⚠️ JUST IN: The username @burger was pulled from Fragment auction after receiving zero bids in 15 minutes.

The listing opened at a minimum bid of just 10 $GRAM and still drew no takers before being removed.

The same username previously sold for roughly $13,000, raising questions about collapsing demand in the Telegram username market.

@fraudwatcher

⚠️ EXPLOIT: 64 BTC and 200 ETH from the Coldcard exploit have been pushed into crypto mixers.

The attackers are laundering only part of the haul — the bulk of the stolen assets still sits in traceable, attacker-controlled wallets.

Mixer use suggests an active cash-out attempt, giving investigators a narrow window to flag the outputs before they hit exchanges.

@fraudwatcher

⚠️ JUST IN: Physical "wrench attacks" on crypto holders have netted more than $30M so far in 2026, per Chainalysis.

Researchers documented 46 attempts, though only 12 ended in an actual payout — kidnappers and home invaders increasingly target victims' families when the holder won't hand over keys.

Analysts tie the surge to data leaks exposing wallet ownership and personal addresses, turning online exposure into real-world risk.

@fraudwatcher

⚠️ JUST IN: A researcher claims Telegram's gift number system is being gamed to snap up rare "beautiful numbers."

The pattern: whenever a sequence like #3333, #5555 or #7777 was up for upgrade, a user named "Tanya" allegedly upgraded the numbers immediately before and after it — then the prize number surfaced minutes later already in her possession.

"Tanya" has reportedly been linked to a second account, "Artem," raising suspicion of insider access or a scripted advantage over ordinary users.

Telegram has not publicly responded to the allegations.

@fraudwatcher

⚠️ JUST IN: Attackers drained $5.7M by guessing wallet seed phrases outright.

A flaw in several crypto wallet apps produced seed phrases with far less randomness than the standard requires, shrinking the pool of possible combinations.

That let attackers mass-generate phrases until one matched a live wallet — no phishing, no malware, no user mistake required. Funds were swept the moment a hit landed.

Affected users should assume any wallet created in a vulnerable app is compromised and move assets to a newly generated wallet from a trusted source.

@fraudwatcher

⚡️ UPDATE: The Coldcard hacker has moved 30.185 BTC — roughly $1.94 million — into a fresh wallet.

The transfer signals renewed laundering of proceeds from the $130 million breach, after a period of dormancy.

Investigators and chain-analysis firms are tracking the addresses as the funds get shuffled, with exchanges the likely next chokepoint.

@fraudwatcher

⚠️ JUST IN: Bybit has sued North Korea and the Lazarus Group over the $1.5B hack — the largest crypto theft on record.

A U.S. federal judge has frozen identified assets tied to the attack, as the exchange moves to claw back stolen funds.

The FBI previously attributed the breach to North Korean state actors.

@fraudwatcher

⚠️ JUST IN: Nearly 800 malicious npm packages were published in a single campaign dropping a cross-platform RAT and infostealer.

The packages use randomly generated or AI-generated typosquatted names mimicking legitimate libraries, hitting developers on Windows, macOS, and Linux.

The payload grants full remote access and harvests credentials, tokens, and crypto wallet data — turning any infected build machine into a foothold for supply chain compromise.

Developers should audit recent installs and lockfiles for unfamiliar dependencies.

@fraudwatcher

⚠️ JUST IN: popular seller @lunacy spotted in the epstien files

⚠️ EXPLOIT: Attackers are draining funds from Lightning Network payment servers in a fresh wave of Bitcoin infrastructure exploits.

The targets are node operators running hot-wallet payment infrastructure — channels must stay online and funded, leaving keys exposed on internet-facing servers.

Once a node is compromised, funds move instantly over Lightning and are near-impossible to claw back, unlike on-chain transfers that can be traced through mixers.

Operators are advised to audit node access, rotate credentials, and cap channel balances until patches land.

@fraudwatcher

⚠️ JUST IN: A phishing attacker who stole $501K USDC on Base lost nearly all of it minutes later (370k).

The thief swapped the stolen USDC for WETH on Uniswap V4 with no slippage protection.

An MEV bot sandwiched the trade and took the bulk of the funds, leaving the attacker with a fraction of the original haul.

@fraudwatcher

⚠️ JUST IN: Bingo, a known figure on marketplace forum OGUsers, has been banned from the site.

The reason behind the removal is unclear — his profile now shows the ban, but no public explanation has been given.

Open question: whether he stepped away voluntarily or was pushed out over a dispute or rule violation.

@fraudwatcher

⚠️ JUST IN: Coinsbuy wallets were drained of $7.9M+ across TRON and Ethereum.

The attacker started laundering proceeds into Monero via exchanges. A six-figure sum was frozen before it could move.

Coinsbuy paused deposits and withdrawals during the incident, then resumed both services.

@fraudwatcher

⚠️ JUST IN: Tiffany Milanovich, a US-based threat actor, has been tied to more than $5 million in crypto thefts.

She allegedly ran support-impersonation scams, posing as help desk staff to drain hardware wallet and exchange users' funds.

Investigators say she taunted victims and flaunted the stolen proceeds on social media.

@fraudwatcher