Tag: Security & Hacks

Three men have been sentenced in the UK for a sophisticated cryptocurrency fraud scheme, stealing approximately £4 million (over $5.3 million) from eight victims by impersonating police officers. The sentences were handed down on Thursday at Southwark Crown Court.

The group operated by contacting victims, falsely claiming to be police officers investigating compromised cryptocurrency accounts. They persuaded individuals to transfer their digital assets to what they believed were secure police-controlled accounts. These were, in fact, fake accounts controlled by the fraudsters, who then laundered the stolen funds through a complex network.

Anthony Ikenwe and Kevin Nwamma each received six-year sentences for conspiracy to commit fraud and five-year sentences for money laundering, to run concurrently. Hamza Bashir was sentenced to three years and nine months for fraud and three years for laundering, also to run concurrently.

Victims began coming forward in January 2025, leading to arrests in November after officers raided seven addresses across London and Essex. The Metropolitan Police’s Cryptocurrency Team investigated the case using a data-driven approach. By piecing together blockchain transactions, exchange records, communications, financial records, and internet service provider data, investigators linked what initially appeared to be separate crimes into a single organized network operating across multiple platforms and jurisdictions.

Detectives discovered the men were living lifestyles far exceeding their declared incomes. For instance, one individual had a recorded annual income of just £444, yet the group purchased a car worth nearly £60,000 with cryptocurrency. They also kept around £500,000 in cash in a safety deposit box in Dubai and funded holidays to destinations including Thailand, Japan, Paris, Mykonos, the Maldives, and the Seychelles. Purchases at luxury retailers such as Harrods, Hermès, and Louis Vuitton were also noted, with crypto routinely converted into prepaid payment cards, according to the Met.

Officers linked more than £1 million in cryptocurrency to wallets controlled by Ikenwe and traced stolen funds flowing into bank accounts associated with Nwamma’s luxury chauffeur business. Recovered luxury goods were valued at over £26,000.

Ikenwe and Nwamma pleaded guilty in April, while Bashir changed his plea to guilty on the eighth day of his trial. The Metropolitan Police stated that they are continuing to work with UK and international partners to identify other individuals linked to the conspiracy and to recover assets for the victims. Around £1 million in crypto linked to victims has been recovered so far.

This case highlights a recurring trend in cryptocurrency crime where criminals impersonate law enforcement. Similar scams have been reported, including one last year where a scammer posing as UK police stole $2.8 million in Bitcoin. In the US, fraudsters have posed as Denver police, and in France, robbers dressed as police carried out a $1 million Bitcoin robbery. In Ukraine, men posing as police were arrested for extorting $250,000 in Tether.

“Criminals should be under no illusion that policing is evolving alongside technology,” said Detective Inspector Geoff Donoghue. The Metropolitan Police’s investigation demonstrates their adaptation to combating complex financial crimes through sophisticated data analysis. However, uncertainties remain regarding the full extent of the laundering network and the total value of assets that can ultimately be recovered for the victims.

Why This Matters

This case underscores the evolving tactics of cybercriminals who impersonate law enforcement to defraud victims of digital assets. The Metropolitan Police’s data-driven investigation demonstrates their adaptation to combating complex financial crimes, highlighting the ongoing technological race between criminals and law enforcement. The approximately £4 million ($5.3 million) stolen from eight victims represents a significant financial impact, emphasizing the need for public vigilance against sophisticated impersonation scams.

Broader Context

Impersonating police has become a recurring thread in crypto crime, with similar incidents reported globally. This case is part of a broader trend where criminals leverage the authority of law enforcement to exploit individuals’ trust in digital asset security.

Ostium, a decentralized perpetuals exchange built on Arbitrum, suffered an estimated $18 million loss on Wednesday after attackers compromised an oracle signer key. The exploit allowed malicious actors to manipulate the platform’s price feed, generating fake trading profits and draining funds from Ostium’s liquidity vault.

Attack Details

Blockchain security firm Blockaid reported that the attacker utilized a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trading profits. This manipulation triggered a multi-million dollar payout in the form of USDC, a stablecoin issued by Circle, from Ostium’s liquidity pool.

Ostium acknowledged the issue on X, stating, “We are aware of the issue with the OLP vault. We have paused all trading. The team is investigating.”

Ostium Protocol and Impact

Ostium offers perpetual futures tied to real-world assets, including stocks, commodities, foreign exchange markets, and indices. Operating as a decentralized exchange (DEX), it allows users to maintain control over their funds and typically does not require personally identifiable information. At the time of the attack, the protocol held approximately $63 million in total value locked. The exploit effectively drained nearly one-third of its liquidity.

Broader DeFi Security Concerns

This incident occurs amidst a challenging year for decentralized finance (DeFi) exploits. DeFi refers to financial applications built on blockchain networks that operate without traditional intermediaries like banks. In the first five months of 2026 alone, over $840 million was stolen from DeFi protocols. Notable incidents include $292 million stolen from KelpDAO and $285 million from Drift Protocol. Resolv Labs also fell victim in June, with hackers stealing over $25 million.

AI’s Role in Exploits

Security experts are increasingly warning that advancements in artificial intelligence are accelerating the discovery of vulnerabilities. Danny Jenkins, CEO and co-founder of ThreatLocker, previously told Decrypt that AI systems are significantly more adept at reviewing code and identifying potential flaws than many human analysts. He noted that current AI is already speeding up vulnerability discovery, and newer models like Mythos could dramatically enhance these capabilities, posing a significant future challenge.

“It will be only a matter of time until someone bad gets access to it,” Jenkins stated.

The increasing effectiveness of frontier AI models in identifying complex software flaws was underscored in May when security researcher Taylor Hornby used Anthropic’s Claude Opus 4.8 to uncover a four-year-old counterfeiting vulnerability in Zcash.

Fake Maccy App Targets Users with New Infostealer

Mac users seeking the open-source clipboard manager Maccy are falling victim to a counterfeit version of the application that installs a new Rust-based infostealer dubbed PamStealer, according to cybersecurity firm Jamf Threat Labs. If successful, the malware poses a significant threat, capable of stealing users’ passwords and cryptocurrency wallet keys.

In a report published Thursday, Jamf Threat Labs detailed how the campaign employs a deceptive website to distribute a disk image containing a malicious AppleScript file named Maccy.scpt. Upon opening, this file presents instructions to users, urging them to run it within Apple’s Script Editor while concealing the malicious code deeper within the document.

“We are tracking this malware under the name PamStealer after one of its core behaviors: validating the victim’s login password through the macOS Pluggable Authentication Modules (PAM) before harvesting it,” Jamf Threat Labs stated.

The malware then leverages JavaScript for Automation and native macOS APIs to download a second-stage payload. This approach avoids common shell utilities like curl or zsh, thereby reducing the number of observable processes for security tools.

“With many stealers, we have seen attackers purchasing Google Ad space to lure users to the malicious app. We have recently observed malicious ads being hosted on X as well,” Jamf Threat Labs Director Jaron Bradley told Decrypt. “These social engineering techniques have proven to be highly successful.”

The second stage, according to the report, is a Rust-based binary specifically designed for Apple Silicon Macs. It disguises itself as either Finder or Software Update to evade detection.

“Rather than storing its configuration in cleartext, the dropper derives a key from a fingerprint of the host—including its CPU architecture, locale, keyboard layout, and time zone—and uses it to unlock an encrypted, integrity-checked configuration containing the payload URL and installation path,” the company explained.

Once installed, the malware can pilfer browser credentials and Keychain data, monitor clipboard contents, establish persistence, and exfiltrate stolen information to a remote command-and-control server using encrypted communications. Crucially, it quietly self-terminates if it cannot verify it is running on its intended target.

The malware also attempts to escalate its privileges by presenting a fake Finder alert that prompts users to grant Full Disk Access. This deceptive prompt can appear up to 40 minutes after infection, making it less likely for users to associate it with the initial download. If granted, the malware gains access to sensitive protected data, including Mail, Messages, and Time Machine backups.

Bradley noted that Jamf has not yet observed any evidence of PamStealer being actively deployed in the wild. Nevertheless, the company has informed Apple of its findings. Apple did not immediately respond to a request for comment from Decrypt.

Jamf also indicated that similar social engineering tactics are appearing on other platforms. Last week, the company reported on X that it was investigating a sponsored advertisement on the platform promoting DynamicLake. This ad redirected users to dynamicmacisland[.]com, where they were instructed to open Terminal and execute an installation command.

“The advertisement was delivered through a verified X account, adding another layer of trust to the social engineering,” the firm wrote. “Analysis of the payload revealed a recent Atomic (MacSync) Stealer variant.”

These discoveries come at a time when attackers are increasingly disguising malware as legitimate software and exploiting trusted developer platforms and advertising channels. Recent campaigns have included a fake OpenAI repository that climbed to the top of Hugging Face’s trending projects before distributing a Rust-based infostealer, a malicious Visual Studio Code extension that GitHub stated exposed approximately 3,800 internal repositories, and the Shai-Hulud software supply-chain campaign targeting development tools used by AI companies such as OpenAI and Mistral AI.

Hacker’s Identity Shrouded in Mystery as $18.5 Million in ADA Moves from Vulnerable Wallets

Cardano – The identity of the “white hat” hacker who moved approximately $18.5 million worth of ADA from vulnerable SecondFi wallets remains unknown to Emurgo, the firm that developed the platform, according to Charles Hoskinson.

Hoskinson, speaking on June 25 during his X Spaces session titled ‘The Bingo Hall,’ relayed information from a contributor named ‘Jer.’ Jer had attended a meeting between the Cardano governance body Intersect and SecondFi’s developers. “A member of the Emurgo team said the identity of the white hat hacker is not known to Emurgo… or at least [Emurgo] said it is not affiliated with Emurgo,” Hoskinson stated.

This distinction is significant, leaving open the possibility that Emurgo may be unaware of the hacker’s identity or is strategically managing its public statements.

The price of ADA has seen a notable decline, dropping 21% over the past two weeks and currently trading near $0.145. These levels represent multi-year lows, approximately 95% below the asset’s all-time high.

While the recent crypto incident did not compromise the Cardano protocol itself – with both Intersect and Hoskinson emphasizing that the vulnerability was confined to the wallet application layer – the reputational impact on the ecosystem is tangible, and the market appears to be factoring this into ADA’s valuation.

Recovery Efforts Underway for Affected Users

The team managing the recovery process is reportedly on track with an estimated two-week timeline. Significant progress is being made as engineering teams explore multiple technical avenues concurrently to identify the most secure method for recovering funds for affected users.

SecondFi, a prominent Cardano wallet provider formerly known as Yoroi Wallet, experienced a critical flaw in its key-generation software. This led to three external attackers draining an estimated 16 million ADA, valued at approximately $2.4 million, from 374 addresses across four separate incidents.

The larger movement of 129 million ADA, which is at the heart of the identity dispute, was characterized by SecondFi as an emergency rescue operation. These funds were reportedly transferred to an “independent, qualified third-party custodian” for the benefit of the affected addresses. Cybersecurity firm SlowMist has estimated the total exposure could surpass $20 million.

SecondFi conducted a final balance snapshot on June 26 and has stated its intention to return lost user assets within two weeks. However, the company has cautioned that this timeline is not guaranteed and has advised users against moving funds to new wallets in the interim, warning that “independent actions taken outside of official guidance create additional risks.”

Technical Analysis of ADA Price Action

ADA is currently trading near $0.145, marking a 21% decrease over the last two weeks. The cryptocurrency is trading well below its 50-day Exponential Moving Average (EMA) of $0.1904, its 100-day EMA of $0.2248, and its 200-day EMA of $0.3006.

The Relative Strength Index (RSI) is hovering around 29, approaching oversold territory. The Moving Average Convergence Divergence (MACD) has turned marginally positive, suggesting a fading bearish momentum rather than a confirmed reversal.

Key support is identified at the psychological level of $0.140, with a structural low near $0.1382. A daily close below $0.1451 could expose this zone directly.

On the upside, initial resistance is observed in the $0.1726–$0.1737 range, which encompasses a broken descending trendline and the 23.6% Fibonacci level. Further resistance is expected at the 50-day EMA ($0.1904) and the 38.2% Fibonacci retracement level ($0.1957).

The CoinGlass long-to-short ratio stands at 0.72, the lowest it has been in over a month. Funding rates are negative at -0.0055%, indicating that short positions are currently paying long positions, a mild contrarian signal.

Q2 2026 Sees Record High in Crypto Hacks, Losses Mount

Decentralized finance (DeFi) platforms have been hit by 121 hacks this year, resulting in approximately $942 million in losses, according to a report released this week by crypto market tracker CryptoRank.

The second quarter of 2026 proved to be the most volatile period on record for the crypto sector, with 85 incidents and an estimated $775 million stolen. This surge in attacks coincides with a broader struggle in the cryptocurrency market, marked by declining investor confidence. The total value locked (TVL) in DeFi protocols has seen a consistent monthly decrease throughout the year, falling from around $115 billion in January to $70 billion by late June.

CryptoRank’s data indicates that the 85 incidents in Q2 2026 represent a significant increase, exceeding the second-highest frequency of exploits—which occurred in Q1 2026—by 49. However, the total dollar value of losses in the second quarter did not reach previous peaks. The data provider noted that two major attacks in April accounted for the majority of the quarter’s losses.

Major Heists Fuel Q2 Losses

Drift Protocol and KelpDAO collectively lost $590 million, a sum that represents more than half of all DeFi losses recorded in 2026. Drift Protocol reported that attackers made off with approximately $285 million in user assets. Investigations by blockchain intelligence firm TRM Labs have linked this operation to hacking groups with ties to North Korea.

According to TRM, the preparatory stages of the attack began on-chain as early as March 11 with a 10 ETH withdrawal from Tornado Cash. This transaction followed months of in-person meetings between proxies of the Pyongyang regime and Drift employees. TRM Labs stated in a report published April 30 that “the attacker used social engineering to induce Drift Security Council multisig signers into pre-signing transactions that appeared routine but carried hidden authorizations for critical admin actions.”

Just over two weeks later, North Korea’s Lazarus Group targeted KelpDAO, a liquid restaking protocol, exploiting its LayerZero bridge infrastructure and stealing roughly $290 million worth of rsETH. Chainalysis reported at the time that the attackers forged a cross-chain message on April 18 after compromising two remote procedure call nodes utilized by LayerZero’s Decentralized Verifier Network. Concurrently, the criminals launched a distributed denial-of-service attack on a third node, manipulating the system to rely on compromised verifiers. This compromised verification process allowed for the creation of rsETH tokens on Ethereum without the corresponding assets being burned on Unichain.

Broader Market Impact and Shifting Landscape

In the immediate aftermath of these attacks, the lending protocol Aave experienced a sharp decline in its TVL, dropping from $26.4 billion to $14.3 billion, with $12 billion in funds withdrawn, representing a decrease of approximately 46%.

This significant dip in Aave’s TVL was not an isolated incident. CryptoRank’s data confirms that the value locked across all of DeFi declined every month in 2026, falling from $115.3 billion in January to just over $70 billion in June. While hacks were not the sole driver of this decline, the firm suggested that the increased frequency of such incidents likely eroded user confidence, leading to a broader shift away from the sector.

However, the current downturn is less severe than the one experienced during the 2021-2022 cycle, when DeFi TVL plummeted by more than 70% in seven months. CryptoQuant notes that the current decline has been more gradual, and the market structure has evolved. The stablecoin supply has grown to approximately $300 billion, real-world asset tokenization is expanding, and capital is now more dispersed across various sectors, including derivatives, infrastructure, and lending, rather than being concentrated in a few automated market makers (AMMs) and yield farms.

Among the largest ecosystems by TVL, only Tron and Hyperliquid have shown growth this year, with Tron gaining 5% and Hyperliquid adding nearly 7%, solidifying its position as a dominant venue for on-chain perpetuals. The remaining top 10 chains have experienced significant declines, with Plasma and Arbitrum being the hardest hit, seeing their TVL plunge by 74.6% and 55%, respectively.

Polymarket Confirms $3 Million Stolen in Frontend Attack, Promises Full Refunds

Polymarket confirmed Friday that a compromised third-party vendor allowed attackers to inject malicious code into its frontend, resulting in the theft of approximately $3 million from fewer than 15 user accounts. The platform has pledged to fully reimburse all affected users.

Security Researcher Flags Breach

The attack was initially identified by on-chain security researcher Specter, who reported that an apparent phishing campaign had drained funds from over 11 victim wallets holding Polymarket’s PUSD stablecoin. At the time of Specter’s report, estimated losses stood at $2.94 million. PeckShield later corroborated this figure, noting that the attacker had bridged the stolen funds from Polygon to Ethereum and converted them into 1,893 ETH.

Polymarket Acknowledges Incident

The prediction market platform acknowledged the breach through one of its official communication channels, Polymarket Traders. “This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We’ve contained it and removed the affected dependency,” the statement read on X. “We’re contacting impacted users and refunding them in full.”

William LeGate, who works closely with Polymarket, reiterated the commitment to compensation, confirming that the issue had been resolved and that affected users would receive their full funds back.

Supply Chain Attack Identified

Other blockchain security firms, such as GoPlus Security, characterized the incident as a supply chain attack. They reported that the malicious code impacted approximately 15 accounts, with total losses amounting to $3 million. Bubblemaps reached a similar conclusion and commended Polymarket’s swift response in containing the losses.

Previous Security Incidents

This is not the first security breach to affect Polymarket. Last month, the platform disclosed an incident where an admin wallet used for employee rewards was drained of about $700,000, likely due to a private key compromise. Initially, crypto investigator ZachXBT estimated the losses at around $520,000, with Bubblemaps later revising the figure upwards after tracing the funds.

Developer Josh Stevens confirmed at the time that a six-year-old private key had been exposed through an internal configuration error. The company subsequently rotated credentials and transitioned to key management services. Importantly, that prior incident did not affect user funds or core contracts.

Broader Reputational Challenges

While the two incidents involved distinct attack vectors, both targeted systems external to Polymarket’s core prediction markets. The latest breach occurs as the platform faces other reputational challenges. A recent report by The Wall Street Journal alleged that Polymarket paid college-age creators between $2,000 and $3,000 per month to post videos of staged bets on dummy versions of its website, with none of the over 1,100 clips demonstrably linked to real blockchain activity.

Adding to recent controversies, an early-this-month claim by a trader alleged a $500,000 loss after the prediction service purportedly altered resolution rules for a market tied to Strategy’s Bitcoin sale.

Third-Party Vendor Hack Leads to Millions in Losses for Polymarket Users

A hack targeting one of Polymarket’s third-party vendors on Thursday has left the prediction market platform vulnerable, resulting in millions of dollars in losses for its users, the company announced.

Polymarket declined to comment when reached by Decrypt and has not publicly identified the compromised vendor. However, the company stated in an X post that the attack allowed hackers to inject malicious code into the prediction market’s front-end. Ultimately, the hackers made off with approximately $3 million in customer funds.

On-chain investigators at Bubblemaps concluded that the potential damage from the hack was largely contained, affecting fewer than 15 user accounts. The blockchain investigation firm did not immediately respond to Decrypt’s request for comment.

Polymarket has stated that it is in the process of fully refunding all impacted customers and that the front-end issue has been resolved and removed.

It remains unclear what measures the prediction market platform can implement to prevent similar exploits in the future, given its reliance on external, third-party businesses that are apparently integral to the site’s operations.

The attackers appear to have drained funds from Polymarket customer wallets holding pUSD, a Polymarket-specific dollar-pegged stablecoin backed by USDC, which is used for all trading on the platform. The stolen funds were then converted into ETH and consolidated into an Ethereum wallet, where they remain as of this report.

This incident follows another hack last month, which targeted a wallet used by Polymarket employees for topping up and distributing user rewards. That exploit resulted in approximately $700,000 in losses for the company and was likely caused by a private key compromise. At the time, experts indicated that it did not appear to affect the company’s core infrastructure or pose broader risks.

Both this recent exploit and the one in May highlight the capacity of hackers to infiltrate major companies through peripheral vulnerabilities, even when their core protocols remain secure.