Scams

On March 5 2026, Dubai’s Virtual Asset Regulatory Authority issued a market alert against Kucoin Exchange and related entities operating under the Kucoin brand, citing unlicensed virtual asset services offered to Dubai residents. The regulator ordered Kucoin to cease all unauthorized crypto activities in or from Dubai and warned that unlicensed providers could expose consumers to financial and legal risks. Kucoin had previously obtained a MiCAR license in Austria in early 2026, but in February 2026 the Austrian Financial Market Authority barred KuCoin EU from onboarding new business over anti-money laundering compliance breaches.

Google's threat intelligence team reported that a new exploit kit dubbed "Coruna" targets iPhones running iOS 13.0 to 17.2.1 and has been used on fake crypto websites to capture wallet seed phrases. The toolkit, first identified in February 2025, contains multiple iOS exploit chains and was later found on spoofed Chinese financial and exchange sites seeking user funds and sensitive data. Security researchers say the tool may be linked to surveillance customers, while some industry experts dispute claims it originated from US intelligence code.

In an international operation on March 3 and 4, law enforcement agencies led by the FBI and Europol dismantled LeakBase, a cybercrime forum with more than 142,000 registered members and over 215,000 messages. Authorities in 14 countries seized user accounts, payment details and IP logs, issued prevention notices and replaced the site with seizure banners. LeakBase's predecessor Raidforums, which was shut down in 2022, had previously hosted leaked personal data of roughly 272,000 users of Ledger's crypto wallet service.

On Wednesday, Europol said a coalition including Coinbase and Microsoft dismantled key infrastructure of Tycoon 2FA, a phishing‑as‑a‑service platform used to bypass multi‑factor authentication. By mid‑2025, Tycoon 2FA represented 62% of phishing attempts blocked by Microsoft, with more than 30 million malicious emails in a single month, and Coinbase traced blockchain transactions linked to the alleged operator and customers.

Bybit reported that its AI-based fraud prevention framework intercepted and recovered $300 million tied to impersonation and other scams in 2025, protecting thousands of account holders. The exchange also said its models flagged hundreds of risky addresses, blocked more than 3 million credential-stuffing attempts, and structured scam response into a three-tier risk system.

Between December 8, 2025 and January 30, 2026, Binance worked with Interpol, Afripol and law enforcement in 16 African countries on Operation Red Card 2.0, which led to 651 arrests and the recovery of $4.3 million tied to scam networks linked to over $45 million in losses. The exchange is also challenging a Wall Street Journal article it calls inaccurate and defamatory, while highlighting expanded compliance resources and its role in responding to more than 71,000 law enforcement requests in the previous year.

In the fourth quarter of 2025, Bybit reported that its AI-assisted risk monitoring system disrupted or stopped more than $300 million in suspected scam-related withdrawals. The platform said around $500 million in withdrawals were flagged overall, protecting over 4,000 users, many of whom canceled transfers after receiving real-time alerts.

The United States Attorney's Office for the District of Massachusetts has filed a civil forfeiture action to seize $327,829 in USDT tied to an alleged online romance investment scam. Tether has reported freezing $4.2 billion in USDT connected to illicit activity over the past three years and was also commended for helping federal agencies seize an additional $61 million in a separate money laundering case.

Cybersecurity researchers report that "ClickFix" attacks are now being used by scammers posing as venture capital firms on LinkedIn and by hijacking the QuickLens Chrome extension. The VC-themed campaign lures victims into fake video calls, while the compromised extension was updated with malware after a February 1 ownership change and reached around 7,000 users before removal.

On a Monday ruling, Manhattan federal judge Katherine Polk Failla dismissed with prejudice a class action that tried to hold Uniswap Labs and its founder Hayden Adams liable for scam tokens allegedly involved in rug pulls and pump-and-dump schemes on the protocol. The suit, originally filed in April 2022 and amended in May after an earlier dismissal, failed to show Uniswap knew of or substantially assisted fraud by third-party token issuers.