Scams

Gnosis’ official X account has been compromised, and users are being urged to avoid interacting with it. The warning covers posts, links, reward campaigns, voting announcements and wallet-connection prompts. Users are advised not to click links or sign transactions until the issue is resolved.

Hu Shi, linked to Prince Group’s activities in Japan, was arrested on June 14 on suspicion of falsifying public records. Japanese police have connected him to Prince Group, an organization that ran one of the largest “pig butchering” scam centers in Cambodia. The case centers on allegations that he submitted false paperwork related to an address change.

A Hong Kong buyer lost HK$1.23 million after making 80 transfers over 30 days to a scammer posing as a secondhand laptop seller. Some payments were routed through Bitcoin ATMs, making recovery unlikely because crypto transactions are largely irreversible. Police said the “sunk cost” mindset kept the victim sending new fees, each framed as the final step to unlock delivery.

The operator of Jaredfromsubway.eth, one of Ethereum’s most active automated MEV bots, offered a 50% white-hat bounty on June 22 after an attacker drained more than $7.5 million from the bot’s wallet using an on-chain honeypot. The operator, who uses the on-chain identity ae13, said the bounty would apply if the funds are returned within 48 hours and warned of legal action otherwise. The incident underscores that bots built to profit from ordinary traders can themselves become targets for cybercriminals.

The Jaredfromsubway MEV bot, linked to roughly 70% of Ethereum sandwich attacks, lost more than $7.5 million in an allowance drain after its automated system authorized attacker-controlled contracts to spend its tokens. The bot, known as Jaredfromsubway.eth, approved a series of transactions that appeared to be part of profitable trading routes.

The Ethereum Foundation has proposed “clear signing” standards aimed at replacing blind signing and making wallet approvals easier to understand. The guidelines would present Web3 transactions in human-readable summaries rather than raw hexadecimal data. The goal is to reduce the risk of phishing scams that trick users into authorizing malicious transactions.

Microsoft warned of malware that spreads via USB flash drives by using Windows shortcut files to infect devices. The so-called “clipper” malware looks for cryptocurrency addresses copied to a user’s clipboard and replaces them with attacker-controlled addresses. The alert came from the Microsoft Defender team, Windows’ built-in security tool.

A newly identified Android banking trojan is targeting 217 banking and cryptocurrency apps and can give attackers extensive control over infected devices. The malware, dubbed Rokarolla, is spread via malicious websites that impersonate popular apps such as TikTok and Google Chrome, according to mobile cybersecurity firm Zimperium. It uses deceptive overlay screens to capture sensitive information from users.

Microsoft flagged a USB-spread crypto clipper malware on June 17, 2026, saying the activity has been ongoing since February. The threat monitors the clipboard and swaps wallet addresses when users paste them. It also steals seed phrases.

Federal jurors convicted a former cryptocurrency promoter after prosecutors linked him to investment fraud schemes that cost investors nearly $1 million. The case focused on Crypto-Pal, which was marketed as a cryptocurrency trading business promising guaranteed high returns with no risk. Prosecutors said investors were lured by assurances of risk-free gains that did not materialize.