Scams

U.S. Senators Elizabeth Warren and Jack Reed have requested an investigation into World Liberty Financial, alleging the Trump-affiliated crypto firm sold $WLFI governance tokens to buyers linked to sanctioned entities in Russia, North Korea, Iran, and Tornado Cash. A watchdog report cited by the lawmakers claims token sales included wallets tied to North Korea's Lazarus Group and a sanctioned Russian tool. The Trump family holds 22.5 billion tokens and receives 75% of revenue from all sales, raising national security concerns.

Phishing attacks targeting cryptocurrency users result in millions of dollars in annual losses. Users can protect themselves by verifying website URLs, checking SSL certificates, reviewing platform reputation, inspecting smart contract addresses, and using browser security extensions to detect fraudulent sites before entering credentials or transferring funds.

Balancer disclosed a security exploit on November 3 that resulted in $121.1 million in stolen funds. The protocol recovered or protected $45.7 million through emergency response measures, representing a 38% mitigation rate. BAL token has declined 23.81% to $0.7487 following the incident.

SlowMist identified critical security vulnerabilities in NOFX AI, an open-source crypto futures trading platform built on DeepSeek and Qwen architectures, that allowed attackers to access wallet private keys and exchange API credentials. Binance and OKX worked with SlowMist to identify affected users and revoke compromised credentials by November 17. The flaws affected multiple system versions, with authentication controls failing to protect administrator functions and sensitive endpoints returning API keys by default.

A two-year investigation by the New York Times and the International Consortium of Investigative Journalists traced approximately $28 billion in funds linked to criminal activity through major cryptocurrency exchanges. Binance, OKX, and Bybit served as primary channels for proceeds allegedly generated through cyberattacks, social-engineering schemes, and large-scale fraud operations. The platforms reportedly enabled rapid conversion of illicit funds into widely traded digital assets and stablecoins, with flows continuing even after Binance paid a $4.3 billion U.S. settlement for anti-money laundering violations.

The US Department of Justice filed civil forfeiture complaints targeting over $15 million in Tether connected to North Korea's state-backed hacking group APT38. The FBI initially seized the USDT in March 2025, tracing it to four cryptocurrency platform breaches in 2023. Separately, five individuals pleaded guilty to helping North Korean IT workers infiltrate US companies through fraudulent remote work schemes.

The U.S. Department of Justice filed civil forfeiture complaints for $15.1 million in USDT seized from North Korean military hacking group APT38. The stablecoin was stolen in 2023 attacks against four international virtual currency platforms. Separately, five individuals pleaded guilty to facilitating a scheme in which North Korean IT workers used stolen identities to fraudulently secure employment at 136 U.S. companies.

Price manipulation attacks resulted in $42 million in losses across 51 separate incidents during 2025, according to CertiK Alert. The November 12 incident involving Popcat on Hyperliquid demonstrated coordinated manipulation tactics, triggering $63 million in liquidations through artificial buy walls and sudden order withdrawals. CertiK recorded 19 incidents in Q4 alone, approaching Q2's peak of 20 cases.

Publicly traded companies building digital asset treasuries are increasingly accepting in-kind token deposits instead of purchasing assets on open markets. The approach enables firms to raise capital while establishing valuations for illiquid tokens, but exposes equity investors to heightened volatility from newly launched, untested assets. This strategy diverges from established Bitcoin treasury models, which typically raise funds through conventional financing before acquiring liquid market positions.

An unidentified trader deliberately destroyed $3 million while executing a leveraged manipulation on Hyperliquid's POPCAT perpetual contract, causing approximately $4.9 million in losses to the platform's hyperliquidity provider vault. The attacker withdrew USDC from OKX, distributed funds across multiple wallets, opened over $26 million in long positions, then removed an artificial buy wall to trigger mass liquidations.