Scams

Ethereum's Clear Signing went live on May 12, 2026, with Ledger, Trezor and MetaMask switching signature prompts from hex strings to human-readable transaction details. The change targets signature-phishing losses that reached $6.27 million from 4,741 victims in Q1 2026, while keeping blind signing possible but more avoidable. The standard improves clarity for approvals such as "unlimited" token spend, though it does not remove risks tied to compromised apps or incomplete dApp metadata.

A report cited by Bitcoin journalist Joe Nakamoto says France accounts for about 70% of so-called crypto "wrench attacks," where victims are physically threatened to surrender digital assets. Nakamoto said France has recorded 41 crypto-related kidnappings so far in 2026, and linked the spike to centralized KYC databases and past breaches such as Ledger's 2020 customer-data leak.

On May 23, 2026, Rio de Janeiro Civil Police said a raid targeting a Comando Vermelho operational nucleus uncovered a small crypto-mining room with about 30 computers on shelving inside what appeared to be an abandoned lot. Investigators said the site drew electricity from an illegal line connected directly to a utility pole, using high-capacity cooling and remote-monitoring equipment. Authorities are examining whether the structure was linked to moving or laundering funds.

On May 21, 2026, Ripple Chief Technology Officer David Schwartz cautioned the XRP community about a sharp uptick in AI-enabled scam campaigns, including deepfake videos and fake giveaways. He said schemes often push bogus XRP airdrops that lure users into sending funds or connecting noncustodial wallets to malicious sites that can rapidly drain holdings. Schwartz also described a separate phishing effort aimed at Robinhood users that leveraged Gmail address tricks and emails designed to look authenticated.

TRM Labs data published in May 2026 says North Korea was linked to $577 million of the $651 million lost to crypto hacks in January–April 2026, or 76% of the total. The losses were concentrated in two April incidents attributed to Lazarus subgroup TraderTraitor: $285 million from Drift Protocol on April 1 and $292 million from Kelp DAO on April 18–19.

Missouri Attorney General Catherine Hanaway's office said it filed a lawsuit Wednesday against GPD Holdings, which operates crypto ATMs under the CoinFlip brand, alleging the company knowingly facilitated fraudulent transactions. The state is asking the court to block CoinFlip from operating in Missouri, impose $1,000 per violation over the past five years (up to $1,826,000), and order restitution for consumers.

npm has revoked granular write-access tokens tied to compromised developer accounts in an effort to curb a new wave of the self-replicating “Mini Shai-Hulud” supply-chain worm. The platform also urged users to rotate secrets and move to Trusted Publishing, but researchers say infected machines can still leak data locally. The latest spike followed the compromise of the npm account “atool,” which published 637 malicious versions across 323 packages in 27 minutes.

Turkey expanded an eight-day crackdown on illegal betting with two May 18 raids in Antalya and Mersin that brought legal action against 233 additional suspects and cited more than TL 18 billion ($395 million) in alleged transaction volume. Across four major raids since May 11, authorities say the total has exceeded 670 suspects, while an earlier Adana case alleged that cryptocurrency platforms were among the channels used to launder proceeds.

Echo Protocol said Tuesday it is investigating a security incident affecting its Echo bridge on Monad and has suspended all cross-chain transactions after about 1,000 unauthorized eBTC was minted. The attacker moved part of the proceeds through Curvance and ultimately sent 384 ETH to Tornado Cash, while still holding 955 eBTC, according to DeBank.

Adshares said an attacker involved in its bridge incident returned 256 ETH (about $540,700), roughly 86% of the estimated $628,000 taken. The exploit was linked to bridge mint-validation failures, and analysts warned that recovery windows often trigger phishing “refund” sites and impersonator accounts.