⚡️ UPDATE: Apple Support says Telegram has not been officially pulled from the App Store.

A representative contacted by @Telelakel said the app remains listed in Apple's internal systems and carries no removal flag.

That points to Telegram being temporarily hidden by the developer rather than taken down by Apple — though no official statement has confirmed the cause yet.

@fraudwatcher

⚡️ UPDATE: Telegram is back on the App Store after its brief removal.

The messaging app had disappeared from Apple's storefront, sparking speculation about a policy dispute or moderation issue.

No official explanation has been given yet by either Apple or Telegram.

@fraudwatcher

⚠️ JUST IN: A former FBI supervisory special agent pleaded guilty to stealing roughly $1 million in crypto seized from an adversarial nation.

The ex-agent diverted the digital assets while in a position of trust, prosecutors said, and has now forfeited about $925,000 into government-controlled wallets.

• Amount stolen: ~$1M in digital assets
• Forfeited: ~$925,000
• Status: guilty plea entered, sentencing to follow

@fraudwatcher

⚠️ JUST IN: German prosecutors charged a 31-year-old man accused of founding and running Archetyp Market, once the world's largest darknet drug marketplace.

Authorities say the platform moved roughly €330 million in illegal drugs before it was taken down.

• ~2.3 million orders processed between November 2022 and the June 2025 takedown
• Accused of founding and administering the site as lead operator
• Case built on international law enforcement action against the marketplace's infrastructure

Prosecutors are pursuing charges tied to large-scale narcotics trafficking; further arrests of vendors and staff remain possible.

@fraudwatcher

⚠️ JUST IN: Russian-language cybercrime forum Ramp4u has allegedly been breached, with its internal data dumped publicly.

The leak reportedly includes 340,000 IP logs tied to forum activity, plus private messages between members — the kind of data that can deanonymize buyers, sellers and admins.

Forum breaches like this are a recurring intelligence windfall for researchers and law enforcement, who use IP-to-account mapping to link handles to real identities. Members are likely already burning accounts and infrastructure.

@fraudwatcher

⚡️ UPDATE: Pavel Durov says the CSAM post that got Telegram pulled from Apple's App Store was planted by a "takedown extortionist."

He describes crews that seed illegal content into public groups, then report it to Apple to punish owners who refuse to pay.

Durov claims Apple removed the app — used by roughly 1 billion monthly users — without contacting Telegram first.

@fraudwatcher

⚠️ JUST IN: A man received 2 years in prison for selling his Telegram accounts to fraudsters.

The buyers used the accounts to advertise non-existent livestock, collected payments from victims, then vanished.

Because the accounts were registered in his name, liability fell back on the original owner — not the scammers who ran the scheme.

@fraudwatcher

🎁 FUN FACT: A darknet hosting empire ran out of an actual NATO bunker in Germany.

Cyberbunker operated out of a former military installation in Traben-Trarbach hosting Wall Street Market, Cannabis Road and Fraudsters, and in September 2019 around 600 German police had to storm the place to physically get in. Literally bulletproof hosting.

@fraudwatcher

⚠️ JUST IN: Three Missouri men charged over a kidnapping-robbery plot tied to the $245M Bitcoin heist.

Prosecutors say Sedric Louis, John Davis and Martel Williams travelled to Connecticut to rob Veer Chetal, later identified as a co-conspirator in the $245 million theft from a Washington D.C. victim.

Chetal's parents were violently abducted in that attack, in a case that also exposed Malone Lam's role in the record crypto heist.

Charges include conspiracy to commit robbery, carrying decades in prison if convicted.

@fraudwatcher

⚠️ EXPLOIT: Police raided an apartment doubling as a SIM farm used to mass-register Telegram and social media accounts.

Officers seized 21 SIM-boxes and over 6,000 SIM-cards from multiple operators. The operator registered accounts in bulk, then resold them.

• Roughly 2,000 accounts created in a single month
• Hardware spanned multiple carriers to dodge blocks

Such farms feed fraud, spam and bot networks, giving scammers a steady supply of "clean" verified accounts.

@fraudwatcher

⚡️ UPDATE: ShinyHunters has published data it claims was stolen from Big Four accounting firm Ernst & Young.

The extortion group listed the firm on its leak site, signaling failed or refused negotiations. EY has not yet confirmed the scope of the breach or what client data may be involved.

ShinyHunters has been behind a wave of high-profile corporate extortion cases, most recently mass data theft tied to Salesforce-linked environments.

@fraudwatcher

⚠️ JUST IN: Former LAPD officer Eric Halem was sentenced to life plus 15 years for a home-invasion robbery of a teenager's Bitcoin.

Halem and his crew dressed as police and broke into a 17-year-old's Koreatown apartment, using real LAPD handcuffs to restrain the teen's girlfriend.

• They threatened to shoot the teen unless he surrendered a hard drive holding $350,000 in Bitcoin
• Halem exploited his badge and police-issue gear during the raid
• Sentence handed down this week

@fraudwatcher

⚡️ UPDATE: Coldcard-linked thefts have topped $130M as victims start going public.

One holder says 2 BTC (~$128,000) — eight years of stacking — was drained from his Coldcard hardware wallet.

The root cause: a March 2021 firmware bug that made seed phrases predictable. Attackers brute-forced the seeds offline, then emptied the wallets with no on-device interaction needed.

Anyone who generated a seed on affected firmware should treat those funds as compromised and move to a freshly generated wallet.

@fraudwatcher