⚠️ JUST IN: Coinkite is telling Coldcard Mk3 owners to move their funds after flagging a potential seed-generation flaw.

The hardware wallet maker says the issue could weaken key randomness on the legacy Mk3 model, and is advising migration to newer devices rather than waiting for a fix.

Separately, Bitcoin security researchers are picking apart an unexplained $38 million wallet drain. No confirmed link between the two has been established.

@fraudwatcher

⚠️ EXPLOIT: A threat actor claims to have leaked an internal IDF C4I Corps personnel database, with references to Unit 8200.

The posted archive allegedly contains personnel profiles, deployment records and unit assignments — data that, if genuine, would expose serving members of Israel's signals intelligence and communications branches.

The claim is unverified, and no confirmation has come from Israeli authorities. Leaks tied to IDF units are frequently recycled or fabricated for reputational effect, so the sample's authenticity remains the key open question.

@fraudwatcher

⚠️ JUST IN: A threat actor claims to have breached SEKISUI Aerospace Corporation, a Tier-1 supplier to Boeing and U.S. defense programs.

The actor says it holds roughly 70 GB of data allegedly taken from the manufacturer's systems, which support commercial aviation and military production lines.

• Alleged haul: ~70 GB of internal data
• Sector: aerospace manufacturing, defense supply chain
• Status: claim unverified, no confirmation from SEKISUI

Breaches at Tier-1 suppliers are prized by attackers for engineering drawings, contracts and program data tied to primes further up the chain.

@fraudwatcher

⚠️ EXPLOIT: A Rust player was left paralyzed after a swatting call — and is now suing for $176 million.

A scammer he met on a Rust server tricked him into downloading malware, seized his accounts, then extorted him with threats to call in a SWAT team.

The gamer warned police in advance. A dispatcher told him "nothing will happen."

Two days later the scammer followed through, and the raid left the victim paralyzed. The lawsuit targets the response that he says he tried to prevent.

@fraudwatcher

⚠️ JUST IN: The US has sanctioned a Dubai-based crypto exchange accused of anchoring a $4 billion Iranian sanctions-evasion network.

The platform allegedly moved funds for front companies tied to Iran's oil sales, converting proceeds into crypto to sidestep the banking system and dollar controls.

Designation freezes any US-linked assets and bars American persons from dealing with the exchange — exposing counterparties and correspondent partners to secondary sanctions risk.

@fraudwatcher

$300 GIVEAWAY
Requirements: Be in @FraudWatcher
Click the button below to join.

⚠️ Welcome to @FraudWatcher

💭Tracking & notifying you with the latest news on com, cybersecurity, fraud & other online threats.

❗️From major data breaches and ransomware attacks to phishing campaigns, crypto scams, arrests, and upcoming threat actors.

stay informed → @fraudwatcher

⚠️ JUST IN: The FBI's 60-day crackdown on "The Com" is winding down with just 3 arrests.

The named suspects span SIM swapping and Scattered Spider-linked activity — a thin haul for an operation billed as a sweep of the sprawling English-speaking cybercrime network.

Arrested so far:
• Merry — SIM swapper
• Peter Stokes — Scattered Spider
• Brandon Hiser

Whether the Bureau extends the push or announces further charges as sealed cases unseal remains unclear.

@fraudwatcher

⚠️ JUST IN: ShinyHunters says it's back, posting a return announcement on an underground forum.

The group shared new Telegram and X accounts it claims will act as official channels, plus a fresh PGP key for future communications and verification.

No new victims or data leaks accompanied the announcement.

@fraudwatcher

⚠️ JUST IN: MoneyFlip's CEO has been arrested in an alleged murder-for-hire plot.

He allegedly paid undercover federal agents $40,000 — including 25,000 USDT — to carry out the killing.

Prosecutors also say he laundered $750,000 in suspected drug proceeds through his own crypto exchange.

@fraudwatcher

⚡️ UPDATE: Galaxy Research puts losses from the Coldcard wallet incident at roughly $70M.

Analysts traced 1,196 addresses drained of 1,082.65 BTC inside a single 41-minute window — a far wider scope than earlier estimates suggested.

• 1,196 affected addresses
• 1,082.65 BTC moved
• Drain completed in 41 minutes

The tight timeframe points to an automated sweep rather than isolated user error. Coldcard holders are being urged to verify balances and migrate funds to freshly generated seeds.

@fraudwatcher

⚡️ UPDATE: A cold-wallet compromise has spread to roughly 4,500 Bitcoin addresses, with losses approaching $89 million.

Victims held funds in offline storage, long considered the safest option — suggesting keys or seed phrases were exposed at generation rather than by a live network breach.

• ~4,500 affected BTC addresses
• ~$89M in stolen funds so far
• Attack still expanding as new addresses are drained

Holders using wallets created from untrusted software or pre-generated seed phrases are urged to move funds to freshly generated keys.

@fraudwatcher

⚠️ JUST IN: Spider-Man: Brand New Day was pirated on X, with a high-quality bootleg reaching 5.9 million accounts before takedown.Posted by an account named "Fredrick Bryan" at 6:05 a.m. PT, the leaked video drew over 143,000 likes and 10,000 reshares before being pulled around 3:25 p.m. PT.

Copies from several other X accounts followed, though most were removed quickly. It comes a week after a high-quality bootleg of The Odyssey leaked on the same platform.

• Leaked Friday morning, a day after the film hit theaters
• Opening day still projected at $167M–$173M, topping *Avengers: Endgame*'s $157.4M
• Sony has not commented

@fraudwatcher

⚠️ JUST IN: @Mist, a former staff member on OGUser, has been banned after failing to resolve a deal dispute.

The ban was issued by default following an open Deal Dispute thread filed against him on-site.

He may still settle up and appeal, but he's said to be leaving the com — leaving the outcome uncertain and raising questions about his disregard for the process.

@fraudwatcher

⚠️ JUST IN: A takedown win against 764, the violent online extortion network, tied to the handle @bebo3.

764 is a global cluster of predators known for coercing minors into self-harm, sexual abuse content, and livestreamed violence, and has drawn FBI and Europol attention as a top child-exploitation threat.

Members typically hunt targets on mainstream platforms — Discord, Telegram, gaming chats — then blackmail victims with the material they extract.

Further details on the case and any charges are pending.

@fraudwatcher

⚡️ UPDATE: A random number generator flaw in COLDCARD hardware wallets is likely behind an $88 million Bitcoin theft.

Researchers say weak entropy during seed generation made private keys predictable, letting attackers reconstruct wallets and drain funds without ever touching the device.

Affected users are urged to check firmware versions and migrate funds to freshly generated seeds on patched hardware.

@fraudwatcher

⚠️ EXPLOIT: Over 100,000 UK police officers and staff have had personal data leaked on the dark web after a hack on the national police legal database.

Exposed records include full names, contact details and force locations, according to the breach.

Staff from the MoD, Home Office, NCA and CPS are also caught up in the leak. One officer said it "puts officers at serious risk."

@fraudwatcher

⚠️ JUST IN: @polymarket sold for 354,900 $GRAM, topping the week's Telegram username auctions.

The Fragment leaderboard shows a steep drop after the top slot, with @cole at 66,666 $GRAM and @monkey at 26,686 $GRAM rounding out the podium.

• @wingram — 20,000 $GRAM
• @pornhubbot — 18,090 $GRAM (and again at 14,000)
• @friend — 17,777 $GRAM

@fraudwatcher

⚡️ UPDATE: Losses tied to compromised Coldcard hardware wallets may now approach $114 million after researchers flagged a possible fourth large sweep.

The thefts involve funds drained from wallets whose seed phrases were apparently predictable or exposed, allowing attackers to empty balances that had sat untouched for long stretches.

• Three earlier sweeps already accounted for the bulk of the stolen crypto
• A newly spotted transaction chain suggests a fourth victim wallet

On-chain investigators are still tracing the flow, and it remains unclear whether the losses stem from a supply-chain issue, counterfeit devices, or user-side seed generation failures.

@fraudwatcher

⚠️ EXPLOIT: Six men convicted over a 52-hour kidnapping and torture of two French crypto holders in London.

Attackers demanded $150,000 and forced the victims to transfer cryptocurrency during the ordeal.

Police say the operation was directed remotely by an overseas mastermind coordinating the crew over WhatsApp.

The case adds to a growing wave of "wrench attacks" — physical violence used to extract private keys and wallet access from crypto holders.

@fraudwatcher