Scams

Two Canadians from Ontario and Prince Edward Island lost a combined $2.3 million to an AI-enabled deepfake cryptocurrency investment scheme. The Ontario victim lost $1.7 million after being deceived by a fake Elon Musk video, while the other victim lost $600,000 after watching a clip falsely linked to Dragon's Den. The report was updated on December 21, 2025.

On December 21, 2025, SantaStealer was detailed as a malware-as-a-service that prioritizes crypto wallets. It is promoted on Telegram and hacker forums with monthly plans at $175 (Basic) and $300 (Premium). Rapid7 links it to BluelineStealer and notes weak evasion, while data is exfiltrated in 10MB chunks over port 6767.

A crypto trader reportedly lost $50,000,000 in USDT after an address‑poisoning scam led to a mistaken copy‑paste. Stablecoins remained pegged, so broader markets saw little reaction, highlighting the finality risk in self‑custody. The incident shows how spoofed look‑alike addresses can appear in wallet history and mislead hurried senders.

The U.S. Securities and Exchange Commission announced settlements with former FTX executives, with enforcement actions pending court approval. The measures bar them from serving as officers or directors of public companies, in some cases for up to ten years, and do not include monetary penalties. Caroline Ellison is expected to face a 10-year officer/director bar related to misused FTX customer funds.

On December 18, 2025, the U.S. SEC filed proposed final judgments against former FTX and Alameda executives Caroline Ellison, Gary Wang, and Nishad Singh. The settlements include permanent anti-fraud injunctions, a 10-year officer/director ban for Ellison, 8-year bans for Wang and Singh, and a further five-year conduct injunction.

Summit National Bank will create a $400,000 settlement fund for customers impacted by a May 2024 email-account breach that exposed names, Social Security numbers, contact details and account numbers. Eligible class members can claim up to $5,000 for documented out-of-pocket losses, plus a pro rata cash payment around $175 and three years of credit and identity monitoring, with claims due February 17, 2026.

On December 20, 2025, a crypto investor mistakenly sent $50 million in USDT to a poisoned address. Within 30 minutes, the funds were swapped to DAI and then 16,690 ETH, with 16,680 ETH routed through Tornado Cash; on-chain timestamps show a 0.005 USDT test and the large transfer minutes apart.

A crypto user mistakenly sent 49,999,950 USDT to a look‑alike address, an incident attributed to address poisoning, according to SlowMist. The funds were rapidly moved into ETH, split across wallets, and partly routed via Tornado Cash; on December 20, 2025, Cos shared the involved addresses. The wallet had been active about two years with frequent USDT transfers.

On December 20 2025, cybersecurity firm Kaspersky detailed a new infostealer malware called Stealka that is being distributed through pirated mods and cheats for Roblox and other Windows games. The malware targets browser data, crypto wallet extensions, standalone wallet apps, password managers, 2FA tools, and messaging and VPN clients to capture credentials and digital assets. Kaspersky reported detections mainly in Russia with cases also seen in Türkiye, Brazil, Germany, and India, and urged users to avoid unofficial mods, secure their accounts, and limit sensitive data stored in browsers.

Prosecutors charged 23-year-old Brooklyn resident Ronald Spektor with stealing roughly $16 million in cryptocurrency from about 100 Coinbase users. He allegedly impersonated a Coinbase representative and used social engineering to pressure victims to transfer funds, with a judge setting bail at $500,000. Authorities reported asset seizures and said recovery efforts continue.