Latest cybersecurity reporting from selected sources.

Also: ZachXBT Uncovers DPRK Worker Scam, Hyperbridge Hack, Coinone FineThis week, Operation Atlantic disrupts $45M phishing fraud, ZachXBT uncovers DPRK crypto worker scheme, Hyperbridge exploit, South Korea fines Coinone $3.5M, Kraken faces extortion attempt over insider data leak and American musician loses $420K in fake Ledger app.

Also: NodeCordRAT Malware, North Korean QR-Phishing CampaignThis week, U.K. crypto exchanges linked to Iranian sanctions evasion, NodeCordRAT malware spread via npm, an FBI alert on North Korean QR-code phishing, illicit crypto hit $154 billion in 2025 and U.S. President Donald Trump said he won't pardon Sam Bankman-Fried.

Also: Trader Loses $50M in USDT in Address Poisoning ScamThis week, the U.K. FCA mapped a path to U.K. crypto regulation, iComTech promoter sentenced in Ponzi case, the U.S. SEC sought public company bans for former FTX and Alameda executives, a trader lost $50M in USDT in an address poisoning scam and a Brooklyn man indicted over $16M Coinbase phishing scam.

Also: LastPass Warns of Phishing Campaign, Trump's New CTFC Head PickEvery week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Meteora CEO faced fraud allegations, LastPass warned of a phishing campaign, Trump taps crypto lawyer to lead CFTC, Mt. Gox delayed creditor repayments again and an Indian court blocked WazirX from using customer funds to cover hack losses.

Also: Texas Brothers Charged in $8M Crypto-Linked Kidnapping CaseThis week, Brian Quintenz won't lead the U.S. CFTC, Canada fined KuCoin $14M, Texas brothers charged in an $8M kidnapping case, South Korean actor given suspended sentence for embezzlement, phishing campaign used robots.txt and an ex-LASD deputy pleaded guilty in a business extortion scam.

Government Agencies Targeted With Infostealers and Cryptomining MalwareA fake police alert is the social engineering cornerstone of an ongoing phishing campaign targeting Ukrainian government agencies, warn security researchers. They're tracking a surge in malicious SVG file attachments, in this case leading to information-stealing and cryptocurrency-mining malware.

Attacker Socially Engineered Developer With Phishing EmailA hacker laced 18 popular npm packages with cryptocurrency stealing malware after socially engineering the developer into giving up his credentials to the JavaScript runtime environment. Aikido Security said the 18 software packages collectively have downloads of more than two billion each week.

PoisonSeed Threat Actor Uses Cross-Device Login Feature and QR Code to Trick UsersExpel researchers have found a novel adversary-in-the-middle phishing technique used by PoisonSeed, a cybercrime group previously tied to large-scale cryptocurrency thefts, to sidestep one of the most secure forms of multifactor authentication - FIDO2 physical keys.

Also: CoinMarketCap Attack, BitPro Blames Lazarus for $11M HackThis week, a new malware targeted crypto wallets via photos, CoinMarketCap faced attack, BitoPro blamed Lazarus for heist, Trezor warned of phishing scam, France saw another crypto kidnapping, cops re-arrested teen after second theft, Hacken blamed human error for exploit and Self Chain ousted CEO.

Also: PoisonSeed Phishing Campaign, FTX Clients Face Reimbursement HurdleThis week, Trump administration disbanded a Justice Department crypto unit, the U.S. Securities and Exchange Commission will review crypto guidance, Usual pledged up to $16M in bug bounties, a PoisonSeed phishing campaign, FTX repayment plan troubles and a Coinbase 2FA error.

Also: FBI Warns About Work-From-Home Scammers Demanding CryptoThis week, Robinhood said it will acquire Bitstamp in a $200 million deal, a senior promoter of the Forcount crypto Ponzi scheme pleaded guilty, crypto scammers targeted work-from-home job seekers, and Tether and CoinGecko warned of crypto phishing attacks.

Also: Bitcoin Fog; EU's Sanctions Violation LawThis week, amounts for crypto and phishing losses were released, the Bitcoin Fog operator was convicted, the EU approved rules to strengthen sanctions, the federal government sought to recover losses linked to pig butchering, and the Philippines blocked unlicensed crypto websites.

Researchers Say Hackers Used Fake Login Pages to Trick 100 Victims, Crypto WorkersA new phishing campaign is targeting victims through mobile devices by mirroring legitimate login pages for the Federal Communications Commission and large cryptocurrency platforms including Binance and Coinbase. At least 100 victims, including crypto company employees, have fallen for the scam.

Also: Changpeng Zhao's Sentencing; UN Probe of North Korean HacksThis week, the U.S. Treasury reported on crypto in crime, Changpeng Zhao's sentencing was rescheduled, PlayDapp was hacked, the UN probed North Korean hacking, suspicious crypto transactions increased in South Korea, the U.K. blocked fraud sites and Hong Kong warned about crypto phishing sites.

Legal Moves: Crypto Theft Lawsuit; Hospital Sues LockBit GangIn the latest weekly update, ISMG editors discussed why crypto-seeking drainer scam-as-a-service operations are thriving, a novel legal move that recovered a hospital's stolen data, and a ground-breaking case involving bitcoin that could streamline recovery for victims.

$295 Million in Digital Assets Lost Last Year to Wallet Drainers, Researchers WarnCryptocurrency phishing scams designed to send crypto owners to fake versions of legitimate sites, recently disseminated via hijacked high-profile social media accounts, highlight the ongoing use of drainer scam-as-a-service offerings, which researchers say last year led to $295 million in losses.

Also: Bitcoin ETP, Gamma and dYdX Attacks, 2023 Hack StatsThis week, hackers ran crypto phishing scams on X accounts, the SEC approved bitcoin ETP, hackers stole $3.4 million from Gamma, dYdX detailed post-hack steps, CertiK published 2023 hack stats, TRM Labs discussed North Korean hacking and Apple India blocked users from offshore crypto exchanges.

All Organizations That Use X Should Review Their Two-Factor Authentication SettingsGoogle Cloud's Mandiant says its account at X, formerly Twitter, was hijacked and used to link to cryptocurrency phishing pages after an attacker guessed the account password, apparently after Twitter last year deactivated the account's SMS-based two-factor authentication, leaving it unprotected.

Also: Mandiant X Account Hijacked in Cryptocurrency ScamThis week, hackers took over Mandiant's X account, authorities charged a Nigerian hacker with stealing $7.5 million from charities, the DOJ fined XCast $10 million for illegal robocalls, and attackers exploited an SMTP smuggling flaw in a phishing email campaign.

Also: Crypto Hack Losses in 2023 Decreased by Over 50%This week, Orbit Chain lost $81 million in a New Year's Eve hack, Indonesian police shuttered bitcoin mining operations, dYdX named its attacker, $324,000 users fell victim to 2023 crypto phishing scams, Singapore's prime minister had a deepfake problem, and 2023 crypto losses decreased by over 50%.