Scams

Blockchain investigator ZachXBT on Dec. 29, 2025 outlined evidence tying a Canada-based actor to more than $2 million stolen by impersonating Coinbase customer support. The scheme used social engineering across Telegram and social media, with on-chain traces linking XRP thefts and subsequent conversions to bitcoin.

On 30 December 2025, China’s Supreme People’s Court outlined a push to update legal tools for digital assets in its 2025 Digital Rule of Law journal. While crypto trading remains banned, courts increasingly treat cryptocurrencies as virtual property and plan clearer rules for electronic transactions, digital records, and AML coverage amid rising cybercrime and disputes.

Flow abandoned plans for a full-chain rollback after a December 27 exploit siphoned about $3.9 million, following heavy criticism from developers and bridge operators. The FLOW token fell more than 50%, briefly near $0.079, while phase one sets EVM operations to read-only and temporarily restricts affected accounts.

On 29 December 2025, DPRK-linked crypto hacking was described as a major revenue channel for Pyongyang. In the first half of 2025, operators extracted more than $2.17 billion in digital assets, and in February attackers drained nearly $1.5 billion in Ether from Bybit. Experts say evolving multi-chain laundering and broader industry coordination will shape the fight ahead.

Trust Wallet has launched a formal claims process for users affected by its Chrome extension v2.68 incident that exposed recovery phrases and drained funds. The company confirmed the breach on December 25 and outlined the compensation workflow on December 26. Changpeng Zhao said around $7 million was affected and pledged reimbursement for verified losses.

According to an investigation by TRM Labs, a coordinated group of Russian cybercriminals allegedly laundered more than $35 million in cryptocurrency stolen from LastPass users after the 2022 breach. The funds were moved through instant exchanges, Bitcoin mixers and Russian platforms including Audi6 and the OFAC-sanctioned Cryptex, with investigators using behavioral continuity analysis to trace the flow. The report indicates that wallet activity tied to the mixers showed operational links to Russia before and after the laundering process.

A report published on 27 December alleges wallets linked to Andrew Tate received about $1.2 million from addresses named in a Texas lawsuit tied to a $5 million investment scam. Court documents filed in March 2025 describe laundering between January 2023 and February 2025, while related wallets reportedly moved up to $30M into the privacy protocol Railgun over the past two years.

Hacken's 2025 Yearly Security Report estimates Web3 losses at about $3.95 billion, up roughly $1.1 billion from 2024, with North Korea-linked clusters responsible for around half of the stolen funds. The Bybit breach of nearly $1.5 billion and widespread access control failures drove most losses, while regulators in major jurisdictions outlined security expectations that many Web3 firms still failed to implement.

On Dec. 27, CEO Brian Armstrong said Coinbase is working with Hyderabad Police in India after the arrest of a former customer support agent linked to an insider bribery and data theft scheme. Public filings show the breach was discovered in May 2025, ultimately affecting 69,461 people and leading Coinbase to recognize $355 million in related costs across Q2 and Q3 2025.

On December 28, 2025, Kaspersky's SecureList reported that stolen crypto accounts listed on dark-web markets fetch an average of $105, with individual prices ranging from $60 to $400. The data is harvested by phishing kits, exfiltrated via email, Telegram bots, or admin panels, and then monetized immediately or routed into broader resale pipelines.