Scams

Missouri Attorney General Catherine Hanaway's office said it filed a lawsuit Wednesday against GPD Holdings, which operates crypto ATMs under the CoinFlip brand, alleging the company knowingly facilitated fraudulent transactions. The state is asking the court to block CoinFlip from operating in Missouri, impose $1,000 per violation over the past five years (up to $1,826,000), and order restitution for consumers.

npm has revoked granular write-access tokens tied to compromised developer accounts in an effort to curb a new wave of the self-replicating “Mini Shai-Hulud” supply-chain worm. The platform also urged users to rotate secrets and move to Trusted Publishing, but researchers say infected machines can still leak data locally. The latest spike followed the compromise of the npm account “atool,” which published 637 malicious versions across 323 packages in 27 minutes.

Turkey expanded an eight-day crackdown on illegal betting with two May 18 raids in Antalya and Mersin that brought legal action against 233 additional suspects and cited more than TL 18 billion ($395 million) in alleged transaction volume. Across four major raids since May 11, authorities say the total has exceeded 670 suspects, while an earlier Adana case alleged that cryptocurrency platforms were among the channels used to launder proceeds.

Echo Protocol said Tuesday it is investigating a security incident affecting its Echo bridge on Monad and has suspended all cross-chain transactions after about 1,000 unauthorized eBTC was minted. The attacker moved part of the proceeds through Curvance and ultimately sent 384 ETH to Tornado Cash, while still holding 955 eBTC, according to DeBank.

Adshares said an attacker involved in its bridge incident returned 256 ETH (about $540,700), roughly 86% of the estimated $628,000 taken. The exploit was linked to bridge mint-validation failures, and analysts warned that recovery windows often trigger phishing “refund” sites and impersonator accounts.

Posts on X claiming a "10 million" Ripple USD (RLUSD) "Season 1" giveaway are not tied to the XRP Ledger Foundation or Xaman and are part of a coordinated phishing operation. The campaign relies on bot networks that mass-tag users, funneling them to fake sites that prompt wallet connections and malicious signing. Community figures also warn that Ripple and the real XRPL Foundation do not run surprise token airdrops or request seed phrases.

Bitcoin developer Jameson Lopp warned crypto holders on May 17, 2026 to adopt a “zero trust” stance toward incoming communications after a phishing method abused Google Forms notifications. He said attackers can use official-domain emails, oversized text fields, and Google Sites-hosted pages to make fake security alerts look legitimate. Lopp listed five channels he would no longer trust for inbound messages: email, phone calls, SMS, messengers, and other external notifications.

Binance Research said data current as of May 13, 2026 shows more than US$75B in illicit crypto remains trapped on-chain, even though such activity stays below 1% of total transaction volume. The report argues tighter KYT/KYC checks, stablecoin freezes and seizures have narrowed exit routes, while mixer capacity is capped at about $10M per day, implying a multi-decade backlog if mixers were the only outlet.

Entain general counsel Simon Zinger sent letters dated May 15 to six Premier League clubs, asking them to commit to UK-licensed gambling shirt sponsors for the 2026/27 season. The letters raised concerns about Stake's "heavy reliance on cryptocurrency" and alleged BJ88 uses "unregulated payment methods like cryptocurrency" to avoid oversight, while noting several clubs' current sponsors lack UK Gambling Commission licensing.

Onchain investigator ZachXBT published an investigation alleging LAB, an AI trading terminal project, is dominated by insiders controlling more than 95% of its token supply. He said LAB pumped over 350% in under 72 hours to a $6 billion fully diluted valuation before dropping more than 65% within hours, alongside claims of multiple retail value-extraction paths. The report also cites large LAB movements tied to Bitget accounts and includes a $10,000 bounty seeking documents tied to market-making activity.