⚡️ UPDATE: Galaxy Research puts losses from the Coldcard wallet incident at roughly $70M.

Analysts traced 1,196 addresses drained of 1,082.65 BTC inside a single 41-minute window — a far wider scope than earlier estimates suggested.

• 1,196 affected addresses
• 1,082.65 BTC moved
• Drain completed in 41 minutes

The tight timeframe points to an automated sweep rather than isolated user error. Coldcard holders are being urged to verify balances and migrate funds to freshly generated seeds.

@fraudwatcher

⚡️ UPDATE: A cold-wallet compromise has spread to roughly 4,500 Bitcoin addresses, with losses approaching $89 million.

Victims held funds in offline storage, long considered the safest option — suggesting keys or seed phrases were exposed at generation rather than by a live network breach.

• ~4,500 affected BTC addresses
• ~$89M in stolen funds so far
• Attack still expanding as new addresses are drained

Holders using wallets created from untrusted software or pre-generated seed phrases are urged to move funds to freshly generated keys.

@fraudwatcher

⚠️ JUST IN: Spider-Man: Brand New Day was pirated on X, with a high-quality bootleg reaching 5.9 million accounts before takedown.Posted by an account named "Fredrick Bryan" at 6:05 a.m. PT, the leaked video drew over 143,000 likes and 10,000 reshares before being pulled around 3:25 p.m. PT.

Copies from several other X accounts followed, though most were removed quickly. It comes a week after a high-quality bootleg of The Odyssey leaked on the same platform.

• Leaked Friday morning, a day after the film hit theaters
• Opening day still projected at $167M–$173M, topping *Avengers: Endgame*'s $157.4M
• Sony has not commented

@fraudwatcher

⚠️ JUST IN: @Mist, a former staff member on OGUser, has been banned after failing to resolve a deal dispute.

The ban was issued by default following an open Deal Dispute thread filed against him on-site.

He may still settle up and appeal, but he's said to be leaving the com — leaving the outcome uncertain and raising questions about his disregard for the process.

@fraudwatcher

⚠️ JUST IN: A takedown win against 764, the violent online extortion network, tied to the handle @bebo3.

764 is a global cluster of predators known for coercing minors into self-harm, sexual abuse content, and livestreamed violence, and has drawn FBI and Europol attention as a top child-exploitation threat.

Members typically hunt targets on mainstream platforms — Discord, Telegram, gaming chats — then blackmail victims with the material they extract.

Further details on the case and any charges are pending.

@fraudwatcher

⚡️ UPDATE: A random number generator flaw in COLDCARD hardware wallets is likely behind an $88 million Bitcoin theft.

Researchers say weak entropy during seed generation made private keys predictable, letting attackers reconstruct wallets and drain funds without ever touching the device.

Affected users are urged to check firmware versions and migrate funds to freshly generated seeds on patched hardware.

@fraudwatcher

⚠️ EXPLOIT: Over 100,000 UK police officers and staff have had personal data leaked on the dark web after a hack on the national police legal database.

Exposed records include full names, contact details and force locations, according to the breach.

Staff from the MoD, Home Office, NCA and CPS are also caught up in the leak. One officer said it "puts officers at serious risk."

@fraudwatcher

⚠️ JUST IN: @polymarket sold for 354,900 $GRAM, topping the week's Telegram username auctions.

The Fragment leaderboard shows a steep drop after the top slot, with @cole at 66,666 $GRAM and @monkey at 26,686 $GRAM rounding out the podium.

• @wingram — 20,000 $GRAM
• @pornhubbot — 18,090 $GRAM (and again at 14,000)
• @friend — 17,777 $GRAM

@fraudwatcher

⚡️ UPDATE: Losses tied to compromised Coldcard hardware wallets may now approach $114 million after researchers flagged a possible fourth large sweep.

The thefts involve funds drained from wallets whose seed phrases were apparently predictable or exposed, allowing attackers to empty balances that had sat untouched for long stretches.

• Three earlier sweeps already accounted for the bulk of the stolen crypto
• A newly spotted transaction chain suggests a fourth victim wallet

On-chain investigators are still tracing the flow, and it remains unclear whether the losses stem from a supply-chain issue, counterfeit devices, or user-side seed generation failures.

@fraudwatcher

⚠️ EXPLOIT: Six men convicted over a 52-hour kidnapping and torture of two French crypto holders in London.

Attackers demanded $150,000 and forced the victims to transfer cryptocurrency during the ordeal.

Police say the operation was directed remotely by an overseas mastermind coordinating the crew over WhatsApp.

The case adds to a growing wave of "wrench attacks" — physical violence used to extract private keys and wallet access from crypto holders.

@fraudwatcher

⚠️ JUST IN: Telegram has reportedly been pulled from the Apple App Store, blocking new iOS downloads.

No reason has been disclosed, and it's unclear whether the removal is temporary or tied to an ongoing App Store review.

Existing users appear unaffected for now. Further details are expected as the situation develops.

@fraudwatcher

⚡️ UPDATE: Apple Support says Telegram has not been officially pulled from the App Store.

A representative contacted by @Telelakel said the app remains listed in Apple's internal systems and carries no removal flag.

That points to Telegram being temporarily hidden by the developer rather than taken down by Apple — though no official statement has confirmed the cause yet.

@fraudwatcher

⚡️ UPDATE: Telegram is back on the App Store after its brief removal.

The messaging app had disappeared from Apple's storefront, sparking speculation about a policy dispute or moderation issue.

No official explanation has been given yet by either Apple or Telegram.

@fraudwatcher

⚠️ JUST IN: A former FBI supervisory special agent pleaded guilty to stealing roughly $1 million in crypto seized from an adversarial nation.

The ex-agent diverted the digital assets while in a position of trust, prosecutors said, and has now forfeited about $925,000 into government-controlled wallets.

• Amount stolen: ~$1M in digital assets
• Forfeited: ~$925,000
• Status: guilty plea entered, sentencing to follow

@fraudwatcher

⚠️ JUST IN: German prosecutors charged a 31-year-old man accused of founding and running Archetyp Market, once the world's largest darknet drug marketplace.

Authorities say the platform moved roughly €330 million in illegal drugs before it was taken down.

• ~2.3 million orders processed between November 2022 and the June 2025 takedown
• Accused of founding and administering the site as lead operator
• Case built on international law enforcement action against the marketplace's infrastructure

Prosecutors are pursuing charges tied to large-scale narcotics trafficking; further arrests of vendors and staff remain possible.

@fraudwatcher

⚠️ JUST IN: Russian-language cybercrime forum Ramp4u has allegedly been breached, with its internal data dumped publicly.

The leak reportedly includes 340,000 IP logs tied to forum activity, plus private messages between members — the kind of data that can deanonymize buyers, sellers and admins.

Forum breaches like this are a recurring intelligence windfall for researchers and law enforcement, who use IP-to-account mapping to link handles to real identities. Members are likely already burning accounts and infrastructure.

@fraudwatcher

⚡️ UPDATE: Pavel Durov says the CSAM post that got Telegram pulled from Apple's App Store was planted by a "takedown extortionist."

He describes crews that seed illegal content into public groups, then report it to Apple to punish owners who refuse to pay.

Durov claims Apple removed the app — used by roughly 1 billion monthly users — without contacting Telegram first.

@fraudwatcher

⚠️ JUST IN: A man received 2 years in prison for selling his Telegram accounts to fraudsters.

The buyers used the accounts to advertise non-existent livestock, collected payments from victims, then vanished.

Because the accounts were registered in his name, liability fell back on the original owner — not the scammers who ran the scheme.

@fraudwatcher