🎁 FUN FACT: A darknet hosting empire ran out of an actual NATO bunker in Germany.

Cyberbunker operated out of a former military installation in Traben-Trarbach hosting Wall Street Market, Cannabis Road and Fraudsters, and in September 2019 around 600 German police had to storm the place to physically get in. Literally bulletproof hosting.

@fraudwatcher

⚠️ JUST IN: Three Missouri men charged over a kidnapping-robbery plot tied to the $245M Bitcoin heist.

Prosecutors say Sedric Louis, John Davis and Martel Williams travelled to Connecticut to rob Veer Chetal, later identified as a co-conspirator in the $245 million theft from a Washington D.C. victim.

Chetal's parents were violently abducted in that attack, in a case that also exposed Malone Lam's role in the record crypto heist.

Charges include conspiracy to commit robbery, carrying decades in prison if convicted.

@fraudwatcher

⚠️ EXPLOIT: Police raided an apartment doubling as a SIM farm used to mass-register Telegram and social media accounts.

Officers seized 21 SIM-boxes and over 6,000 SIM-cards from multiple operators. The operator registered accounts in bulk, then resold them.

• Roughly 2,000 accounts created in a single month
• Hardware spanned multiple carriers to dodge blocks

Such farms feed fraud, spam and bot networks, giving scammers a steady supply of "clean" verified accounts.

@fraudwatcher

⚡️ UPDATE: ShinyHunters has published data it claims was stolen from Big Four accounting firm Ernst & Young.

The extortion group listed the firm on its leak site, signaling failed or refused negotiations. EY has not yet confirmed the scope of the breach or what client data may be involved.

ShinyHunters has been behind a wave of high-profile corporate extortion cases, most recently mass data theft tied to Salesforce-linked environments.

@fraudwatcher

⚠️ JUST IN: Former LAPD officer Eric Halem was sentenced to life plus 15 years for a home-invasion robbery of a teenager's Bitcoin.

Halem and his crew dressed as police and broke into a 17-year-old's Koreatown apartment, using real LAPD handcuffs to restrain the teen's girlfriend.

• They threatened to shoot the teen unless he surrendered a hard drive holding $350,000 in Bitcoin
• Halem exploited his badge and police-issue gear during the raid
• Sentence handed down this week

@fraudwatcher

⚡️ UPDATE: Coldcard-linked thefts have topped $130M as victims start going public.

One holder says 2 BTC (~$128,000) — eight years of stacking — was drained from his Coldcard hardware wallet.

The root cause: a March 2021 firmware bug that made seed phrases predictable. Attackers brute-forced the seeds offline, then emptied the wallets with no on-device interaction needed.

Anyone who generated a seed on affected firmware should treat those funds as compromised and move to a freshly generated wallet.

@fraudwatcher

⚠️ JUST IN: Maksim Silnikau, creator and admin of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison.

Prosecutors tied him to attacks on at least 18 companies worldwide. Silnikau was extradited to the US after his arrest in Spain.

He's also linked to earlier cybercrime infrastructure, including the Angler exploit kit and long-running malvertising schemes that pushed scareware and ransomware to victims' machines.

@fraudwatcher

⚠️ JUST IN: Connor Riley Moucka pleaded guilty in Seattle federal court to computer fraud, wire fraud, aggravated identity theft and conspiracy over the 2024 Snowflake customer account breaches.

The 26-year-old from Kitchener, Ontario hit at least 165 organizations, exposing records on at least 100 million people.

Attackers used stolen credentials to log into Snowflake customer environments that lacked multi-factor authentication, then extorted victims. Sentencing follows.

@fraudwatcher

⚠️ EXPLOIT: A WebKit flaw leaks users' real IP addresses even with iCloud Private Relay enabled.

Researchers identified three WebKit features that bypass the browser proxy and connect directly from the device — triggered simply by visiting a website.

Because Apple mandates WebKit for browsers on iOS, the issue extends beyond Safari to third-party browsers, including iOS Tor browsers, where an IP leak can deanonymize the user.

• Affects iOS and macOS WebKit-based browsers
• Bypasses proxy protections silently, with no user interaction

@fraudwatcher

⚠️ EXPLOIT: The Triple-A exploiter has laundered roughly $4.99M in DAI through Tornado Cash.

The attacker swapped the stolen DAI into 2,620 ETH before routing it into the mixer, a standard move to break on-chain tracing.

• $4.99M laundered so far
• 2,620 ETH converted from DAI
• $6.7M in stolen DAI still held by the attacker

More funds are expected to move, with the remaining balance still sitting in wallets under watch.

@fraudwatcher

⚠️ JUST IN: The username @burger was pulled from Fragment auction after receiving zero bids in 15 minutes.

The listing opened at a minimum bid of just 10 $GRAM and still drew no takers before being removed.

The same username previously sold for roughly $13,000, raising questions about collapsing demand in the Telegram username market.

@fraudwatcher

⚠️ EXPLOIT: 64 BTC and 200 ETH from the Coldcard exploit have been pushed into crypto mixers.

The attackers are laundering only part of the haul — the bulk of the stolen assets still sits in traceable, attacker-controlled wallets.

Mixer use suggests an active cash-out attempt, giving investigators a narrow window to flag the outputs before they hit exchanges.

@fraudwatcher

⚠️ JUST IN: Physical "wrench attacks" on crypto holders have netted more than $30M so far in 2026, per Chainalysis.

Researchers documented 46 attempts, though only 12 ended in an actual payout — kidnappers and home invaders increasingly target victims' families when the holder won't hand over keys.

Analysts tie the surge to data leaks exposing wallet ownership and personal addresses, turning online exposure into real-world risk.

@fraudwatcher