A major cryptocurrency heist was detected involving social engineering and malicious code downloads. Tools used for generation Text Gemini Narator Azure TTS Clips Pexel Rendering Remotion

A former special agent with the Federal Bureau of Investigation (FBI) has formally entered a guilty plea following allegations of digital asset theft. On November 5, 2026, Patrick Steven Yaroch admitted to wire fraud and…

US government agencies and cyber analysts have blamed Pyongyang for the record-breaking heist.

If the accusations are true, the record-making heist shows how powerful suspected North Korean hackers have become.

Two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor.

The FBI has blamed North Korean hackers, specifically an entity known as TraderTraitor, for the reco...

The attack is a major setback for an industry intent on shedding its reputation as too risky — and too vulnerable to criminals— for widespread use.

Two Texas brothers have been sentenced to significant prison terms following a violent home invasion and the theft of over $2 million in cryptocurrency. According to the U.S. Attorney's Office for the District of Minneso…

CryptoMarket and Blockchain News

Renowned on-chain investigator ZachXBT has released a detailed report exposing FreedomXMR (FXMR), a centralized money laundering service operating on the Hyperliquid Core (HL Core) network. According to the findings publ…

CryptoMarket and Blockchain News

ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack Posing as a client, the onchain sleuth said he gathered intelligence that helped action freezes tied to the $1.5 billion Bybit hack and attribute illicit activity onchain. Blockchain investigator ZachXBT said he infiltrated a Chinese organized crime network and gathered intelligence that helped action freezes tied to the 2025 Bybit hack. In a detailed thread on X, ZachXBT alleged that the Chinese crime syndicate laundered over $1 billion across multiple exploits for North Korea's Lazarus Group. The onchain sleuth said he began investigating after he noticed a pattern involving more than 15 accounts in Telegram and Discord groups seeking help with orders tied to stolen funds following the Bybit exploit in February 2025. Posing as a client, ZachXBT funded a new address with 349,700 USDC on Ethereum to conduct multiple transactions with a vendor who went by the pseudonym "Jimmy Green." In March 2025, Jimmy provided ZachXBT with the receiving address "0xbaa5" to exchange USDC for USDT on Tron. The sleuth said that Jimmy's receiving address was gas-funded by a wallet that was "directly traceable to Bybit exploit funds" and appeared on Bybit's public exploit blacklist. ZachXBT also said that Jimmy discussed plans to move Bybit funds for North Korea before the transactions occurred and shared details about the group's operation in Hong Kong and mainland China. "One day prior, he stated funds would be moved to Solana and the next day they were," ZachXBT said. "He stated his team laundered most of the $1.5 billion from Bybit, which was consistent with the laundering patterns I observed." Repeated pattern ZachXBT said other claims made by Jimmy showed similar ties to illicit funds. Among those operations, a March 12 bridge screenshot shared by Jimmy matched a THORChain order created within minutes, according to ZachXBT. Three Solana addresses Jimmy shared also helped identify a cluster of over $12 million in Bybit exploit funds that had been swapped across BTC, ETH, SOL, and Tron, he said. Tether later froze 442,000 USDT linked to the cluster. Two other claims in their conversations were also checkable, he said. Jimmy's mention of roughly $300,000 frozen in 2024 matched 332,000 USDC from the Poloniex exploit. Jimmy also claimed to have laundered $3 million in fraud proceeds for another client. ZachXBT said he traced those funds to a hot wallet of Huione Guarantee, which has been sanctioned. "Throughout our conversations, Jimmy and I had a lot of small talk in between discussing laundering for DPRK," said ZachXBT. "He talked about playing mahjong, hunting wild rabbits, food, his fat-reducing meal, family life, and vacations at Disney." ZachXBT noted that he ultimately fronted $349,700 and lost about 5% per order, "with no guarantee Jimmy wouldn't disappear with the funds." He said he continued trading with the group in an effort to "gamble on capturing as much actionable intel as quickly as possible." The investigator said he immediately shared his findings with law enforcement but was unable to disclose details sooner due to sensitivity around the investigation. He added that he has helped facilitate the freezing of $75 million in funds related to North Korean incidents since 2022. Ref: https://paykalken.com #ZachXBT #Bybit #LazarusGroup #CryptoHack #CryptoCrime #NorthKorea #BlockchainSecurity #OnChain #CryptoNews #CyberSecurity ZachXBT says he fronted $349,700 to infiltrate alleged Chinese launderers tied to Lazarus, Bybit hack

https://www.osintinvestigate.com This week in financial forensics: insider trading investigations, investment fraud, private-market scams, crypto fraud, asset recovery, prediction markets and new SEC crypto custody rules from September 27 to October 3, 2026.

 Microsoft’s account on X was hacked and used to promote a cryptocurrency token, turning the technology company’s 13-million-follower social media presence into part of an apparent crypto pump-and-dump operation. The incident centered on the company’s @Microsoft account and began with activity involving another X profile impersonating Clippy, Microsoft’s former virtual assistant.  The Microsoft account followed and reposted a post from @clippymsftcto, an account that has since been suspended. The activity subsequently drew attention to a $Clippy token. Another account, @ClippyMSFT, reposted Microsoft’s message and continued promoting the cryptocurrency. That account claimed the token had a liquidity pool directly paired with $MSFT. Microsoft later removed the unauthorized posts and acknowledged that its account had been accessed unauthorized.  A company spokesperson said the account had been secured and that Microsoft was investigating how the breach occurred. The company also made clear that it had no association with the cryptocurrency which was being promoted. Microsoft said it did not authorize, sponsor or endorse a cryptocurrency associated with Clippy, Microsoft or $MSFT, and had not authorized the use of its branding or intellectual property in connection with such a token. The incident is part of a long pattern of cryptocurrency scams involving compromised accounts belonging to major organizations.  Microsoft itself experienced a similar breach in June 2024, when its Microsoft India account, which had more than 211,000 followers, was taken. In that case, attackers used the account to impersonate meme-stock trader Keith Gill, known online as Roaring Kitty. They attempted to lure users to a website advertising a supposed GameStop cryptocurrency presale. Victims who connected their wallets and authorized transactions instead had their crypto assets stolen through a wallet-drainer malware. Compromised social media accounts has been a particularly useful tool for cryptocurrency scams, as posts from established organizations can appear more credible to potential victims.  ScamSniffer reported in December 2023 that approximately $59 million in cryptocurrency has been stolen from 63,000 people through a Twitter advertising campaign using the “MS Drainer” wallet-draining service between March and November. Government accounts have also been targeted. In January 2024, the U.S. Securities and Exchange Commission’s official X account was compromised through a SIM-swapping attack. Attackers used it to publish a fake announcement claiming that Bitcoin exchange-traded funds had received approval, temporarily but significantly moving Bitcoin’s price.  Eric Council Jr., identified as the hacker who compromised the SEC account, pleaded guilty in February 2025 and was sentenced to 14 months in prison over his involvement in the scheme. Microsoft now has its account secured and the posts associated with the breach removed. Its investigation is ongoing, but the cryptocurrency promotion associated with the unauthorized activity has further raised the risks of trusting what appear to be legitimate social media posts when they involve digital-asset promotions.