OCINT - OnChainIntelligence

𝗧𝗵𝗲 𝗗𝗮𝗶𝗹𝘆 𝗧𝗿𝗮𝗰𝗲 | October 23, 2026 Your Daily Crypto News Digest 𝗧𝗼𝗽 𝗦𝘁𝗼𝗿𝘆 Interpol said more than 1,400 suspected cybercriminals were arrested across Africa this summer as part of a crackdown targeting gangs behind online fraud, ransomware, and business email compromise attacks, with $105 million seized. (via @TheRecord_Media and @OCCRP) 𝗛𝗮𝗰𝗸𝘀 & 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝘀 - An attacker moved $744,000 in ETH and BNB to Tornado Cash after exploiting Cysic's bridge to mint 10 million tokens on BNB Smart Chain; Cysic has offered the exploiter a 10% bounty. (via @Cointelegraph) - Arkham said Bitget was hacked for $388 million in late September and outlined how to track the stolen funds. (via @arkham) - CoinDCX denied that its active wallets were hacked after blockchain sleuths flagged $16 million in outflows from addresses linked to the India-based exchange. (via @CoinDesk) 𝗘𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁, 𝗔𝗿𝗿𝗲𝘀𝘁𝘀 & 𝗦𝗲𝗶𝘇𝘂𝗿𝗲𝘀 - New York's attorney general is seeking over $1.3 billion from NovaTech's founders, whose platform allegedly took in $1.16 billion and traded only a fraction of it, following an August 2025 default judgment and nearly $6 million in settlements with four promoters. (via @TheBlockCo and @Cointelegraph) - The Central Bank of Ireland penalized Coinbase Ireland EUR 3,252,618 for leaving its safeguarding account underfunded and mixing customer funds with group accounts; it is the exchange's second Irish penalty in the last year. (via @decryptmedia) - A U.S. district court found four Lebanese defendants liable for fraud, torture, and civil conspiracy in the 2019 detention of Elie and Lara Samaha and ordered $35 million. (via @OCCRP) 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁 & 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 - Microsoft said a Chinese government-aligned hacking group used automated ARTEX AI agents to carry out the recent supply-chain attack on ConnectWise and is using the same techniques to target organizations worldwide. (via @TheRecord_Media) - Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images carrying a payload that steals credentials, secrets, and environment variables. (via @BleepinComputer) - SlowMist said users reported a GitHub repository named sol-live, presented as a Solidity interview practice project, that contained a hidden command capable of collecting browser login databases, wallet extension storage, and macOS Keychain files; the actual scope of infection is not confirmed. (via @SlowMist_Team) 𝗦𝗮𝗻𝗰𝘁𝗶𝗼𝗻𝘀 & 𝗗𝗲𝘀𝗶𝗴𝗻𝗮𝘁𝗶𝗼𝗻𝘀 - Brendon Luo, sanctioned by the U.S. Treasury in June over ties to a Cambodian scam compound, still owns a California mansion estimated at $5 million, according to OCCRP. (via OCCRP) Follow BlockchainUnmasked for your daily news digest every morning

𝗧𝗵𝗲 𝗗𝗮𝗶𝗹𝘆 𝗧𝗿𝗮𝗰𝗲 | September 25, 2026 Your Daily Crypto News Digest 𝗧𝗼𝗽 𝗦𝘁𝗼𝗿𝘆 Bitget was reportedly drained of $350M across seven chains between 18:31 and 21:23 UTC, with five wallets compromised and 26 hacker addresses labelled so far. Reported funds include 102.93M XRP ($157.48M), 31,890 ETH ($85.75M), 34.75M USDT, and 21.05M USDC, according to on-chain assessments. (via @arkham and @lookonchain) 𝗛𝗮𝗰𝗸𝘀 & 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝘀 - Attackers reportedly drained Duelbits' hot wallets across four blockchains, taking the crypto casino offline. About $6 million in stolen funds now sits in a single Ethereum address. (via @CoinDesk) 𝗘𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁, 𝗔𝗿𝗿𝗲𝘀𝘁𝘀 & 𝗦𝗲𝗶𝘇𝘂𝗿𝗲𝘀 - KelpDAO sued LayerZero and Bryan Pellegrino over the April 18 rsETH exploit, described as a $292M loss. The suit alleges LayerZero approved the single-verifier configuration in writing multiple times, then reportedly warned a different developer about it. (via @TheBlockCo and @decryptmedia) - Ardit Kutleshi, 28, a Kosovar national, pleaded guilty to operating Rydox, an illicit marketplace selling stolen personal information, login credentials, and cybercrime tools. Extradited from Kosovo last year, he faces up to 22 years in prison. (via @BleepinComputer and @TheRecord_Media) - Ahmed Hossam Eldin Elbadawy, a Texas man linked to Scattered Spider, was sentenced to 45 months after pleading guilty to wire fraud conspiracy and aggravated identity theft. The court reportedly ordered forfeiture of approximately 175 bitcoin and 1,306 ether or sale proceeds. (via @DarkWebInformer) 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁 & 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 - A new MacSync malware variant targeting macOS now uses public iCloud calendar events to deliver new native payloads. (via @BleepinComputer) - A new botnet malware called Carbonato targets insecure Docker hosts to install the Hermes Agent AI framework and take control. (via BleepingComputer) - A high-severity Roundcube Webmail vulnerability patched in May is now being actively exploited in code injection attacks, according to the Canadian Centre for Cyber Security. (via BleepingComputer) 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻 & 𝗣𝗼𝗹𝗶𝗰𝘆 - New York sued Polymarket, alleging it is running an illegal gambling operation without a license. The state is seeking to block its operation and recover allegedly illegal gains, following a similar lawsuit against Kalshi in July. (via @CoinDesk) - The U.S. Federal Reserve proposed rules to implement the GENIUS Act, including capital requirements, a two-day redemption window, and new reserve disclosures for stablecoin issuers. (via @Cointelegraph) - Sens. Mark Warner and Ted Cruz introduced the Telecommunications Cybersecurity and Resilience Act, citing Salt Typhoon attacks in which Chinese hackers reportedly breached nearly all major U.S. telecommunications companies. (via The Record) Follow BlockchainUnmasked for your daily news digest every morning

𝗧𝗵𝗲 𝗗𝗮𝗶𝗹𝘆 𝗧𝗿𝗮𝗰𝗲 | September 22, 2026 Your Daily Crypto News Digest 𝗧𝗼𝗽 𝗦𝘁𝗼𝗿𝘆 Agencies from Japan, the U.S., Australia, and Germany released a report on Sep 18 linking North Korea-tied WaterPlum, also known as Contagious Interview, to 30,000+ infected computers across 100+ countries from Dec 2025 to Jul 2026, theft from 7,000+ crypto wallets, and at least JPY 1.7B (approximately USD 10.71M) flowing into WaterPlum-controlled wallets. Japan also disclosed its first Laptop Farm seizure and dismantling. (via @SlowMist_Team and @officer_secret) 𝗛𝗮𝗰𝗸𝘀 & 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝘀 - DPRK-aligned TraderTraitor, also known as UNC4899 and Jade Sleet, reportedly compromised an India-based IT services firm with no crypto ties by luring engineers via fake GitHub job interviews and deploying weaponized Terraform files that install two macOS backdoors, FLATROOF and ROOFDECK, enabling credential theft and cloud access. (via @SlowMist_Team) - White hats moved 52 BTC linked to the Coldcard exploit to a Wyoming trust for victims, with the transfer accompanied by an OP_RETURN message pointing to a recovery trust address. The amount represents approximately 40% of the bitcoin moved in the exploit's second wave. (via @CoinDesk and @Cointelegraph) 𝗘𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁, 𝗔𝗿𝗿𝗲𝘀𝘁𝘀 & 𝗦𝗲𝗶𝘇𝘂𝗿𝗲𝘀 - Federal prosecutors in Manhattan and the Justice Department are reportedly investigating whether Binance knowingly allowed users to bypass U.S. sanctions on Iran and whether its 2023 compliance fixes held. Binance says it maintains a zero-tolerance policy for sanctions violations. (via @CoinDesk and @decryptmedia) - James Joseph Simpkins, 49, of Cedar City, Utah, has been charged with second-degree felony sexual exploitation of a minor after FBI investigators allegedly traced Bitcoin subscription payments to a dark web child sexual abuse material site to his verified Coinbase wallet. FBI agents and Iron County sheriff's deputies searched his residence on September 16. (via @DarkWebInformer) 𝗖𝘆𝗯𝗲𝗿 𝗧𝗵𝗿𝗲𝗮𝘁 & 𝗠𝗮𝗹𝘄𝗮𝗿𝗲 - Google learned in late July that Gemini had breached three real companies during a May security test but made no public disclosure for seven weeks. (via Decrypt) 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻 & 𝗣𝗼𝗹𝗶𝗰𝘆 - The European Central Bank launched its Pontes DLT platform to connect its payment system to blockchain-based financial markets, with plans to purchase tokenized public-sector securities and settle trades through the platform to gain firsthand DLT market experience. (via Cointelegraph) Follow BlockchainUnmasked for your daily news digest every morning