Massive $4.5M Phishing Scam Unveiled

An unsuspecting cryptocurrency holder has fallen prey to a staggering $4.46 million phishing scam, with the funds initially withdrawn from a Kraken crypto exchange wallet and eventually landing in an address linked to a notorious phishing scammer.

Kraken Exchange Compromised

The incident began when $4.46 million worth of Tether (USDT) was withdrawn from a Kraken cryptocurrency exchange wallet, setting off a chain of transactions that ultimately led to an address identified by blockchain security firm PeckShield as belonging to a phishing scammer.

Fake Coinone Mining Exchange Connection

someone withdrew $4.46 million from Kraken to a fake Coinone crypto-mining exchange about 1 hour ago.https://t.co/ued55jlWdM pic.twitter.com/tsV5BGDY0O — Scam Sniffer (@realScamSniffer) September 20, 2023

Reports from blockchain scam monitoring platform Scam Sniffer indicated that the funds were sent to an address associated with a fictitious Coinone crypto mining exchange. This revelation sheds light on the sophistication of the phishing scheme.

Rising Phishing Scams in Crypto

Data shared by Scam Sniffer through a user-generated Dune Analytics dashboard highlighted the alarming trend of phishing scams. Scammers have managed to siphon approximately $337.1 million in USDT, affecting over 21,953 individuals.

Phishing Scam Victim Transfers Staggering $4.5M in USDT to Scammer

Tech giants have deployed emergency blocks against eight vulnerable digital certificates that could allow attackers to impersonate legitimate websites.

By Tuesday, browser developers and other major technology companies had deployed protections against eight intermediate certificates issued by India-based certificate authority eMudhra Limited after discovering that their private keys were insufficiently secure.

Mozilla cryptography engineer Dennis Jackson wrote in an incident report that Mozilla independently recovered the private keys when it first received notice of the flaw on Saturday, confirming that the key-generation process was “flawed” and “trivial to exploit.”

An attacker who intercepts a user’s connection could use fraudulent certificates to impersonate a legitimate website and potentially read or alter the information exchanged, according to Mozilla.

While many companies quickly blocked the affected certificates, the threat remains for applications and systems that don’t receive those blocks automatically.

In a blog post on Tuesday, Mozilla Firefox’s security team said it received the report on Saturday and responded by blocking the affected certificates in Firefox using OneCRL, which it completed the same day. It then released an update for its browser on Desktop and Android, protecting users with custom settings that prevented them from receiving the OneCRL update.

Cloudflare said it became aware of the report on Monday and released updates for its Cloudflare One and WARP Clients and Cloudflare Tunnel on Tuesday, alongside mitigations across its services.

Jackson said that the certificates have also been blocked in Chrome since Saturday, on Apple devices since Monday and on Microsoft platforms since Tuesday.

“The issue was responsibly disclosed to downstream trust stores on the 19th of October. Many have already released updates or are in the process of releasing updates,” he said.

Related: Hugging Face hack exposes the open-weight AI cybersecurity paradox

Jackson said there is no evidence that Firefox, Chrome, Edge and Safari have been attacked this way, as there were no entries in the certificate transparency logs for the intermediate certificates since April 2025.

“However, many clients outside of the browser ecosystem do not enforce Certificate Transparency. We do not know if attackers exploited the flawed key generation to target these clients,” he said.

The incident recalls a breach of DigiNotar in 2011, a major cyberattack where hackers compromised the Dutch certificate authority, issuing 531 fraudulent SSL certificates.

The rogue certificates allowed threat actors to pose as Google and spy on approximately 300,000 Iranian Gmail accounts.

Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time





Tech Giants Rush to Block Flawed eMudhra Certificates

French lawmakers narrowly approved a proposal to tax gains when investors swap cryptocurrency for stablecoins, bringing the transactions a step closer to falling under the country’s 31.4% capital gains levy.

The National Assembly adopted amendment I-3898 to the 2027 budget on Oct. 16 by 38 votes to 37, with 25 abstentions. The vote advances a proposal previously approved by its finance committee.

The proposed changes would apply to transactions from Jan. 1, 2027. They remain subject to the budget’s remaining parliamentary stages and could still be amended or removed before becoming law.

Exchanges between crypto without an additional cash payment generally benefit from tax deferral under current French tax rules. Taxable gains on private investments face a default rate of 31.4%, although investors can opt for the progressive income-tax scale.

The amendment would remove that deferral when investors receive e-money tokens as defined by the European Union’s Markets in Crypto-Assets (MiCA) framework.

Investors could therefore owe tax on gains when moving into qualifying stablecoins, even without withdrawing the funds in fiat currency to a bank account.

France's parliament approves vote to hit crypto-to-stablecoin trades with 31% levy

Microsoft MSFT $531.71·Market Closed, Alphabet (GOOG, GOOGL) and Goldman Sachs (GS) have objected to having tokenized versions of their shares traded on OKXICE, adding to issuer resistance against the planned stock-trading venue from crypto exchange OKX and New York Stock Exchange parent Intercontinental Exchange (ICE).

The companies appear among seven additional objecting issuers in the joint venture’s updated public notice dated Oct. 19. Qualcomm (QCOM), Caterpillar (CAT), McDonald’s (MCD) and Western Digital (WDC) also joined the list.

The additions bring the disclosed tally to 16 companies, up from nine in last week’s notice. The document does not explain their reasons or specify when they submitted their objections.

Read more: SEC tokenized stock framework faces issuer pushback as Broadcom, Verizon object to OKX-ICE listing

The growing list highlights a hurdle for the SEC’s new framework for tokenized stock trading, which was unveiled last month.

OKXICE’s original notice identified 63 tickers representing 62 companies, with Alphabet appearing through both share classes. Fifteen of those companies have now objected, leaving 47 without a disclosed objection. Cerebras Systems (CBRS), the other objecting issuer, was outside the original proposed trading roster.

Microsoft (MSFT), Alphabet (GOOG), Goldman Sachs (GS) join objections to OKX-ICE tokenized stock trading

Kazakhstan’s financial regulator secured court orders restricting Coinbase and five other crypto platforms from offering services without authorization in the Astana International Financial Centre (AIFC).

The Astana Financial Services Authority (AFSA) said that the injunctions cover BingX, Bitcoin.com, Huobi Global (HTX), BitMart, Coinbase and WEEX. The orders prohibit the platforms from offering or marketing unlicensed digital asset services and distributing mobile apps for those services within the center.

The restrictions do not amount to a nationwide ban. In a Sept. 15 judgment, Justice Sir Stephen Richards said the injunctions apply only to the AIFC and users located there.

The Astana International Financial Centre is a financial hub in Kazakhstan’s capital that operates under its own legal framework and regulator. It requires crypto firms to obtain a license to offer services within the center.

The order also binds Google and Apple as app-store operators, though the court declined to issue a separate injunction against them, saying AFSA should first discuss necessary steps with the firms.

LBank was named in the initial proceedings, and was removed on Sept. 18 after addressing AFSA’s concerns. The regulator said the platform blocked access to its services in Kazakhstan.

Kazakhstan court bars Coinbase, five others from unlicensed crypto services in AIFC

While bitcoin BTC $82,703.67 lost more than half its value in the past year's selloff, investors in one Calamos Investments’ fund were spared much of the pain.

The Naperville, Illinois-based firm's Bitcoin Structured Alt Protection ETF – October (CBOO) dropped just 1% since the start of its one-year protection period in October 2025, according to a Calamos spokesperson. The largest cryptocurrency, in contrast, tumbled as much as 52% from its record high of roughly $126,000.

Now BlackRock (BLK), the world's largest asset manager, wants to offer investors a similar way to protect themselves from bitcoin's price swings.

On Monday, the firm filed to introduce the iShares Bitcoin Managed Protect ETF, which would give investors exposure to bitcoin's gains while seeking to limit losses when the cryptocurrency falls.

"The Fund seeks to provide upside exposure to the iShares Bitcoin Trust ETF and/or similar bitcoin exposure up to an approximate limit, while seeking to provide a level of downside protection," BlackRock said in the filing.

The proposed fund would build on BlackRock's flagship iShares Bitcoin Trust (IBIT), which manages more than $65 billion in assets and is the largest of the U.S. spot bitcoin ETFs introduced in 2024.

BlackRock seeks to shield bitcoin (BTC) investors from losses after Calamos fund weathers 50% crash

A growing list of companies rejecting tokenized trading of their shares is an expected part of testing a new market structure, Andrew Cuomo, co-chairman of the OKX-ICE joint venture, said after Microsoft, Alphabet and Goldman Sachs joined the objectors.

“This is a very natural response,” Cuomo, an OKX board member and former New York governor, said during a press call on Tuesday. “The model was designed to give companies the right to determine whether they want to opt in or opt out.”

“We always anticipated that, because this is such a dramatic and revolutionary change, many companies would want to wait and see how it goes rather than be the first to participate,” he added.

His remarks followed a Monday public notice showing 16 companies had objected to having tokenized versions of their shares traded on OKXICE, the planned venue from crypto exchange OKX and New York Stock Exchange parent Intercontinental Exchange (ICE).

Seven newly disclosed objectors — Microsoft, Alphabet, Goldman Sachs, Qualcomm, Caterpillar, McDonald’s and Western Digital — joined companies including Broadcom, Verizon and UnitedHealth.

OKX-ICE’s Cuomo calls issuer objections a ‘natural response’ to tokenized stock plans

The potential effects of artificial intelligence in the derivatives markets will be in focus at the U.S. Commodity Futures Trading Commission's first in a new series of meetings hosted by its Innovation Task Force on October 28.

Using President Donald Trump's favored "super intelligence" descriptor, the agenda released on Tuesday marks the opening outing of what the regulator is calling its "Frontier Forum" series. It begins with a look at how derivatives markets may respond to the influx of machine intelligence and how the technology may impact price discovery and risk management.

"Super intelligence is poised to transform our financial markets,” said CFTC Chairman Mike Selig in a statement.

The task force said the event will hear from leaders in the space, including the heads of firms such as Ornn, Architect and Liquid Compute.

The event will also explore how traders' own AI agents may operate under CFTC regulations.





U.S. CFTC sets agenda for AI forum, exploring trading and agentic finance

Elon Musk said he likes the idea of merging Tesla with SpaceX in a potential move that would create a roughly $3.5 trillion technology giant combining AI, space exploration and electric vehicle manufacturing.

“Do I think it would be a good idea? Yes,” Musk said of the potential merger during a SpaceX Q3 earnings call on Tuesday.

Musk said that both SpaceX and Tesla have formed special committees of independent directors to discuss the idea at the request of shareholders, though he isn’t able to take part in the discussions due to being a conflicted party.

A merger would bring Tesla into the same corporate group as Grok developer SpaceXAI (formerly xAI) and social media platform X, which SpaceX acquired in February. The talks also come as SpaceX’s AI business became its largest revenue segment in Q3, underscoring how central artificial intelligence has become to Musk’s expanding technology empire.

“There’s a lot to be gained from cooperating on developing superintelligence software, chip design, the Terafab, obviously, robotics, mass to orbit with the Starmind constellation. Connectivity,” said Musk.

However, Musk tempered expectations of whether a merger will ultimately come through.

“Some people out there assume that a SpaceX and Tesla merger is a certainty, and I think that would be overstating it,” he said, adding that the special committees have not reached agreement on terms of any transaction and there is no guarantee that they will.

“At the end of the day, the shareholders have to be supportive of this and particularly on Tesla’s side we’ll need a 50% vote of all shares, not just those who vote, but of all shareholders. And that’s quite a high hurdle to try to achieve.”

SpaceX Q3 earnings show huge AI revenue gains

Musk’s comments followed SpaceX’s third-quarter earnings report, which showed revenue rising 161% year over year to $14.6 billion, driven largely by its “Super Intelligence” AI segment.

SpaceX’s Super Intelligence segment generated $7.6 billion in third-quarter revenue, an 830% increase from a year earlier, making it the company’s largest revenue contributor.

Related: Crypto Biz: SpaceX fuels tokenization’s next boom

SpaceX said the growth was driven by the activation of new cloud services agreements, the acquisition of Cursor and increased adoption of its agentic AI model Grok across enterprise and consumers.

Combined Bitcoin holdings would exceed 30,000 BTC

A Tesla–SpaceX merger could also bring two sizable corporate Bitcoin treasuries under one roof. SpaceX reported holding 18,712 Bitcoin as of June 30, while Tesla held 11,509 BTC on the same date, according to their respective quarterly filings.

Based on those disclosures, a combined company would hold 30,221 BTC, which would make it the sixth-largest public Bitcoin treasury company, beating crypto exchange Bullish.

Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

Musk Backs Tesla–SpaceX Merger Idea as AI Revenue Soars

Key Takeaways A wallet holding 225 million XRP sent 82.3 million to a newly created address at 00:30 UTC on Oct. 20.

Its 298 million XRP arrived between Nov. 2025 and Feb. 2026, when XRP mostly traded near $2.

With XRP at $1.30, the whale’s 225 million XRP sits about 37% below its average arrival value.

Following the Wallet

Whale Alert first flagged the move as a transfer between two unknown wallets; however, the XRP Ledger’s public history tells a longer story. The sending wallet’s trail, built from its onchain account record, is as follows:

Nov. 14, 2025: The wallet is activated by a funding address that also supplies all of its large deposits.

The wallet is activated by a funding address that also supplies all of its large deposits. Nov. 24, 2025: 73,179,840 XRP arrives, with XRP near $2.05.

73,179,840 XRP arrives, with XRP near $2.05. Dec. 4, 2025: 59.6 million XRP lands at about $2.20.

59.6 million XRP lands at about $2.20. Dec. 12, 2025: 73.9 million XRP at about $2.03.

73.9 million XRP at about $2.03. Jan. 12, 2026: 73 million XRP at about $2.08.

73 million XRP at about $2.08. Jan. 31 and Feb. 5, 2026: two smaller tranches of 9.27 million and 9.31 million XRP, as the price slid to $1.74 and then $1.52.

two smaller tranches of 9.27 million and 9.31 million XRP, as the price slid to $1.74 and then $1.52. May 20, 2026: 73,179,900 XRP goes back out to the funding address, almost exactly the size of the first deposit.

73,179,900 XRP goes back out to the funding address, almost exactly the size of the first deposit. Oct. 20, 2026: 82,314,668.8 XRP leaves for a fresh wallet that the same transaction created.

The last number (82,314,668.8046 XRP) is exactly the Jan. 12 deposit of 73 million plus the Feb. 5 deposit of 9,314,668.8046. Like the May withdrawal, this looks like specific lots being peeled off.

The Math at Today’s $1.30 Price

Using daily prices on each deposit date, the 298.3 million XRP that flowed in was worth about $613 million on arrival, an average of roughly $2.06 per token. Today XRP is trading at about $1.30.

Remaining across both wallets: About 225.1 million XRP, worth roughly $293 million now versus about $463 million at its arrival value.

About 225.1 million XRP, worth roughly $293 million now versus about $463 million at its arrival value. Paper drawdown: About 37%.

About 37%. Context: XRP’s 2026 range runs from a $2.35 high on Jan. 6 to a $0.99 low on Aug. 17, so this holder has sat through nearly all of it without selling onchain.

Those are arrival values, not proven purchase prices, since the coins came from another wallet rather than an exchange trade.

What to Watch

So far, traders aren’t treating it as a sell signal, especially since XRP started the week up 3% with 24-hour volume up 32% to $1.76 billion, and has since held around $1.30 (all while bitcoin’s price action has stalled near $82,000).

The key signal from here on out is whether the new wallet sends anything to an exchange deposit address. If those 82.3 million XRP stay put, it was most likely a custody shuffle. If they move to an exchange, the remaining 142.8 million XRP in the original wallet becomes the next thing to watch.

XRP Whale That Stacked Above $2 Just Moved 82 Million Tokens

Key Takeaways Ngrave traced approximately $2.56 million stolen from 70 wallet addresses across four blockchain networks.

Ngrave said its ZERO hardware remained secure while phishing victims surrendered wallet recovery credentials.

Ngrave’s CEO admitted the company had “absolutely and utterly failed” its fundamental security obligation.

A Fake Security Alert With a $2.56 Million Price Tag

Belgian hardware-wallet maker Ngrave, commonly known as NGRAVE, disclosed on Oct. 19 that attackers hijacked a third-party notification provider serving its LIQUID companion app. The breach allowed criminals to send authentic-looking security warnings directly to customers on Oct. 17. The message claimed a user’s portfolio had been synchronized with a Pixel 9 device in Moscow. Clicking the alert opened a counterfeit Ngrave website featuring a countdown timer and an ominous choice to approve or deny the suspicious activity.

Both paths led to the same trap. Users were prompted to enter their 24-word recovery phrase or Perfect Key, handing attackers everything needed to recreate their wallets. Automated scripts emptied compromised accounts within minutes. Ngrave’s investigation traced approximately $2.56 million stolen from 70 wallet addresses across four networks. Bitcoin accounted for $1.77 million, followed by $454,000 in XRP, $316,000 in Ethereum-based assets and $18,000 in Stellar.

Attackers Exploited Notification Keys, Not Hardware

The company’s incident report reveals that unauthorized access potentially began Oct. 11, six days before the fraudulent notifications appeared. Attackers obtained one access key and leveraged it to acquire another with broader permissions, including access to certain analytics information. Ngrave detected the malicious alerts within a minute of their appearance at 9:30 p.m. UTC on Oct. 17. Nevertheless, the first wallet was drained six minutes later.

The company disabled its notification system by 10:45 p.m., but thefts continued from previously compromised wallets until 3:51 a.m. the following morning. Crucially, Ngrave maintains its ZERO hardware wallets and private keys remained untouched. The criminals instead manipulated customers into surrendering their own credentials.

Ngrave CEO Admits Company ‘Absolutely and Utterly Failed’

The stolen funds traveled through exchanges, blockchain bridges, and fresh addresses. Ngrave traced bitcoin into 12 addresses, while XRP moved through 54 transfers. The company also acknowledged potential exposure of device information, wallet activity, IP addresses, and approximate locations, raising concerns about subsequent targeted scams.

The analytics firm Bitquery also published a report on the matter, noting that, in terms of the stolen funds, “most of it now sits on Hyperliquid as a Monero token.” The Bitquery report estimates around 81% found its way to the popular perps DEX exchange. In the incident report, Ngrave’s senior executive spoke on the matter.

Its CEO offered an unusually candid assessment, stating:

“In my humble opinion, the first duty of a crypto security company is to provide exactly that: security. In this, we have absolutely and utterly failed.”

He acknowledged that the company’s security posture was inadequate when he assumed leadership months earlier. Ngrave has since replaced compromised keys and outlined tighter notification controls, including two-person approvals, restricted domains and emergency shutdown capabilities.

Affected customers are being urged to establish fresh wallets and contact support. The investigation continues, leaving a troubling distinction intact: the hardware held firm, but the trusted messages surrounding it became the weapon.

It’s been a tough year for hardware wallet makers as 2026 has been riddled with security issues. Nearly a dozen documented hardware-wallet security incidents involving Ledger, Trezor, Tangem, Safepal, Bitbox02, and Coldcard. Reported losses exceeded $180 million across two incidents, exposing vulnerabilities in firmware, third-party vendors, physical security, and phishing, rather than direct remote attacks on recovery phrases.

Crypto Thieves Hijack Ngrave Alerts and Walk Away With $2.56M

Layer-1 blockchain Qubic has restarted its network and launched a recovery process after a wallet seed vulnerability allowed an attacker to drain roughly $1.4 million in QU tokens from 1,404 accounts, according to the project’s latest update.

Qubic’s blockchain explorer shows the network resumed processing ticks 8:00 pm on Oct. 19, advancing beyond tick 85,371,949, where it was halted on Sunday.

Qubic said its network validators, known as Computors, had approved a recovery plan and that the project had launched a claims platform for affected wallet holders.

Affected users can check their address and submit a claim through Qubic’s reclaim platform. Affected users have until May 1, 2027, to submit claims, according to Qubic.

The network was halted Sunday to prevent further movement of stolen funds after attackers exploited predictable wallet seeds generated by vulnerable wallet software.

The vulnerability affected wallet seeds generated using Qubic’s web wallet on certain Apple devices and browsers, where an insecure random-number generator could produce predictable seeds. Qubic on Sunday said it had fixed the seed-generation flaw in the latest version of its web wallet.

“If you created your wallet with the Qubic web wallet before version 4.26.4 (released 19 October), treat it as insecure, even if your funds were never touched,” said Qubic on Tuesday.

“Update to web wallet 4.26.4 or later, then create a new wallet,” said the team. “Move your funds to the new wallet as soon as you can, and never use the old one again.”

Related: Qubic freezes chain after attacker drains 1.4K wallets with weak seeds

Qubic Restarts Blockchain After $1.4M Wallet Hack

Utah Attorney General Derek Brown announced a lawsuit against Kalshi, its affiliates and two Susquehanna trading companies, alleging that the prediction markets platform had been facilitating illegal betting in the US state since 2024.

In a Tuesday press briefing, Brown said Utah officials had petitioned a court to compel the companies to return about $30 million to $60 million in profits they made through allegedly illegal event contracts. The Utah attorney general alleged that Kalshi illegally offered its services to more than 32,000 users in the state, resulting in significant losses.

“Under Utah law, I have determined that this operation is causing a significant and substantial ongoing harm to a significant number of Utahns,” said Brown. “And so today, we are asking the court to stop sports, elections, politics, culture and mention bets here in Utah.”

Kalshi sued Utah in February after lawmakers passed a bill on betting on prediction markets as gambling under state law. In August, a judge ruled in favor of Utah officials, saying federal laws under the US Commodity Futures Trading Commission (CFTC) do not preempt state gambling laws. An appellate court also denied Kalshi’s request for an injunction in September, blocking the platform from operating during its appeal.

Cointelegraph reached out to Kalshi for comment on the lawsuit but did not receive an immediate response.

Related: NFL backs New Jersey authorities in SCOTUS petition over Kalshi

Ongoing legal battles across the US

The civil lawsuit is one of many filed by US state authorities against prediction market platforms like Kalshi and Polymarket over alleged violations of state gambling laws, many involving sports betting. Officials in Arizona remain the only ones in the US pursuing criminal charges against Kalshi, but other states, including Michigan, Ohio, Kentucky, Nevada, Massachusetts, Wisconsin and New York, have filed civil suits against one or more prediction market companies.

The Utah lawsuit comes as the US Supreme Court considers whether to accept a petition to weigh in on New Jersey’s own case against Kalshi over allegedly illegal sports bets. The case, if accepted by the high court, could potentially resolve whether the purview of prediction market companies falls under state authorities or the CFTC, which claims “exclusive jurisdiction” over the platforms’ event contracts.

Magazine: Agents can trade 24/7 — but Yat Siu warns you could lose access at any time

Phishing Scam Victim Transfers Staggering $4.5M in USDT to Scammer

Related Post

Follow Us: