Scams

On Tuesday, SlowMist released its 2025 Blockchain Security & AML Annual Report, estimating roughly $2.935 billion stolen in 2025, up 46% from 2024, even as incidents fell 51% to 200. DeFi logged 126 cases and about $649 million in losses, while CEX breaches (22) totaled $1.809 billion. The firm also noted 18 recovery or freeze events, with nearly $387 million secured from $1.95 billion in stolen funds.

Unleash Protocol suffered a governance-level exploit that allowed an attacker to deploy an unauthorised contract upgrade and withdraw about $3.9 million in user assets. The incident, identified by PeckShieldAlert and later confirmed by the team, affected tokens including WIP, USDC, WETH, stIP, and vIP, with 1,337.1 ETH ultimately funneled into Tornado Cash via Ethereum bridges. Platform operations have been paused while external security specialists investigate how the multi-signature admin controls were bypassed.

In 2025, blockchain investigator ZachXBT identified a Canadian actor known as Haby/Havard who allegedly impersonated Coinbase support and siphoned more than $2 million in crypto via social‑engineering phone calls. He tied on‑chain activity to social media posts, including a Dec. 30, 2024 XRP theft and a Feb. 2025 Bitcoin wallet screenshot showing $237,000, linking multiple victim cases.

Blockchain investigator ZachXBT on Dec. 29, 2025 outlined evidence tying a Canada-based actor to more than $2 million stolen by impersonating Coinbase customer support. The scheme used social engineering across Telegram and social media, with on-chain traces linking XRP thefts and subsequent conversions to bitcoin.

On 30 December 2025, China’s Supreme People’s Court outlined a push to update legal tools for digital assets in its 2025 Digital Rule of Law journal. While crypto trading remains banned, courts increasingly treat cryptocurrencies as virtual property and plan clearer rules for electronic transactions, digital records, and AML coverage amid rising cybercrime and disputes.

Flow abandoned plans for a full-chain rollback after a December 27 exploit siphoned about $3.9 million, following heavy criticism from developers and bridge operators. The FLOW token fell more than 50%, briefly near $0.079, while phase one sets EVM operations to read-only and temporarily restricts affected accounts.

On 29 December 2025, DPRK-linked crypto hacking was described as a major revenue channel for Pyongyang. In the first half of 2025, operators extracted more than $2.17 billion in digital assets, and in February attackers drained nearly $1.5 billion in Ether from Bybit. Experts say evolving multi-chain laundering and broader industry coordination will shape the fight ahead.

Trust Wallet has launched a formal claims process for users affected by its Chrome extension v2.68 incident that exposed recovery phrases and drained funds. The company confirmed the breach on December 25 and outlined the compensation workflow on December 26. Changpeng Zhao said around $7 million was affected and pledged reimbursement for verified losses.

According to an investigation by TRM Labs, a coordinated group of Russian cybercriminals allegedly laundered more than $35 million in cryptocurrency stolen from LastPass users after the 2022 breach. The funds were moved through instant exchanges, Bitcoin mixers and Russian platforms including Audi6 and the OFAC-sanctioned Cryptex, with investigators using behavioral continuity analysis to trace the flow. The report indicates that wallet activity tied to the mixers showed operational links to Russia before and after the laundering process.

A report published on 27 December alleges wallets linked to Andrew Tate received about $1.2 million from addresses named in a Texas lawsuit tied to a $5 million investment scam. Court documents filed in March 2025 describe laundering between January 2023 and February 2025, while related wallets reportedly moved up to $30M into the privacy protocol Railgun over the past two years.