Scams

On December 24, 2025, Binance founder Changpeng Zhao called for industry-wide measures to eradicate address poisoning after a trader's nearly $50 million USDT loss on December 19. He said Binance Wallet already uses automated checks to warn against flagged recipients and urged other platforms to deploy similar protections. The attacker later converted the funds and funneled them through Tornado Cash.

Entities linked to alleged Mt. Gox hacker Aleksey Bilyuchenko moved another 1,300 BTC worth about $114 million to unknown exchanges over the past week. Since October, these addresses have sold 2,300 BTC and still hold 4,100 BTC valued near $360 million, indicating an ongoing, controlled distribution.

U.S. regulators halted an alleged crypto fraud that took over $14 million from investors on 24 December 2025. The operation used social media groups, private chats, and slick but fictitious platforms, then pressured victims to pay new fees during withdrawal attempts, leaving funds unrecovered.

After Balancer disclosed a vulnerability on November 3, Gnosis validators carried out a hard fork earlier this week to strip the attacker of control over the exploited assets. With more than $116 million drained and roughly $28 million later recovered by white‑hats, the plan now focuses on DAO custody and community governance to manage restitution.

On December 24, 2025, India's Enforcement Directorate conducted coordinated searches under the PMLA, raiding 21 residential and office locations across Karnataka, Maharashtra, and New Delhi. The case names 4th Bloc Consultants and involves allegedly fake crypto investment platforms that targeted investors in India and abroad; no arrests have been announced.

In 2025, crypto attackers stole $3.3 billion, CertiK reported, even as total incidents fell by 162. Supply chain compromises drove $1.45 billion in losses, with the largest case allegedly linked to Bybit. CoinMarketCap showed ETH at $2,942.71 on December 23, 2025.

In November 2023, Binance agreed to a $4.3 billion criminal plea deal with US authorities, but later findings allege the exchange still allowed flagged accounts to process large crypto flows. An investigation into 13 Binance accounts reportedly uncovered $1.7 billion in crypto movements, including $144 million after the plea deal, with links to Iran, Hezbollah and wallets later frozen under anti-terrorism laws. Binance's legal team denies knowingly facilitating criminal activity and says relevant wallets were not designated for terror financing at the time.

Kaspersky reported on Thursday that a Windows-targeting infostealer dubbed 'Stealka' is spreading via video game cheats, mods, and pirated software. Distributed through GitHub, SourceForge, and Google Sites, it harvests autofill and extension data from over 100 Chromium- and Gecko-based browsers and threatens 115 extensions and 80 crypto wallets.

Two Canadians from Ontario and Prince Edward Island lost a combined $2.3 million to an AI-enabled deepfake cryptocurrency investment scheme. The Ontario victim lost $1.7 million after being deceived by a fake Elon Musk video, while the other victim lost $600,000 after watching a clip falsely linked to Dragon's Den. The report was updated on December 21, 2025.

On December 21, 2025, SantaStealer was detailed as a malware-as-a-service that prioritizes crypto wallets. It is promoted on Telegram and hacker forums with monthly plans at $175 (Basic) and $300 (Premium). Rapid7 links it to BluelineStealer and notes weak evasion, while data is exfiltrated in 10MB chunks over port 6767.