ThreatPaper

#cryptocurrency

5 cases

A market that took only Monero ran for five years and €330 million. The playbook that broke Silk Road and AlphaBay did not apply — and the authorities who dismantled it have not said what did.

Darknet & Illicit MarketsCryptocurrency & Web3

Nobody was hacked. A Chinese CDN company bought the polyfill.io domain, and every site that had ever pasted the script tag started serving whatever the new owner wanted. Four months later it was redirecting phones to betting scams.

Financial FraudSupply Chain Attack

A stranger emailed an unpaid maintainer offering to take over a package he no longer used. Three months later it was stealing private keys from bitcoin wallets holding more than 100 BTC. Nobody was ever identified.

Supply Chain AttackCryptocurrency & Web3

A North Korean-linked actor compromised Trading Technologies' X_TRADER, used it to breach 3CX, and shipped signed, trojanised VoIP clients to its customers — the first documented case of one software supply chain attack causing another.

Supply Chain AttackState-Sponsored

In mid-2025, the Narcotics Control Bureau (NCB) Cochin Zonal Unit executed Operation MELON, dismantling India's premier Level-4 darknet narcotics syndicate operating under the vendor moniker...

Darknet & Illicit Markets