Scams

North Korean agents have infiltrated the cryptocurrency industry at unprecedented levels, with 15% to 20% of digital asset firms potentially employing state-backed operatives, according to Security Alliance member Pablo Sabbatella. Between 30% and 40% of job applications to crypto companies may originate from North Korea-linked actors. These individuals gain access to internal systems, production environments, and sensitive infrastructure after being hired through fraudulent recruitment channels.

A malicious Chrome extension named "Safery: Ethereum Wallet" reached fourth place in Chrome Web Store search results for "Ethereum wallet" in November, according to Socket, a security firm specializing in open-source software supply chain analysis. The extension stole user seed phrases by encoding them into micro-transactions on the Sui blockchain. This method allowed attackers to drain wallets without triggering traditional security alerts.

A 10-month cross-border investigation traced criminal funds through Binance, OKX, Coinbase, Kraken, Bybit, and KuCoin, according to the International Consortium of Investigative Journalists. Researchers documented over $408 million in transfers from Huione Group to Binance between July 2024 and July 2025. OKX received more than $226 million from Huione in the five months following its February 2025 guilty plea for operating an unlicensed money transmitter.

Aerodrome and Velodrome, leading decentralized exchanges on Base and Optimism, reported front-end compromises early Saturday morning. Both platforms warned users to avoid primary domains and use decentralized mirror links while investigations into the DNS hijack continue. Smart contracts remain secure and unaffected.

Aerodrome, the largest decentralized exchange on Base blockchain, has issued a security alert regarding a DNS hijacking incident affecting its main domains. Two decentralized mirrors remain accessible, while centralized domains (.finance and .box) are still compromised. The platform confirmed smart contracts remain secure.

The Department of Homeland Security has conducted a months-long investigation into Beijing-based Bitcoin mining equipment manufacturer Bitmain, examining whether its devices pose national security threats. The probe, code-named "Operation Red Sunset," includes inspections of seized hardware at US ports and assessments of potential remote manipulation capabilities, according to reports.

The UK's Serious Fraud Office arrested two individuals in connection with the alleged $28 million collapse of Basis Markets. The decentralized hedge-fund project raised funds through NFT and token sales in 2021–2022 before ceasing operations without delivering a product. No formal charges have been filed, and the investigation remains ongoing.

The UK Serious Fraud Office arrested two individuals in connection with the collapse of Basis Markets, a cryptocurrency fund that allegedly misappropriated $28 million from investors. A man in his 40s and another in his 30s were detained in south London and West Yorkshire on suspicion of fraud and money laundering. The arrests represent the SFO's first major cryptocurrency investigation, according to Director Nick Ephgrave.

India's Enforcement Directorate has frozen ₹8.46 crore held across 92 bank accounts, including balances at CoinDCX and several cryptocurrency wallets, as part of an investigation into a ₹285 crore cyber-fraud network. The probe identified fraudulent apps and platforms that used task-based earning schemes to lure victims before blocking their withdrawals.

GANA Payment, a BNB Smart Chain project, lost $3.1 million after attackers gained unauthorized contract control and manipulated staking rewards. The attacker laundered 1,140 BNB ($1.04 million) and 346.8 ETH ($1.05 million) through Tornado Cash, with approximately $1 million remaining on Ethereum. Blockchain security firm HashDit identified the vulnerability as malicious transfer of contract ownership, enabling extraction of excess GANA tokens.