TronWeekly

Crypto World News

You are here: Home / Archives for News / Crypto Scam

Crypto Scam

From Bitcoin Scam to Real-World Kidnapping: The $243M Crypto Heist and Its Deadly Aftermath

by

  • Teen Hackers Steal 4,100 Bitcoin worth $243M Using Social Engineering Method
  • A week after pulling the heist, the hackers kidnapped Veer Chetal’s parents in an attempt to extort a larger share of the stolen funds.
  • By March 2025, five suspects had pleaded guilty and could face up to 1l5 years in prison.

The Bitcoin scam that started as an online theft, with a group of teenage hackers stealing $243 million worth of Bitcoin, has turned into something much more serious, like a real-life kidnapping in Connecticut.

The theft started on August 19, 2024, and was executed by three individuals: Greavys (Malone Iam), Wiz (Veer Chetal), and Box (Jeandiel Serrano). The trio targeted a single Genesis creditor, a cryptocurrency investor based in Washington, D.C. They carried out the heist using a complex social engineering scheme.

The attack started when one of the criminals placed a fake call and pretended to be someone from Google support. The criminal used a disguised number to gain the victim’s trust and access personal accounts. Shortly after, another call came from someone claiming to be from Gemini, one of the major crypto exchanges, warning the victim of a ‘supposed’ security breach.

Using this scare tactic, the criminals convinced the victim to reset two-factor authentication (2FA) and unknowingly transferred funds from their Gemini account to a wallet controlled by the hacker. After all of this, the hacker made a loss of 4,100 Bitcoin, worth $243 million at the time.

From Bitcoin Scam to Real-World Extortion

A week after the crypto theft, Veer Chetal’s parents, Sushil and Radhika, were forced into a van by armed men, tied up with duct tape, and driven off. Thankfully, there were nearby witnesses, including an off-duty FBI agent who helped the police track the van.

The couples were quickly released, and four out of the six kidnappers were caught within hours. The reason behind the attack was disturbing, as it is believed that Veer’s partners in the heist pressured him into giving up more of the stolen funds by using his parents as leverage.

That same evening, Greavys and Box were arrested, one during a SWAT raid in Miami and the other at LAX wearing a $500,000 watch. Veer was also taken in quietly and now faces federal charges. By March 2025, five of the six people involved in the kidnapping had admitted guilt, and there is a possibility that they could spend 15 years behind bars.

Authorities are still looking into others connected to the crypto scam, while a federal wallet now holds the recovered Bitcoin.

Read More: HBAR Price Faces Crucial Breakdown Risk, Will $0.15 Hold?

ZachXBT Confirms That The $330 Million Bitcoin Hack Targeted An Elderly Individual in the US.

by

  • ZachXBT revealed that the $330 million Bitcoin theft targeted an elderly U.S. resident, with the stolen funds laundered through over six exchanges and swapped into Monero.
  • Hacken’s Extractor tool tracked the laundering process, revealing that over 300 wallets and 20+ services, including Binance, were used to move and hide the stolen crypto.


ZachXBT has revealed that an elderly person in the United States is the victim of a $330 million Bitcoin scam carried out through social engineering.

This massive theft, reported on Sunday, is now ranked as the fifth-largest crypto hack in crypto history. There’s been a lot of shock amongst members of the crypto community, and it has raised serious concerns about security and fraud prevention in the space.

How the Bitcoin Hack Was Carried Out

ZachXBT first reported a suspicious movement on April 28, 2025, that involved 3,520 Bitcoin, valued at $330.7 million. In the early hours of today, he reported more details, stating that the funds were stolen from an elderly US resident who had held more than 3,000 BTC since 2017, with no prior record of large transactions.

According to the details, immediately after the theft was completed, they quickly moved the crypto through over six crypto exchange platforms and converted it into Monero, a privacy-focused cryptocurrency. The large-scale swap caused Monero’s price to spike by 50% due to limited liquidity.

The stolen Bitcoin was laundered using a peel chain method, which, in basic terms, involves breaking large amounts into smaller parts in order to hide the trail.

Hacken’s tool, Extractor, tracked $284 million worth of BTC through these chains, which reduced to about $60 million after repeated redistributions across low-trust crypto exchanges. Rudytsia, one of the on-chain researchers at Hacken, confirmed that more than 300 wallets and over 20 services, including Binance, were involved in the transactions, according to Cointelegraph.

Read More: Crypto Crash Deepens as Over 50% of Coins Launched Since 2021 Fail, Leaving $3.7 Million Dead After Pump. fun era

Ledger Warns Users of Scam Letters Demanding Seed Phrases

by

  • Ledger users are being targeted by scammers sending fake physical letters that mimic official communications, asking for their seed phrases.
  • The scam letters appear legitimate, using Ledger’s logo, business address, and threats of account deactivation to pressure recipients.
  • This phishing attempt may be connected to the 2020 Ledger data breach that exposed over 270,000 customers’ personal details, including home addresses.

There’s a new crypto scam in town, and it involves sending physical letters to individuals who own Ledger crypto hardware wallets. In the letter, the perpetrators are asking these individuals to confirm their private seed phrases.

If they do, the scammers will access their wallets and withdraw all their funds. Recently, tech commentator Jacob Canfield shared his experience of receiving one of such letters on X.

According to him, he received the letter in his home post box, and the letter looks it is truly from the crypto hardware wallet provider. The letter claimed that there’s a need to validate Canfield’s device and that he should  scan a QR code and enter his wallet’s private recovery phrase.

As a proof of that the letter was not fake, it had Ledger’s logo, business address and a reference number. The letter also stated that Canfield could lose access to his wallet and funds should he fail to comply with the ‘validation process.’

AD 4nXdI9jPxiaKO7JOkE1EIQ4cQIz8Wx8PnLgwuH zJ0zxaQFwTVXzTBvBL dqCYGjgLp1YzpndH25QTzfrYRYYgw9hovEAIZ 1NnZkiGQT2JL6GHHfl2RMJtzJkBfRds9f1armKKc?key=MAFtgkIt4OHhqbU4dvGFJtij

Source: X (@JacobCanfield)

A seed or recovery phrase contains up to 24 words that open access to a crypto wallet. Hence, anyone (including a scammer) with a wallet’s seed phrase can access it, perform transactions or transfer funds out of the wallet.

Ledger responded to Canfield’s tweet, stating that the letter is a scam and warned its users to be on guard against phishing attempts.

 Is There a Possible Connection to the Ledger Data Leak?

Canfield claimed that the company’s customers whose data were leaked about 5 years ago were the largest receivers of these scam letters. Five years ago, Ledger admitted that a hacker accessed its database illegally and released the personal information of over 270,000 of the firm’s customers online.

The information included the customers’ home addresses, phone numbers and names. A year later, a report by Bleeping Computer claimed that many Ledger users stated that they received Ledger devices in their post boxes without requesting them.

The report added that the design of the devices had been modified and contained malware which would become active upon use.

DOJ Seeks 20-Year Sentence for Celsius Founder Alex Mashinsky

by

  • DOJ pushes for 20 years in prison for Celsius founder Mashinsky
  • Celsius founder profited $48 million in fraudulent crypto scheme
  • Mashinsky’s sentencing to reflect severity of crypto fraud impact

The U.S Department of Justice (DOJ) demands a 20-year prison sentence for former CEO of Celsius Network Alex Mashinsky. The DOJ accuses Mashinsky of creating a multibillion-dollar fraud which resulted in major financial losses for thousands of customers. The sentencing will take place on May 8 as prosecutors stress on the need for strict punishment to protect other cryptocurrency markets from frauds.

The DOJ’s sentencing memorandum demonstrates that Mashinsky’s actions were not a mistake. The DOJ argues that his actions were a deliberate scheme to trick customers and exploit the platform for individual benefits. Celsius, valued at more than $20 billion, collapsed in 2022 and resulted in a $4.7 billion loss in customer funds. The prosecutors state that Mashinsky’s crimes led to a loss of about $7 billion at the current cryptocurrency market value.

Alex Mashinsky Pleads Guilty to Celsius CEL Token Fraud

In December 2024, Mashinsky pled guilty to deceiving customers about their investment safety and manipulation of Celsius’ CEL token for personal profits. The DOJ states that Mashinsky received $48 million from the fraudulent scheme. The federal prosecutors accuse him of spearheading a long-term plan to manipulate the price Celsius’ native token and deceive customers about their funds’ security.

The former CEO inflated prices and sold more than $48 million CEL tokens without sufficient disclosure to customers. In July 2022 Celsius was declared bankrupt which caused substantial financial losses to its users and attracted severe legal consequences. The DoJ states that a long prison term demonstrates the severity of Mashinsky’s crimes and deters future crimes in the cryptocurrency sector.

DOJ’s Severe Punishment Protects Crypto Sector

The U.S Department of Justice filed the memorandum just a week before Mashinsky’s court sentencing. The DOJ seeks a severe punishment to condemn Mashinsky and send a message to cryptocurrency executives that fraud will face severe consequences. The court will determine whether or not to issue the proposed 20-year sentence on May 8.

The Celsius fraud also involved the platform’s former chief strategy officer and co-founder Shlomi Daniel Leon. In 2022, Leon resigned from his position before the  company filed bankruptcy. The Federal Trade Commission (FTC) charged Leon and other co-founders like Hanoch Goldstein with financial misconduct which resulted in a $4.7 billion loss.

Alex Mashinsky on the Verge of 20-Year Sentence as DOJ Slams Crypto Fraud Mastermind

by

  • The Department of Justice has requested a 20-year prison term for Mashinsky, emphasizing that his actions were deliberate and not a result of negligence.
  • Despite pleading guilty, Mashinsky still refuses to take full responsibility for his fraudulent acts, shifting blame to external factors while personally profiting $48 million from the scheme.

The Department of Justice (DOJ) has requested that the founder of Celsius, Alex Mashinsky, serve a 20-year prison sentence because they believe that his actions didn’t come as a result of negligence or market misfortune but rather a series of calculated and deliberate decisions to lie. Their decision underscored the gravity of his offenses and the damage he inflicted on investors.

One of the co-founders of the collapsed crypto platform, Alex Mashinsky, could spend 20 years in prison if the U.S. Department of Justice gets its way. In a memo filed on the 28th of April, the DOJ asked the court to give him a strong sentence for his role in the platform’s fraud.

Screenshot 20250429 153507 1
Alex Mashinsky on the Verge of 20-Year Sentence as DOJ Slams Crypto Fraud Mastermind 3

According to them, his actions were not a mistake but instead a purposeful act to scam users. This mistake caused around $7 billion in damage and hurt thousands of people. After Celsius froze withdrawals in June 2022, users lost access to about $4.7 billion in combined crypto assets. The DOJ described Mashinsky’s behavior as a long-running scheme driven by greed and deception.

Mashinsky’s Guilty Plea and Refusal to Take Responsibility

Mashinsky, who admitted guilt in December 2024, misled users about the security of their money and secretly manipulated the CEL token to make a profit.

Despite confessing to the court, he still avoids taking complete responsibility for his actions but instead points fingers at outside forces, including officials, the market, and even the people he stole from. Prosecutors said his actions were not mistakes or poor judgment but clear plans to cheat and steal for personal gain.

He made at least $48 million for himself after causing over $500 million in damage. When the company was still in operation, it claimed to have managed $20 billion in crypto, but behind the scenes, it took big risks, used customer funds to pump token prices, and gave ‘hodl-ers’ false promises.

Although he told investors he was holding CEL tokens, he had actually sold the tokens for millions at its peak. The DOJ wants Mashinsky’s punishment to match the damage done and warn others in the crypto world.

Read More: Galaxy Digital Moves 23,900 ETH to Coinbase, Market Braces for Impact

Monero (XMR) Price Soars as $330M Bitcoin Theft Sparks Launders Across Six Exchanges

by

  • A suspected Bitcoin theft worth 3,520 BTC ($330.7 million) led to laundering across six exchanges, with the stolen funds converted into Monero (XMR), causing the price to surge by 51% before retracing.
  • Monero (XMR) experienced sharp price volatility due to large swaps and thin liquidity, with trading volume rising by 55% within two hours.

Monero saw a major surge in its price after Bitcoin worth approximately $330.7 million, (3,520 BTC), was suspiciously transferred from a suspected victim’s wallet to an unknown address. On-chain investigator ZachXBT reported that the event, which happened on Sunday, appears to be a theft.

The details of the theft were covered by on-chain investigator ZachXBT. Shortly after, the funds moved through more than six exchanges and were swapped into Monero (XMR), causing the price of XMR to increase by 51% to $347.72 within seven hours before retracing.

Monero (XMR) currently trades at $281.55 and has a high of 23.4% in the last 24 hours and 31.0% on the 7-day chart.

Screenshot 20250428 132224 Chrome
Monero (XMR) Price Soars as $330M Bitcoin Theft Sparks Launders Across Six Exchanges 5

source: coingecko.com

ZachXBT noted that the high transaction fees and the users’ suspicious movements suggest that it is a case of theft, although he believes there’s a high probability that North Korea was not involved. He also pointed out that the victim had been a longtime Bitcoin holder.

Monera (XMR) Volatility and Price Surge Due to Bitcoin Theft

Due to large swaps and thin liquidity, XMR experienced sharp price movements, and traders have been warned to expect increased volatility and greater regulatory attention. From a trading view, the theft and laundering created new risks and chances across several cryptocurrency pairs.

For instance, XMR’s price jumped 8.2% within two hours, suggesting that there has been an overbuy for XMR/USDT and XMR/BTC watchers. On Binance, XMR/USDT volume rose to $42.3 million between 15:30 and 17:30 UTC on April 28, 2025, marking a 55% rise compared to the earlier 24-hour average of $27.2 million.

Monero’s Privacy Features

Monero is the largest privacy-related token with a $5.3 trillion market cap and the 27th biggest cryptocurrency by value. Unlike other blockchain tokens and networks like Bitcoin and Ethereum, where everyone can see all transactions and track funds across wallets, Monero uses special technologies to hide wallet addresses and activities.

Read More: Best Payout Online Casinos Australia 2025– Highest Paying Australian Casinos

Solana’s Loopscale Suffers Setback After $5.8 Million Exploit Weeks After Launch

by

  • Loopscale, a Solana-based DeFi lending protocol, was hacked two weeks after its launch, causing it to lose over $5.8 million (around 12% of its TVL) and forcing the platform to pause most of its services while investigations on the case go on.
  • The platform was launched on April 10 after a six-month closed beta.

Solana’s DeFi project, Loopscale, has been hacked and is now one of the top 2025 hacks that caused victims to lose over $5.8 million, which amounts to about 12% of its total value locked. Following the incident, the platform decided to pause its lending services so as to prevent any further damage. The exploit happened just two weeks after Loopscale’s official launch, marking a major blow to the new protocol.

On the 26th of April, attackers exploited a vulnerability in one of Loopscale’s lending markets, stealing about 5.7 million USDC and 1,200 Solana (SOL), according to Mary Gooneratne, the cofounder of the platform. The stolen funds represent almost 12% of the protocol’s total value locked (TVL).

Due to the exploit, Loopscale temporarily paused its lending but later allowed limited functions, like loan repayments, top-ups, and loop closings. Other main features like Vault withdrawals remain restricted as the investigation continues.

According to the platform, the exploit happened because of a problem with how Loopscale priced RateX-based collateral. “There is no issue with RateX itself related to this. Loss of funds explicitly affects depositors to SOL and USDC Genesis vaults,” the platform added.

Presently, an investigation is ongoing to determine the full effect of the breach and also ways for fund recovery. Gooneratne stated that their team is fully mobilized to investigate the situation, recover stolen funds, and ensure user protection.

The Launch of Solana DeFi Lending Platform

The DeFi lending platform, Loopscale, was launched on April 10 after a six-month closed beta. It aims to improve capital efficiency by directly connecting lenders and borrowers. Its main USDC and SOL vaults offer yields above 5% and 10%, while also supporting lending for tokens like JitoSOL and BONK, along with looping strategies across more than 40 token pairs.

Related Reading | Dogecoin’s Bullish Cross and Breakout Signal a Big Price Move Ahead

Devastating Solana Hack as Loopscale Loses 5.8M in DeFi Exploit

by

  • Loopscale, a Solana-based lending platform, lost $5.8M (12% of TVL) in a sophisticated hack targeting RateX-based collateral pricing.
  • Despite prior audits, vulnerabilities remained; Loopscale paused key operations but has cautiously reopened some services.
  • The platform, recently rebranded from Bridgesplit, had promised more stable lending through an order book model.

Solana-based lending platform Loopscale suffered a devastating exploit this weekend, losing over $5.8 million, roughly 12% of its total value locked (TVL), in a sophisticated attack that exploited vulnerabilities in one of its collateral pricing mechanisms.

The breach, confirmed late Saturday, targeted RateX-based collateral pricing, an isolated component within Loopscale’s lending infrastructure. “The root cause of the exploit has been identified as an isolated issue with Loopscale’s pricing of RateX-based collateral,” the Loopscale team announced on X (formerly Twitter). “An active investigation is underway to determine how this vulnerability was introduced, who is responsible, and how we can most effectively pursue fund recovery.”

Launched just earlier this month on April 10, Loopscale was initially known to the crypto community as Bridgesplit, a startup that raised $4.25 million in venture capital during 2021 from backers including Solana Labs, Coinbase Ventures, and others. Bridgesplit had initially pitched an NFT-based yield generation product but rebranded to Loopscale to focus on order book-based lending, an alternative to the traditional pool-based models used by DeFi giants like Aave and Solend.

By relying on an order book system, Loopscale promised users more predictable loan terms and a reduction in the interest rate volatility that plagues many variable-rate lending protocols.

Solana Faces New DeFi Crisis as Loopscale Suffers Major Hack

Despite being subject to an audit earlier this year by blockchain security firm OShield, which flagged and helped fix several critical vulnerabilities, Loopscale still found itself vulnerable. Its FAQ stated that “all critical and high-risk issues identified have been fixed” and that an additional audit by Sec3 was ongoing at the time of the attack.

“We are fully mobilized to investigate the incident, recover the stolen assets, and protect our community,” wrote Mary Gooneratne, co-founder of Loopscale, in a statement on X.

Following the exploit, Loopscale temporarily paused several key functions on its platform to contain the damage. However, by Saturday evening, it had cautiously reopened services, allowing loan repayments, collateral top-ups, and loop closing, in an effort to stabilize the platform and reassure its user base.

This latest attack adds to an already grim tally of 2025 DeFi hacks, with the sector bleeding hundreds of millions of dollars in losses. It follows February’s record-breaking $1.46 billion Bybit hack, as well as recent exploits impacting KiloEX (oracle manipulation leading to a $7 million loss), Solana-based projects, and Infini, a stablecoin neobank that suffered a staggering $49 million breach.

The Loopscale incident underscores a growing concern: even newly launched, audited DeFi platforms remain vulnerable to attack vectors, and the race between security protocols and hackers is far from over.

As the crypto community demands better transparency and more rigorous security standards, all eyes are now on how Loopscale manages its response and whether it can recover both the stolen funds and user trust in the volatile months ahead.

Related | Bitcoin, Solana, Ethereum: institutional FOMO ignites crypto markets with record ETF inflows 

Cryptocurrency Weaponized: Southeast Asia’s Crime Rings Fuel World Fraud, UN Reports

by

  • Southeast Asia has become the world’s global hotbed of cyberfraud activities, centered on cryptocurrency, a report by the UN has revealed.
  • Criminal gangs are evading official crackdowns by relocating to hard-to-reach areas and using satellite internet and illegal crypto exchanges like Haowang.
  • The Haowang platform, linked to Cambodia, has processed over $24 billion in crypto inflows since 2021, expanding into gambling, trading apps, and its own stablecoin.

Cybercriminal organizations in Southeast Asia are significantly improving their operations, and they’re using cryptocurrency as a fundamental part of their fraudulent activities. According to a recent UN report, these criminal networks continue to spread across the world  despite the crackdown from authorities.

They have operational bases in various places, including Myanmar and Mexico. The study revealed that Southeast Asia is now the central location for the leading and highly profitable cybercrime activities worldwide, and cryptocurrency is a fundamental aspect of their operations.

The report also revealed that the cyberfraud sector within this region has grown more rapidly than any other form of transnational crime. This happens because the operators can easily scale their operations and target millions of users across national boundaries through the internet.

According to the UN study, cyber fraud resulted in the loss of up to $37 billion among residents in Southeast and East Asia in 2023 alone, with a large percentage of those losses associated with crypto scams.

Criminal Networks Evade Authorities with Illegal Cryptocurrency Exchanges

The near-anonymity and global accessibility of cryptocurrencies have made it almost impossible for authorities to find a lasting solution to the problem. As authorities are stepping up their efforts to dismantle known scam centers, some of these criminal networks are responding by moving their bases of operations to more geographically isolated areas.

Others are moving their activities online with the help of technologies such as Starlink satellite internet to remain undetected by the government. The UN report also showed that these criminal networks are using illegal cryptocurrency exchanges for their scam operations.

One of such notable exchanges is the Huione Guarantee (now known as Haowang).

AD 4nXcIcojmcVqjHSBzYqDuL3qLYsEW4FxaEIZQBrMge6fltKrT3Bm2SZ l7lKNUO3D6LBGtUW3dxFb7txMOm95Or4L9sU90CMgluNbXAed6mSObjqKSnO7RU4m ahJp7Mgv U3VRmr?key=90O4d 0GYd4gVq s12uDwM M

Crypto inflows across illegal marketplaces. Source: the UN.

According to the report, the Haowang platform has links with several nations, most notably, Cambodia, and has processed cryptocurrency transactions worth billions of dollars over the past four years. Following its massive growth, the platform has moved from just being a marketplace to exchange cryptocurrencies.

It has now launched several crypto products such as trading applications, an online gambling platform, and a US dollar-pegged stablecoin to avoid control from the authorities. The study further reported that cryptocurrency sellers on this illegal platform have received funds worth a minimum of $24 billion since 2021. Also, the platform boasts of nearly one million users.

Lazarus Invades US Biz! Sanctions Shattered

by

  • North Korean Lazarus Group registered US shell companies Blocknovas LLC and Softglide LLC using false identities to target crypto developers with malware.
  • This marks a rare instance of North Korean hackers legally registering US firms to launch cyberattacks, successfully compromising multiple victims.
  • The registration by the RGB, which manages North Korea’s cyber warfare, violates US and UN sanctions aimed at restricting Pyongyang’s financial activities.

Lazarus, North Korea’s notorious hacker group, has spread its tentacles once again. According to Reuters, the group has set up two shell companies, Blocknovas LLC and Softglide LLC, in New Mexico and New York using false identities. They also opened a third business, called Angeloper Agency, which does not appear to be registered in the United States.

By posing as recruiters, the duo target job applicants, especially crypto developers, and spread malware into their software. Cybersecurity firm Silent Push called it a rare case of North Korean hackers legally registering U.S. firms to launch cyberattacks, successfully compromising multiple victims.

Lazarus
Lazarus Invades US Biz! Sanctions Shattered 8

The Lazarus Group is a part of the Reconnaissance General Bureau (RGB), which belongs to the Korean People’s Army (KPA). The RGB oversees all North Korean cyber warfare, including the hacks in the cryptocurrency industry. Besides Lazarus, RGB has other threat actors like AppleJeus, APT38, DangerousPassword, and TraderTraitor. 

Such activity shows the technical evolution of North Korean efforts in targeting the cryptocurrency sectors and funding the North Korean government. Besides stealing foreign currency via hacks, North Korea has reportedly dispatched thousands of IT workers abroad to bring in millions to finance Pyongyang’s nuclear missile programme, according to the United States, South Korea, and the United Nations.

Lazarus Exploiting Registration Loopholes for Illicit Activity

However, the presence of a North Korean-controlled company, registered by the RGB, in the United States is a gross violation of Office of Foreign Assets Control sanctions. It also violates United Nations sanctions that ban North Korean commercial activity designed to assist the isolated country’s government or military.

It shows how the current system allows for the easy formation of LLCs at the state level with minimal scrutiny of the true owners and their potential links to problematic foreign actors. This could easily be exploited for illicit activities, sanctions evasion, or other purposes detrimental to national security.

The FBI, on its part, has formed a separate unit to track and prevent these intrusions and has been conducting victim notifications for years now. Security experts like Samczsun, part of the SEAL 911 emergency response team, have actively worked with federal agents to identify and protect potential DPRK targets.