ThreatPaper

Cryptocurrency & Web3

6 cases

Raheim Hamilton, co-creator of the $430M darknet market Empire Market, was sentenced to 40 years on October 5, 2026. The case ties his 'ZeroAngel' AlphaBay counterfeiting past to the Tor and crypto machinery of a 4-million-transaction market — and to ~1,230 BTC seized despite coin tumbling.

Darknet & Illicit MarketsCryptocurrency & Web3

OFAC sanctioned a Tren de Aragua ATM jackpotting network on September 30, 2026 — eight facilitators, two Mexican firms and seven TRON addresses — tied to $40.73M in reported US losses. Alleged malware engineer 'Prometheus' was arrested and arraigned in Nebraska two days later.

Financial FraudCryptocurrency & Web3Malware

Bitget lost an initially-reported $351.6M — later revised to ~$387.5M — after attackers compromised a wallet-infrastructure backend, spoofed transaction data and pushed forged transfers through its own authorization workflow. Private-key theft was ruled out; Bitget suspects North Korea.

Cryptocurrency & Web3Financial Fraud

Blackpoint APG documented ChainScript, a full-featured RAT pushed via ClickFix lures (fake Spotify/Zoom/Teams installers) that reads a Polygon smart contract to find its live WebSocket C2 — an EtherHiding-style design built to survive takedowns and defeat indicator-based blocking.

MalwareSocial EngineeringCryptocurrency & Web3

A market that took only Monero ran for five years and €330 million. The playbook that broke Silk Road and AlphaBay did not apply — and the authorities who dismantled it have not said what did.

Darknet & Illicit MarketsCryptocurrency & Web3

A stranger emailed an unpaid maintainer offering to take over a package he no longer used. Three months later it was stealing private keys from bitcoin wallets holding more than 100 BTC. Nobody was ever identified.

Supply Chain AttackCryptocurrency & Web3