw people seeing if it could play Doom, indulge in financial day trading, and many more frivolous pursuits.

There’s even a rival cryptomining scheme dubbed the FlyMiner. Visiting this portal, you can see a fruit fly connectome that has been put under the control of an ASIC miner. Visiting that site will also be limited to a brain-nourishing, not money-spinning, activity, as FlyMiner admittedly has “almost zero chance” of mining success.

Symbiosis is one of the many useful DeFi networks that let users trade across almost any crypto pair without having to talk to an exchange. It's been operating for five years, and links some 50-odd chains together. The ecosystem's reliance purely on smart contracts (code that's hosted on the blockchain, visible to anyone) is fully logical but paradoxically creates an accountability problem. This was demonstrated on September 11, when Symbiosis got hacked to the tune of at least $770,000, or 9.97 BTC.

Smart contracts are published on the blockchains themselves and are open-source by definition. This means anyone can find a bug, and Symbiosis' thief found two: an undisclosed privilege escalation exploit that let them fake network administrator privileges, plus a Coding-101 failure of not checking if a transaction fee was a positive number.

The method was simple: being an admin, the thief set the transaction fee to a negative value, then issued 12 transactions. With the transaction fee now negative, instead of deducting from the moved amount, it added to it. The thief only spent 330 satoshi (the smallest unit of BTC), about 25 cents, but he managed to issue 46 billion syBTC — BTC wrapped in Symbiosis' network. For reference, the maximum theoretical amount of BTC in circulation is 21 million.

These syBTC tokens meant nothing by themselves as they weren't backed, but they were tradable. And trade the thief did, selling syBTC against matching wrapped pairs including BTCB, cbBTC, WBTC, and RBTC, draining those pools, and causing $770,000 worth of BTC in damage. It's known that they only converted about $336,000 into cash via Uniswap before being cut off.

The rest of the wrapped BTC tokens were flagged by security firms and exchanges, making it difficult for the thief to use. That's of little comfort for the victims, though, until such time as the thief returns the tokens by themselves or by law. Some of them, like Coinbase's cbBTC, are issued by centralized entities and can be nullified and re-minted after a legal process, but others like RBTC cannot.

For the uninitiated, DeFi (decentralized finance) pools can be broadly described as automated trading pots. They run on existing blockchain networks like Ethereum or Solana, via smart contracts, and let users trade directly against the money in the pool, with no third party in between. Depositors providing liquidity to the pool get a cut of transaction fees whenever other users trade for it.

Example: lock 1 ETH, and you get a small amount whenever someone buys or sells ETH, effectively netting you "interest" on held currency with next to zero effort. The trader didn't have to interact with anyone: just with a piece of code, the smart contract. To make the transactions work, DeFi networks "wrap" other tokens in their own variations, like BTC turning into syBTC.

Symbiosis says it intends to repay the incurred debts, stating that "a portion will be returned from the evacuated funds, and each LP will be offered an individual compensation plan." In practice, this ultimately means that Symbiosis is going to talk to the big wrapped-BTC holders in its pool and offer them an IOU, interest-bearing debt package, or some variation/combination thereof. In these situations, it's somewhat expected, but not guaranteed, that big holders take the deal, as forcing liquidation would end the network entirely and net them pennies on the virtual dollar.

The project also said it's going to rewrite the Bitcoin-side logic and has requested an independent audit before implementing the new code. Likewise, it claims it requested a full audit of the "entire system." Symbiosis also says that "capable AI models have lowered the cost of finding bugs like this," a perfectly valid argument — and yet one that isn't likely to find much purchase given the code's high-risk nature involving money, plus the base fact that someone missed a basic negative-value check in only what's likely only a few thousands lines of code total.

The country of Venezuela has had a few embattled decades, but it has massive oil reserves continually attracting buyers, despite the U.S.-led sanctions that effectively block dealings with the nation. A few years back, in 2023, Poland's state-backed Orlen energy group had $600m in hand and was looking to buy 6 million barrels during a sanction reprieve. Like many before him, one executive thought it expedient to use the USDT stablecoin cryptocurrency (1 USD = 1 USDT). It didn't end well, with $230 million worth of crypto unaccounted for at multiple stages in an adventure chronicled by the Financial Times.

The twisted web of transactions

Orleen enlisted an external company, Hannon, to take care of the purchase, which it did by enlisting the services of UK firm Lexcor Energy, which supposedly had a Venezuelan office. Hannon first needed to convert a large sum into USDT, and did so by exchanging $245m at multiple Dubai companies, adding $15m of its own to the deal. Only one of multiple transfers of $80m into 80m USDT was fully successful.

As for the other two, $135m exchange only produced 85m USDT out the other end, with $50m still unaccounted for. A third exchange of $30m also vanished (partially returning much later). The proverbial PNL is currently -$80m, and Hannon has 165m USDT in hand. All this while, three Polish oil tankers headed to Venezuela anchored there, continually racking up millions in demurrage and port fees, as they were being chartered for far longer than initially agreed.

Weeks of delays followed, which Hannon pinned on Venezuelan energy company PDVSA. One of Hannon's reps, Kam Tse, headed to Venezuela himself with a colleague, loaded with the USDT, stored in multiple cold wallets on USB sticks. They stayed in high-end hotels, drove around in armored cars, and employed bodyguards out of concern for the money and themselves. Tse found many brokers claiming to be from PDVSA, a cadre later revealed to contain a substantial number of con-men, many of whom fled as a local investigation came cracking down.

The buyers were nevertheless undeterred, and they handed 60m USDT in a USB wallet to a purported representative of local energy corp Synergy. After a few weeks of waiting, a Venezuelan office sent him a picture of a purported PDVSA export schedule displaying all three Polish tankers set to be loaded with 1.9m barrels of oil each, but with no predicted date. Ever-trusting, Tse's team then handed Synergy's representative another 50m USDT on another USB wallet. Said representative vanished in a cloud of smoke. PNL currently sits at -$190m.

Seemingly desperate, Tse ordered a buy of 1 million barrels of a lighter blend of oil, eventually finding it contaminated, then switched tactics to acquiring fuel oil instead, signing a contract. At last, a break: some of the money spent in the Dubai exchanges came back; only 21m USDT out of a $30m input, but still better than zero. Tse pays Consulting Services, another Venezuelan firm, 11m USDT for the fuel.

Finally, some good news: 500,000 barrels confirmed loaded onto the one ship, half of the contracted amount. Tse provides Consulting Services with another 11m USDT for the rest of the fuel, but that was never delivered, and there was no further contact. Cumulative PNL = -$186m total. With $72m in shipping costs in total (far outweighing the expected profit), plus additional expenses, the Polish government's investigation pins the total lost and spent at $424m.

The aftermath

Many folks' gut reaction may be that the use of cryptocurrency made the cash untraceable, but the problem isn't with the blockchain. In fact, for the vast majority of currencies, the on-chain ledger offers more visibility into transactions, not less. What failed here was the lack of official records linking wallets to persons or entities.

Reputable exchanges all have a form of identity verification, known as KYC, mandated by law. The problem is that apparently almost no entities Hannon traded with had any recognizable proof their crypto wallets belonged to them. The Venezuelan crude oil salesmen vanished, effectively cutting off nearly every avenue for investigation. Before their exchanges, they had even advised Tse to not keep records of their transactions due to the government's investigation into their collective's dealings.

Even in Dubai, pending court cases regarding the dollar-to-USDT exchanges hinge on the same problem, despite the presence of verifiable bank transactions. Broadly speaking, the country's legal system places the burden of proof fully on the accuser, making them prove wallet ownership before discussing the meat of the dispute. That's quite the high bar to clear for Hannon in order to prove that it wasn't handed the funds from the exchanges.

That task may well prove impossible, since one can't prove a negative when there's nothing linking the exchange to their wallet. Adding insult to injury, the two exchanges in the court were both recently created, and probably weren't a part of Dubai's VARA program for legal crypto operations. Caveat emptor.

There is increasing evidence that Mexican drug cartels are diversifying into cryptocurrency mining and are using crypto platforms to diversify their income and, at the same time, launder their ill-gotten gains and fund other illegal activities. Reuters reports that local Mexican police uncovered a clandestine cryptocurrency farm in Tlaola, a town located in the leafy mountains of Puebla's Sierra Norte region. They found 300 GPUs, electricity infrastructure, and satellite equipment. The electricity-hungry operation likely drew power by secretly tapping into the grid at Presa de Necaxa, a nearby hydroelectric dam.

While this latest hidden facility found by police may seem small, Reuters notes it is the fourth such crypto farm Mexican authorities have uncovered in this region since early last year. According to a Mexico-based security analyst, the crypto farms discovered show that the cartels are increasingly sophisticated in their operations. In the latest bust, the Mexican federal authorities, the Navy, and state police seized around 300 GPUs, 80 medium-voltage terminations, a transformer, and eight satellite antennas.

It might not be surprising to hear about the Mexican cartels being tied up in crypto. Blockchain analytics firm Chainalysis, as cited by Reuters, reckons illicit crypto transactions grew from $59 billion in 2024 to $154 billion last year. The firm links the surge recorded to sanctions evasion involving governments. However, in South America, cartels are increasingly interested in using this channel to launder money. The mining operations are also integrated into the scheme, as stealing electricity is easy for organized crime. Mainstream consumer GPU mining ended in H2 2022, flooding the market with used graphics cards.

The source report doesn’t say how authorities found the crypto farm. Perhaps locals in this remote area of Puebla alerted authorities to the operation. Two folks from neighboring communities told Reuters that they could hear the crypto farm noise (transformers, cooling) from a kilometer away (0.6 miles), and the place was apparently a mere 2 km (1.2 miles) from the nearest village. The other three recently uncovered crypto farms were also near the same HEP dam, it is noted. Tlaola is a small community with around 20,000 inhabitants, so the noise levels and power consumption of crypto farms are very perceptible even if the cartels try to hide them deep in the mountains.

Remote communities, such as Tlaola, are popular locations for clandestine crypto farms because the electricity is cheap and most of them are under the protection of the cartels. For example, the Cartel Jalisco Nueva Generación (CJNG) and its armed branch, La Barredora, have the strongest presence in Puebla.

According to SILIKN, a Mexican cybersecurity firm, the use of cryptomining to launder illegal money rose by at least 55.8% last year in México. Drug cartels such as the Cartel de Sinaloa and the CJNG have set up crypto farms to mine Bitcoin (BTC), Monero (XMR), and Tether (USDT).

Similarly remote, illicit cryptomining facilities exist around the world, with Reuters recalling news of raids in Brazil, the U.S., and Thailand. Do you think there’s one near you? Please call the local police and liberate those stressed GPUs. Meanwhile, analysts expect crypto-related crime will reach new heights in the coming years.

The ringleader of a cybercrime gang, which reportedly formed after meetups in Minecraft online, has pleaded guilty to a racketeering charge. Sentencing is yet to be finalized, but 22-year-old Singaporean and Miami resident Malone Lam could face 20 years behind bars. Lam is accused of helping to steal and launder hundreds of millions of dollars in cryptocurrency. Here are the full United States District Court for the District of Columbia documents (PDF), via The Register.

According to the court documents, Lam visited the U.S. to meet fellow Minecrafters Jeandiel Serrano and Veer Chetal, for the first time in real life, in 2023. Soon, Lam’s role in the cybercriminal gang seems to have become an important one. The Singaporean reportedly found high-net-worth crypto holders to target, supported social engineering operations, leveraged technology to trigger account access alerts on target devices, and was involved in laundering the pilfered digital booty.

Lam’s crypto fraud gang reportedly totaled 12 members, and this criminal fraternity operated for about two years. Documents indicate that the individual crypto thefts ranged from $800,000 to tens of millions of dollars. One crypto heist purportedly netted $245 million from a single victim.

Cybergang members enjoyed lavish lifestyles due to their swindling successes. The court documents mention members of the gang owning “a fleet of 31 exotic cars, ranging in value from $100,000 up to $3,800,000.” They would also run up nightclub service bills of up to $500,000 a night, buy luxury watches, clothing, and more. As well as rent prestigious homes in locations like Los Angeles, the Hamptons, and Miami – traveling around in private jets and protected by a team of security guards.

Lam was arrested in September 2024, though, so they didn’t really get to enjoy that lavish luxury lifestyle for very long. Since that time, their suspected criminal activities have been under deeper investigation. The last members of the ‘Minecraft crew’ threw in the towel around May 2025. Lam has now pleaded guilty to RICO violations, and a status hearing is scheduled for December 8 this year; the Singaporean faces up to 20 years in jail. The Register notes that another member of Lam’s fold, Marlon Ferro, was handed a 6.5-year sentence back in May. Ferro’s role was effectively a ‘physical plan B,’ and they reportedly took part in multiple physical burglaries at the behest of the gang if/when social engineering attacks weren’t enough.

Hackers reportedly claiming to be good actors have drained about $320 million worth of Bitcoin from Liquid Network's federation wallet, according to a CoinDesk report. In an X post on September 6, Liquid — a Bitcoin sidechain developed by blockchain infrastructure company Blockstream — confirmed that 4,000 BTC, roughly 95% of the entire wallet's balance, had been withdrawn.

Interestingly, the post referred to those behind the exploit as “purported white-hat hackers,” echoing the hackers’ own claim, after they self-identified as “whitehats” in a message embedded in a Bitcoin transaction. They also reportedly requested an audience with Liquid via the on-chain message, promising to return the money once the vulnerability that enabled the exploit is fixed.

“Please fix the bug first,” the on-chain message said. "The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.” Liquid responded on-chain with its security team's contact and has reportedly moved communications to an encrypted channel. Meanwhile, the platform said it has suspended transactions and warns of service disruptions as federation members work to restore service.

Launched in 2018, Liquid is a federated sidechain designed to move Bitcoin faster and more privately than the main chain. Users lock BTC on Bitcoin and receive an equivalent token, L-BTC, on Liquid, which settles blocks roughly every minute and finalizes in about two minutes. Rather than relying on miners, the network is secured by a federation of more than 80 exchanges, brokers, and other financial firms. The block signing and the multisig wallet holding the pegged-in Bitcoin are handled by 15 rotating functionaries that require 11 signatures to move funds.

The mechanics behind the exploit are also unusual, as nothing appears to have been stolen in the conventional sense. For example, in January, the Solana-based platform Step Finance lost roughly $40 million after attackers compromised devices belonging to its executive team, gaining access to the keys that guarded its treasury wallets. According to Liquid, the coins left through the Peg-out Authorization Key (PAK), belonging to SideSwap, a decentralized exchange built on the sidechain.

However, Liquid said that the key had not been compromised, nor had any others. SideSwap gave a matching account, stating a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC, the service processed the order as it would any other, and the Liquid Federation paid out 3,996 BTC to the customer's Bitcoin address twenty-three minutes later. According to SideSwap, its systems had no way of distinguishing those coins from any other L-BTC.

The incident lands in what has already been a punishing stretch for crypto infrastructure. Recently, the trading platform Drift suspended deposits and withdrawals after a suspected $270 million hack in April. In 2025, roughly $17 billion worth of Bitcoin was stolen, driven largely by impersonation schemes and AI-assisted scams.