Scams

In November 2023, Binance agreed to a $4.3 billion criminal plea deal with US authorities, but later findings allege the exchange still allowed flagged accounts to process large crypto flows. An investigation into 13 Binance accounts reportedly uncovered $1.7 billion in crypto movements, including $144 million after the plea deal, with links to Iran, Hezbollah and wallets later frozen under anti-terrorism laws. Binance's legal team denies knowingly facilitating criminal activity and says relevant wallets were not designated for terror financing at the time.

Kaspersky reported on Thursday that a Windows-targeting infostealer dubbed 'Stealka' is spreading via video game cheats, mods, and pirated software. Distributed through GitHub, SourceForge, and Google Sites, it harvests autofill and extension data from over 100 Chromium- and Gecko-based browsers and threatens 115 extensions and 80 crypto wallets.

Two Canadians from Ontario and Prince Edward Island lost a combined $2.3 million to an AI-enabled deepfake cryptocurrency investment scheme. The Ontario victim lost $1.7 million after being deceived by a fake Elon Musk video, while the other victim lost $600,000 after watching a clip falsely linked to Dragon's Den. The report was updated on December 21, 2025.

On December 21, 2025, SantaStealer was detailed as a malware-as-a-service that prioritizes crypto wallets. It is promoted on Telegram and hacker forums with monthly plans at $175 (Basic) and $300 (Premium). Rapid7 links it to BluelineStealer and notes weak evasion, while data is exfiltrated in 10MB chunks over port 6767.

A crypto trader reportedly lost $50,000,000 in USDT after an address‑poisoning scam led to a mistaken copy‑paste. Stablecoins remained pegged, so broader markets saw little reaction, highlighting the finality risk in self‑custody. The incident shows how spoofed look‑alike addresses can appear in wallet history and mislead hurried senders.

The U.S. Securities and Exchange Commission announced settlements with former FTX executives, with enforcement actions pending court approval. The measures bar them from serving as officers or directors of public companies, in some cases for up to ten years, and do not include monetary penalties. Caroline Ellison is expected to face a 10-year officer/director bar related to misused FTX customer funds.

On December 18, 2025, the U.S. SEC filed proposed final judgments against former FTX and Alameda executives Caroline Ellison, Gary Wang, and Nishad Singh. The settlements include permanent anti-fraud injunctions, a 10-year officer/director ban for Ellison, 8-year bans for Wang and Singh, and a further five-year conduct injunction.

Summit National Bank will create a $400,000 settlement fund for customers impacted by a May 2024 email-account breach that exposed names, Social Security numbers, contact details and account numbers. Eligible class members can claim up to $5,000 for documented out-of-pocket losses, plus a pro rata cash payment around $175 and three years of credit and identity monitoring, with claims due February 17, 2026.

On December 20, 2025, a crypto investor mistakenly sent $50 million in USDT to a poisoned address. Within 30 minutes, the funds were swapped to DAI and then 16,690 ETH, with 16,680 ETH routed through Tornado Cash; on-chain timestamps show a 0.005 USDT test and the large transfer minutes apart.

A crypto user mistakenly sent 49,999,950 USDT to a look‑alike address, an incident attributed to address poisoning, according to SlowMist. The funds were rapidly moved into ETH, split across wallets, and partly routed via Tornado Cash; on December 20, 2025, Cos shared the involved addresses. The wallet had been active about two years with frequent USDT transfers.