Oct 2, 2026
Brazil will mandate that regulated banks and exchanges report cryptocurrency transfers of $10,000 or more involving self-custody wallets beginning October 1, 2026, expanding anti-money laundering oversight across the country's $252.5 billion crypto market.
THORChain declined Bitget's formal request to block addresses linked to the $387.5 million hack, stating it 'doesn't censor by design' and comparing itself to Bitcoin's permissionless nature, while approximately $6 million in stolen funds moved through the protocol.
SEC Commissioner Hester Peirce urged regulators to adopt zero-knowledge proof technology to allow cryptocurrency firms to conduct KYC checks while collecting less personal data. The proposal comes as federal agencies advance stablecoin regulation under the GENIUS Act.
U.S. federal prosecutors have charged a Vietnamese national with money laundering in connection with a "pig butchering" cryptocurrency scam that defrauded one victim of approximately $16 million. The case involves a sprawling fraud scheme that moved funds through cryptocurrency channels.
SEC Commissioner Hester Peirce, known as 'Crypto Mom' for her advocacy of digital assets, announced her resignation effective next week after years of service. In one of her final speeches, she called for reducing KYC data collection and implementing zero-knowledge proofs to protect privacy.
A malicious iOS application called FomoPeek has been connected to the theft of approximately $580,000 in cryptocurrency. Security researchers from SlowMist provided analysis on how the app operated and offered guidance for users who installed affected versions.
A joint operation between Microsoft, Coinbase, and law enforcement has taken down EvilTokens, an AI-powered phishing-as-a-service platform that compromised over 12,000 email inboxes across more than 10,000 organizations and traced $1.1 million in crypto theft.
Four hooded men broke into a family home in Vendin-le-Vieil, northern France, and restrained a cryptocurrency worker, his wife, and their two children, forcing the father to transfer €40,000 in digital assets before fleeing. The incident is part of a growing trend of violent "crypto-rapts" targeting cryptocurrency holders in France.
Cybercriminals deployed malware called Needle Stealer, disguised as an AI-powered crypto trading agent, to target seven browser-based cryptocurrency wallet extensions including MetaMask and Coinbase Wallet. The malware used signed Microsoft software to steal passwords and replace wallet extensions.
A North Korea-backed hacking group infected more than 30,000 computers across over 100 countries using fake job offers, stealing cryptocurrency worth approximately $11 million from more than 7,000 crypto wallets. Japan's National Police Agency and the FBI jointly disclosed the large-scale cyberattack campaign targeting IT engineers globally.
NEAR Protocol enabled private perpetual futures by default on September 17, routing all deposits through a confidential layer that masks positions. The feature is powered by Hyperliquid's infrastructure and represents the industry's first 'confidential by default' perpetuals trading.
Authorities in the UAE and Sweden conducted a coordinated operation arresting seven suspects, including a Swedish national wanted under an Interpol Red Notice, for allegedly running an international money laundering network that moved approximately 70 million Swedish krona ($7.1-7.5 million) in cryptocurrency. The network is linked to organized crime and contract killings.
The US Treasury sanctioned Iranian cryptocurrency exchange BitBank, accusing it of processing hundreds of millions of dollars in bitcoin for Iran's Islamic Revolutionary Guard Corps and facilitating payments for ships transiting the Strait of Hormuz.
A group claiming responsibility for a Revolut data breach is demanding 6,000 XMR (roughly $3 million) within 24 hours, threatening to sell stolen customer data including passport information and Bitcoin transaction histories. The breach reportedly exposed data on at least 680 customers.
Hamas' military wing Al Qassam Brigades advised potential donors to avoid using Binance for cryptocurrency transfers and instead use platforms including Bybit, OKX, Kast, and Redotpay, according to U.S. Department of Justice documents released in September 2026.
Attackers compromised a legitimate Italian state email address to impersonate law enforcement and trick Revolut into releasing personal data of approximately 680-700 customers, primarily cryptocurrency holders. The hackers are now demanding a $3 million ransom in Monero cryptocurrency with a 24-hour deadline to prevent the data's sale.
Bulgaria's parliament approved amendments to its Tax and Social Security Procedure Code requiring cryptocurrency service providers to report detailed customer identities, tax residency information, and transaction data to tax officials. The legislation, passed with 149 votes in favor and 10 abstentions, aligns Bulgaria with EU directives aimed at curbing tax evasion and enhancing cross-border tax transparency.
Swiss Bitcoin Pay, a non-custodial bitcoin payment processor based in Neuchâtel, shut down its entire server infrastructure on Monday after discovering a malicious intruder had gained access to its internal systems. The company warned that customer email addresses, Bitcoin addresses, IBANs, transaction history, and hashed passwords may have been compromised.
Thailand's Securities and Exchange Commission has proposed regulations that would require licensed crypto firms to only accept stablecoin deposits and withdrawals through accounts verified in the customer's own name, effectively blocking transfers to other people's wallets. The draft rules also set a daily transaction cap of 5 million baht ($151,000).
Authorities uncovered a clandestine cryptocurrency mining farm operated by a drug cartel in the mountains of central Mexico, highlighting cartels' expanding use of digital currencies for funding operations.
Hardware wallet maker Trezor disclosed that attackers compromised its third-party email provider Brevo, enabling phishing emails to be sent from Trezor's legitimate domain to approximately 347,000 newsletter subscribers.
India's Financial Intelligence Unit issued non-compliance notices to 15 cryptocurrency platforms including Weex, Blofin, Bitunix, DigiFinex, and Toobit under the Prevention of Money Laundering Act, ordering them to block public access to their apps and websites. The action raises concerns about sudden account lockouts for users.
Spain's largest cryptocurrency exchange Bit2Me has established a specialized unit called Bit2Shield to assist police, courts, and financial institutions with tracing, seizing, storing, and liquidating cryptocurrency linked to criminal investigations.
Carlos Erick Vazquez Gonzalez, 48, pleaded guilty to conspiring to launder approximately $4 million in drug trafficking proceeds from the United States back to Mexico using cryptocurrency. He worked with money brokers and the Cartel Jalisco Nueva Generación, earning $40,000 for his role, and faces up to 20 years in prison.
The Treasury Department's Financial Crimes Enforcement Network (FinCEN) identified approximately $12.7 billion in suspected financial activity linked to digital asset investment scams operated by overseas criminal networks, based on analysis of 33,904 Bank Secrecy Act reports. The alert urges financial institutions to report suspicious activity related to these scams.
Hardware wallet manufacturer Trezor disclosed that an additional 67,000 U.S. customers were affected by a data breach at shipping partner ShipMonk, bringing the total to over 80,000 exposed customer records. The breach involved personal information including names, email addresses, phone numbers, and shipping addresses from orders dating back to 2019, despite Trezor's belief that ShipMonk had deleted the data as certified.
Hardware wallet manufacturer Trezor disclosed on September 4 that an additional 67,000 US customers were affected by the ShipMonk shipping partner data breach, bringing the total to approximately 80,700. The breach exposed names, addresses, and phone numbers of customers who ordered between November 2019 and August 2021.
The Financial Crimes Enforcement Network analyzed 33,904 suspicious activity reports and identified $12.7 billion in crypto transactions linked to pig butchering and other scams operated from Asian compounds.
U.S. law enforcement and CrowdStrike announced the takedown of Sality, a Russian cybercrime operation active since 2003 that used clipjacking malware to steal cryptocurrency by replacing copied wallet addresses. More than 15,000 infected machines have been isolated in the global operation.
The Financial Crimes Enforcement Network analyzed over 33,000 suspicious activity reports filed between September 2023 and December 2025, identifying $12.7 billion in suspected fraudulent cryptocurrency transactions tied to pig butchering scams operated from Asian compounds. The announcement comes as Singapore authorities separately reported preventing $9 million in crypto scam losses through a joint police and exchange operation.
Two Thai businessmen filed a lawsuit in New York federal court claiming Tether froze $42.4 million in USDT across 10 Ethereum addresses at an informal US law enforcement request, more than three months before a seizure warrant was issued. The plaintiffs allege the freeze was unlawful.
The Justice Department and CrowdStrike announced Tuesday they have disrupted the Russia-based Sality botnet, which has been operating since 2003. For the past eight years, the malware used EggJagger to steal Bitcoin and Ethereum by replacing copied cryptocurrency addresses with attackers' addresses, infecting over 15,000 machines.
The Justice Department announced the FBI seized more than $560,000 in cryptocurrency donations allegedly intended for Hamas's Al Qassam Brigades, taking control of fundraising domains and servers. The operation disrupted terror financing through targeted crypto warrants issued in 2025.
South Korea's National Tax Service announced it will introduce commercial cryptocurrency tracing software used by domestic and international investigative agencies to prepare for taxing income generated through private crypto transactions starting in 2027.
A fraudulent Claude desktop application is distributing RevStealer malware designed to steal data from over 50 cryptocurrency wallets, password managers, and browsers. Anthropic has begun alerting users whose active login sessions were compromised by infostealer malware, with attackers using stolen sessions to access accounts and exhaust usage limits.
Blockchain analytics firm Chainalysis organized Operation Light Shine, a multi-day investigation with support from Binance and Coinbase that identified more than 7,700 suspect accounts linked to child sexual abuse material networks.
The U.S. Treasury expanded sanctions against Iran's digital asset sector on August 24, granting broader authority to target foreign entities facilitating crypto transactions, while also sanctioning four India-based companies and three Indian nationals for importing Iranian petroleum products.
The U.S. Treasury expanded sanctions against Iran's digital asset sector on August 24, granting broader authority to target foreign entities facilitating crypto transactions, while also sanctioning four India-based companies and three Indian nationals for importing Iranian petroleum products.
The US Treasury's OFAC issued a sectoral determination allowing it to sanction any person worldwide who operates in Iran's digital asset sector, as part of Treasury Secretary Bessent's 'Operation Economic Outcast' targeting Iran's economy through crypto, gold, shipping and technology sectors.
The US Treasury Department expanded Iran sanctions to cover the country's digital asset sector, citing over $100 million in crypto payments allegedly used to facilitate Iranian oil sales as part of 'Operation Economic Outcast.'
Treasury Secretary Scott Bessent announced a new wave of sanctions aimed at Iran's use of cryptocurrency and international networks to circumvent existing US economic restrictions. The move represents an escalation in Washington's economic campaign against Tehran, with threats of secondary sanctions on cooperating entities.
The Trump administration unveiled Operation Economic Outcast, a sweeping sanctions offensive against Iran targeting digital assets, oil, shipping, aviation, gold, and technology sectors. Treasury Secretary Scott Bessent warned trading partners to cut ties with Iran but indicated the US would give countries time to comply before imposing secondary sanctions.
European Central Bank Executive Board member Piero Cipollone stated that the digital euro would provide privacy comparable to cash and that the Eurosystem would not be able to identify users, addressing criticism over financial surveillance risks associated with central bank digital currencies.
HM Revenue and Customs sent over 81,000 warning letters, emails, and text messages to cryptocurrency investors suspected of owing unpaid taxes during the 2025/26 financial year, marking a sharp increase in scrutiny of digital asset holdings. The figures were revealed through a freedom of information request.
South Korean authorities have clarified that their planned 22% digital asset tax, set to take effect January 1, 2027, will cover cryptocurrency income from private wallets and overseas exchanges, not just domestic platforms. The expanded tax regime will require enhanced information gathering from international platforms.
The European Union is preparing to significantly expand sanctions against Russia in the coming months, including measures targeting 14 foreign crypto service platforms and introducing country-level transaction bans that could cut EU operators off from crypto providers suspected of sanctions evasion, according to EU foreign policy chief Kaja Kallas.
Blockchain analytics company Chainalysis filed suit against the US government over Immigration and Customs Enforcement's decision to award a sole-source contract to competitor TRM Labs, alleging the procurement process was improper.
Binance-backed cryptocurrency wallet provider SafePal disclosed that a flaw in an order-tracking plugin exposed names, phone numbers, and shipping addresses of 39,798 customers over 14 months. The stolen records are now being advertised on cybercrime forums, raising concerns about phishing and physical security risks for affected users.
Cryptocurrency wallet provider SafePal disclosed a security breach that exposed names, physical addresses, and contact details of 39,798 customers. The breach follows a similar incident at Trezor days earlier that affected 13,689 users.
Hardware wallet manufacturer Trezor disclosed that approximately 14,000 customers across seven countries had their names, email addresses, and shipping information exposed after unauthorized access to systems at ShipMonk, its third-party fulfillment partner. The company emphasized that customer wallets and funds remain secure.
South Korea's Cabinet approved regulations removing the 1 million won ($700) minimum threshold for crypto Travel Rule compliance, requiring information sharing for all virtual asset transfers between registered service providers regardless of amount. The revision also mandates disclosure of major shareholder information for VASP registration applicants.
Australia's financial intelligence agency AUSTRAC suspended crypto ATM operator Cryptolink's registration for three months, taking 96 cryptocurrency ATMs across the country out of service. The suspension was issued due to missing transaction reports and the company's failure to respond to regulatory inquiries.
Brazil's central bank announced new anti-fraud regulations requiring cryptocurrency transfers above $10,000 (approximately R$51,000) to be delayed by up to 24 hours for additional security analysis. The rules take effect January 1, 2027.
The United States Treasury Department sanctioned two Dubai-based cryptocurrency exchanges, Shelbit and Aban Tether, alleging they processed billions of dollars in transactions for Iran's Islamic Revolutionary Guard Corps and facilitated sanctions evasion. The action is part of the Trump administration's 'Economic Fury' campaign targeting Iranian financial networks.
The XRP Ledger Foundation and RippleX issued urgent security warnings on August 6-7, 2026, alerting users to phishing campaigns promoting fraudulent XRP airdrops and fake "XRP Rewards Scanner" tools designed to steal cryptocurrency from investors.
South Africa's draft Crypto Assets Manual proposes banning corporate cross-border stablecoin transactions and treating transfers to self-custody wallets as capital outflows, prompting warnings from industry leaders like VALR CEO Farzam Ehsani that the rules could drive crypto activity offshore and reduce regulatory oversight.
Following a firmware vulnerability in Coldcard hardware wallets that affected seed generation, attackers have begun laundering stolen cryptocurrency, with 64 BTC ($4.17M) and 200 ETH ($380K) routed through mixers. At least 15 separate attackers are exploiting the vulnerability, with the largest controlling 1,159 BTC that remains unmoved, in what's being called the biggest hardware wallet exploit in crypto history with losses exceeding $30 million.
Taiwan's Financial Supervisory Commission proposed draft amendments on August 4, 2026, requiring all domestic crypto platforms to share customer information on platform-to-platform transfers, with implementation scheduled for October 2026.
Federal prosecutors charged three Missouri men—Sedric Louis, John Davis, and Martel Williams—with conspiracy to commit Hobbs Act robbery over an alleged August 2024 plot to kidnap a Bitcoin holder and steal cryptocurrency through a planned home invasion in Connecticut. The defendants have pleaded not guilty and face up to 20 years in prison.
Physical attacks targeting cryptocurrency holders have resulted in more than $30 million in losses during the first half of 2026, with home invasions becoming the most common method and France accounting for a disproportionate share of incidents. The trend puts 2026 on track to become the worst year on record for violent crypto thefts.
South Korea's Ministry of the Interior and Safety announced plans to create a dedicated Virtual Asset Joint Investigation Division within the Seoul Serious Crime Investigation Agency (Jungdaebeomjoe Susacheong), set to launch October 2. The new agency will focus on seven major crime categories including corruption, economic crimes, defense procurement, narcotics, insurrection, cybercrime, and judicial obstruction.
Hackers illegally accessed Liechtenstein's Register of Beneficial Economic Owners during the night of July 29-30, 2026, stealing data on approximately 31,000 companies and foundations. The government has established a crisis cell to investigate the breach of the register, which was created in April 2021 to combat money laundering and financial crime.
Minnesota's law prohibiting virtual currency kiosks takes effect August 2, 2026, following reports that residents lost approximately $1 million to crypto ATM scams between 2023 and 2025, with senior citizens comprising the majority of victims.
Hong Kong experienced a surge of romance scams involving cryptocurrency, with 25 cases reported in a single week resulting in $9 million in losses. Criminals gained victims' trust through false promises of love and investment returns before draining their accounts.
A Reuters investigation revealed that Shelbit, an unlicensed Dubai-based cryptocurrency exchange, processed at least $4 billion for an Iranian sanctions-evasion network linked to the IRGC, Iran's central bank, and illegal gambling operations. At least $676 million from wallets connected to this network flowed to Binance.
Marcos Arturo Kleiman Tronllan, 40-year-old CEO of cross-border currency exchange MoneyFlip LLC, was arrested July 30 on federal charges for allegedly paying undercover agents $40,000 in cryptocurrency to kidnap and kill a businessman over an unpaid debt. Prosecutors allege he converted $750,000 into cryptocurrency before arranging the payments.
The IRS Criminal Investigation division issued a warning about fraudsters mailing official-looking letters directing crypto holders to a fake 'Digital Asset Compliance Portal' designed to steal digital assets and personal information.
The Blockchain Association countered claims by the National Sheriffs' Association that cryptocurrency legislation would hinder law enforcement, while the Major Cities Chiefs Association voiced support for the bill as lawmakers push for passage.
The US Treasury Department has imposed sanctions on two Iranian maritime companies allegedly part of an Islamic Revolutionary Guard Corps-backed insurance network, with one firm accepting Bitcoin and other digital assets as payment.
The European Union approved its 21st package of sanctions against Russia on July 23, 2026, imposing transaction bans on 14 cryptocurrency platforms and operators accused of helping Russia evade sanctions, including entities tied to the A7 Network. The package also targets 48 individuals and 170 organizations across energy, financial services, and shipping sectors.
India's cybercrime agency has ordered GitHub to take down Bitchat, a Bluetooth mesh messaging app created by Jack Dorsey that enables offline communication and bitcoin transactions, citing security concerns as protesters use it to bypass internet shutdowns during ongoing demonstrations in Delhi.
Binance, the world's largest cryptocurrency exchange by trading volume, announced a partnership with global non-profit STOP THE TRAFFIK on July 23, 2026, to detect and investigate cryptocurrency activity linked to human trafficking and child exploitation through intelligence sharing, training, and investigative support.
Bitcoin mining pool OCEAN has announced the launch of Portal, a new end-to-end encrypted dashboard that allows miners to monitor and manage their operations while maintaining privacy and data sovereignty without revealing their identity.
The U.S. Department of Justice has filed five civil forfeiture lawsuits seeking to seize more than $25 million in cryptocurrency recovered from investigations into international fraud schemes, including fake investment platforms and romance scams that targeted victims in the United States and Canada.
Blockchain intelligence firm TRM Labs reports that cryptocurrency exchange HTX has been systematically rotating its hot wallets and deposit addresses across four blockchains since UK authorities imposed sanctions on the platform in May 2026, making sanctions enforcement more difficult.
The U.S. Attorney's Office for the District of Columbia and U.S. Secret Service announced that investigations by the Cyber Fraud Task Force have resulted in the seizure of more than $25 million in cryptocurrency connected to international fraud operations.
Pakistan's Federal Investigation Agency (FIA) has set up a specialized cryptocurrency investigation unit within its National Command and Control Centre to investigate money laundering, terrorism financing, and other crimes involving digital assets. Officials said the unit will monitor suspicious crypto transactions and investigate crypto-linked cybercrime and financial fraud, while the FIA's counter-terrorism chief separately recommended that the cybercrime and anti-narcotics agencies establish similar units to address cybercrime and drug trafficking.
Blockchain firm Consensys disclosed that a North Korea-linked software developer gained access to its team and MetaMask wallet code before being identified and removed. The developer used a fake identity to infiltrate the company.
The United States Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned multiple cryptocurrency wallets tied to the Central Bank of Iran, freezing more than $130 million in digital assets. Treasury Secretary Scott Bessent announced the action as part of ongoing efforts to disrupt Iran's sanctions evasion activities.
An opinion article in China's Supreme People's Procuratorate newspaper outlined a framework for prosecuting crypto money laundering, including presuming criminal intent when mixers or privacy coins are used.
A four-month INTERPOL operation spanning 97 countries resulted in 5,811 arrests and the seizure of $293 million in illicit assets. Thai police arrested two suspects linked to a romance scam network, with one 20-year-old's cryptocurrency wallet processing over $122.5 million in suspicious transactions.
The Reserve Bank of India reasserted its call for a cryptocurrency policy 'leaning towards prohibition,' while the country's tax department warned that offshore trading and P2P transactions are difficult to track and enforce, according to internal government documents reviewed by Reuters.
India's Enforcement Directorate conducted raids on six Bengaluru-based crypto on-ramp/off-ramp firms, investigating alleged unauthorized cross-border money transfers totaling approximately ₹2,500 crore ($300 million).
Major U.S. banks are bracing for public scrutiny as a Trump administration banking regulator wraps up a review into whether financial institutions improperly closed customer accounts for political reasons, with results expected to name specific banks.
Bipartisan U.S. lawmakers, led by Representative Lance Gooden (R-TX), have introduced legislation to establish a cross-agency federal task force dedicated to investigating cryptocurrency fraud, hacking, and theft. The task force would be led by the attorney general and coordinate efforts across multiple law enforcement agencies.
The European Union has proposed its 21st package of sanctions against Russia over the war in Ukraine, targeting the country's banks, cryptocurrency networks, drone production, oil traders and refiners. The package includes 80 proposed listings aimed at Russia's military industrial complex, human rights violators and propagandists, adding to what the EU estimates is a $1.5 trillion cumulative economic hit on Russia.
Visa and stablecoin issuer Brale have launched a proof-of-concept testing SBC stablecoin settlement on the Canton Network's privacy-preserving blockchain. Separately, Visa, Mastercard, and Stripe are reportedly backing a new stablecoin platform that Coinbase is considering joining.
The U.S. Senate Banking Committee voted on May 14, 2026 to advance the Clarity Act, a comprehensive cryptocurrency regulation bill, marking the first major legislative progress for the crypto industry. The approval came despite minority staff releasing a national security advisory warning the bill fails to address vulnerabilities exploited by criminals and foreign adversaries.