Scams

Betterment said an unauthorized party accessed a third‑party marketing system, leading to bogus push alerts and emails that promoted a "crypto giveaway." The messages promised to triple deposits and instructed users to send between $1 and $750,000 in Bitcoin or Ether within three hours. At the time of writing, the listed wallets held 0.14626084 BTC and $1,779.30 in ETH.

According to TRM Labs' 2026 Crypto Crime Report, illicit crypto inflows reached $158 billion in 2025, a 145% rise from $64.5 billion in 2024. The share of illicit activity fell to 1.5% of on-chain volume and 2.7% of VASP inflows, while Russia-linked A757 and A7 saw $72 billion and $39 billion respectively.

On January 9, 2026, WazirX confirmed Recovery Tokens were credited to eligible users as part of its court-approved restructuring following the 2024 hack. The pro rata RTs are non-tradable and may enable reclaiming roughly 75–80% of locked funds over time, subject to three-month recovery reviews and a $10 million buyback threshold.

Americans have lost more than $333 million to scams conducted through crypto ATMs, with $240 million disappearing in the first half of 2025. In response, cities like Spokane and Stillwater have passed local bans, while several other states and municipalities are weighing restrictions or tighter oversight. Industry participants and legal experts argue the machines expose deeper gaps in banking access, even as authorities focus on their role in fast, irreversible fraud.

On January 10, 2026, BlockSec's Phalcon flagged suspicious transactions against Arbitrum's Futureswap and estimated losses of around $395,000 after a suspected exploit that drained USDC via repeated changePosition calls. BlockSec said it tried to contact the team without success and noted the closed-source contract leaves the root cause under investigation.

NextGen Healthcare has agreed to a court-approved settlement that could pay up to $7,500 to patients impacted by a cyberattack in March and April 2023. The incident allegedly allowed a third-party attacker to access sensitive personal data, including Social Security numbers, leading victims to claim ongoing costs for credit monitoring and other protective measures. The settlement fund is designated to reimburse verifiable, unreimbursed expenses that victims consider directly linked to the breach.

On January 10, 2026, authorities in Louisiana reported recovering $200,000 taken through Bitcoin ATM scams that targeted elderly residents. Police and consumer advocates said the funds were retrieved under a new state law that imposes warning requirements, transaction limits and waiting periods on Bitcoin ATMs. Officials also highlighted a broader rise in such schemes, noting that reported Bitcoin ATM fraud reached $333 million in 2025.

In its latest 2026 Crypto Crime Report, Chainalysis reports that illicit cryptocurrency transactions surged 162% in 2025 to at least $154 billion, driven by sanctioned states and organised criminal networks. The study highlights Iran's IRGC, Russia's ruble-linked A7A5 token, North Korean hackers and Chinese money laundering networks as key actors in this ecosystem. It also notes a sharp rise in physical attacks and kidnappings targeting crypto users, underscoring mounting security risks for the industry.

On January 10, 2026, reports highlighted that a UK-based crypto entrepreneur connected to Paradox Metaverse was linked to what authorities described as the largest illegal drug operation in the country. According to The Guardian, MHRA officers raided a Northampton unit last October, seizing thousands of unlicensed Alluvi pens, raw chemicals, equipment, and £20,000 in cash.

On Friday, Betterment customers reported an unauthorized notification urging them to send up to $10,000 in Bitcoin and Ethereum for a promise of triple returns within a three-hour window. Betterment later said the message mimicked an official promotion but was sent via a third-party communications platform and was not a real offer. The incident coincides with ongoing social engineering and wallet-drain campaigns targeting EVM-compatible networks through phishing and malicious extensions.