The post Bitget Hacker Moves Millions in XRP as Freezing Fails appeared first on Coindoo.

Key Takeaways

The stolen XRP is no longer sitting where it first landed. A CoinDesk review of XRP Ledger records found that roughly 54 million XRP had left the five original accounts used to hold the Bitget haul by 12:41 UTC on September 26. Two accounts that began with 20 million XRP each had been reduced to about 23 and 55 XRP, while a third held roughly 5.8 million XRP.

About 49 million XRP, valued near $75 million at the time, remained in those first five accounts. That figure only counts the original holding accounts: funds that leave them can still be under the attacker’s control in newly created wallets. The on-chain question is whether the XRP reaches a service that can identify and stop the person controlling it.

To understand what the $83 million figure actually measures, it helps to separate the original theft from the later redistribution.

The five original wallets show only the first stage

Public blockchain records show that roughly 103 million XRP left two Bitget-linked XRPL accounts on September 24 and reached the address rwNhefsz1UQEusxhCvHip3RANinWi4CTck. Arkham has placed that address in its Bitget Hacker entity.

The amount was then split among five holding accounts. The split confirms where the XRP first went. It cannot, by itself, show whether each later address belongs to the same operator, a laundering intermediary or an exchange customer.

Calling every transfer a “cash-out” would overstate the evidence. A movement between attacker-controlled wallets does not create new selling pressure by itself. Selling becomes a more concrete risk when the route reaches a centralized exchange, OTC desk, instant-swap service or another gateway that can turn XRP into a different asset or fiat money.

Ripple cannot freeze a native XRP balance

The limitation is built into how the XRP Ledger treats its native asset. XRP is not an issued token and has no issuer that can blacklist an account. The XRPL documentation states that freeze features apply to issued tokens held through trust lines, not XRP itself.

Ripple, the XRPL Foundation and validators therefore have no built-in authority to mark these native-XRP accounts as frozen. A normal payment from an account that holds sufficient XRP remains valid under the ledger’s current rules.

Traceability is not control. The XRP Ledger makes the transfers public, yet that transparency does not give Ripple authority to seize or lock native XRP held in another account.

The contrast is visible in the stablecoin portion of the same breach. CoinDesk reported that Circle and Tether had frozen about $320,000 in USDC and USDT tied to the incident. Those assets include issuer-level blacklist controls. Native XRP does not.

The important intervention point is the exchange deposit

Once the XRP reaches an exchange-controlled address, the issue changes from protocol rules to custodial control. The exchange can connect a tagged XRP deposit to a customer account, stop withdrawals or trading, preserve records and respond to investigators.

This distinction is especially relevant on the XRP Ledger because large exchanges commonly use shared deposit wallets. A destination tag tells the exchange which internal customer account should receive a payment. The tag is not public proof of a person’s identity, but it creates a point where the platform can match an on-chain deposit with its own customer records.

A September 25 public-XRPL analysis traced one route from an original holding account through intermediary addresses toward Binance and MEXC deposit infrastructure. That does not prove those exchanges received or credited all later transfers, and neither platform should be described as having frozen funds without a public confirmation. It does show why on-chain alerts matter before a large balance reaches an exit.

READ MORE:

How Cosmos Hub Stopped and Restarted to Seize Stolen ATOM

The holding accounts are emptying quickly

That exchange checkpoint is becoming more urgent because the original holding accounts are emptying quickly. They held around 70 million XRP at 04:32 UTC on September 26. Roughly eight hours later, that balance was about 49 million XRP, according to CoinDesk’s review. In another visible detail, one account failed to send roughly 521,000 XRP because it did not have sufficient funds; a second account sent an identical amount to the intended recipient about an hour later.

That pattern supports the conclusion that the funds were being actively redistributed. It does not establish the reason for every transfer, whether a particular wallet belongs to a laundering service, or how much XRP has reached the market. Those require evidence beyond the ledger itself.

The decisive moment is not the next transfer between anonymous wallets. It is the first point at which a traceable XRP balance enters a service that knows who controls the account and can prevent it from leaving again.

This article is provided for informational purposes only and does not constitute financial, investment or legal advice. On-chain balances, wallet labels and exchange actions can change quickly as the investigation continues.

The post Bitget Hacker Moves Millions in XRP as Freezing Fails appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-hacker-moves-millions-in-xrp-as-freezing-fails/

The post Bitget Wallets Flagged in Suspected $170M Security Breach appeared first on Coindoo.

The claim remains unconfirmed. Neither the reported attack method nor the final loss total had been established at publication. The Block said it had contacted Bitget to ask whether the transfers were tied to a security incident and whether withdrawals had been paused, but no public explanation had been identified at publication.

The alerts concern wallets associated with Bitget’s exchange infrastructure; they do not establish a compromise of the separately branded Bitget Wallet self-custody app.

What the on-chain trail reportedly shows

The Block reported also that on-chain data appeared to show more than $170 million moving from Bitget hot and cold wallets to one address over roughly an hour. The transfers reportedly included ETH, USDT, USDC, AVAX and BNB.

Wu Blockchain said, citing MLM monitoring, that three hot wallets and one cold wallet were suspected of being involved. It linked the activity to 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee and stressed that the attack vector and total losses remain unconfirmed.

Withdrawal Complaints Create a Separate Question

The Block also noted social-media posts and online reports from users who said they were experiencing withdrawal problems. Those claims do not establish that Bitget has suspended withdrawals, and they do not prove that any service issue is connected to the flagged wallet movements.

They nevertheless create a second question for the exchange. If the transfers were authorised wallet management, Bitget can identify the receiving address and explain whether users are facing an unrelated operational delay. If the two developments are connected, a public response becomes more urgent.

Why $170 million moved does not yet mean $170 million was stolen

Exchanges regularly shift large balances between hot wallets, cold storage and liquidity-related addresses. A large transfer can look alarming on a blockchain explorer while still being authorised wallet management.

The reported pattern here is more difficult to dismiss than a single transfer because assets from several wallets reportedly reached one fresh address that was not identified as Bitget-controlled and then entered swaps. Even so, that is evidence worth investigating, not proof of theft.

The missing fact is simple: does Bitget control the receiving address?

If the exchange identifies it as an internal operational wallet, the breach theory weakens sharply. If the ETH continues through bridges, mixers or wallets unrelated to Bitget, the case for an unauthorised outflow becomes much stronger.

Three answers matter more than the first loss estimate

Is the destination address controlled by Bitget?

This is the fastest way to separate internal wallet management from a possible compromise. The destination address is publicly visible; only Bitget can say whether it controls it.

Were the transfers authorised?

Bitget needs to clarify whether the wallets acted through normal signing procedures or whether access to any part of its infrastructure was compromised. Until then, claims about the method behind the transfers remain speculation.

Are users or platform services affected?

The on-chain reports do not establish that customer balances, deposits, withdrawals or trading services have been affected. A public update on those points would matter more to users than another revised estimate of the outflows.

What would settle the question

A formal Bitget statement is the next important development, but independent tracing will matter too. Security firms can follow whether the ETH remains in the recipient wallet, is moved through bridges, reaches exchange deposit addresses or enters recognised laundering routes.

That evidence will determine whether the story remains a suspicious sequence of wallet movements or becomes a confirmed exchange security incident. Until then, the $170 million figure should be treated as reported on-chain volume, not a final accounting of losses.

This article is provided for informational purposes only and does not constitute financial or investment advice. Wallet labels and on-chain estimates can change as new information emerges.

The post Bitget Wallets Flagged in Suspected $170M Security Breach appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-wallets-flagged-in-suspected-170m-security-breach/

The post Bitget Breach: North Korea Link Probed, Withdrawals Paused appeared first on Coindoo.

Coindoo first covered the unusual wallet movements in its earlier report, when funds from Bitget-linked wallets were moving to a fresh address and being swapped on-chain. Bitget has since confirmed that the transfers were unauthorised.

How the Bitget Story Changed Overnight

The two dollar figures should not be read as competing estimates of the same thing. The $170 million number came from the initial visible on-chain flow. Bitget’s later $351.6 million figure is its internal estimate of the assets affected by the breach.

Bitget has not published a wallet-by-wallet reconciliation explaining the difference. What is clear is that the first alert captured only part of a wider incident that the exchange later confirmed from inside its own systems.

The North Korea Clue Is Not a Final Attribution

During a live security update, Bitget CEO Gracy Chen said some IP addresses associated with the attack matched VPN-use patterns linked to a North Korean hacker organisation. She also said the activity resembled previous attacks associated with North Korean operators, according to ChainCatcher’s report.

That is a preliminary lead, not a completed attribution. Bitget has not named a group or released the forensic evidence behind the assessment. The company’s current position is that North Korean involvement cannot be ruled out while investigators continue to trace the intrusion.

The Attack Did Not Require a Stolen Private Key

Bitget’s explanation changes the technical question around the breach.

In a September 25 update, Chen said the attacker compromised a critical backend system within the exchange’s wallet infrastructure. Bitget says the system was then used to create spoofed transfer data that reached its authorisation process and moved funds out.

Here is what we can confirm at this stage:

On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC

— Gracy Chen @Bitget (@GracyBitget) September 25, 2026

The exchange says a private-key leak has been ruled out. It also says it has contained the incident and that no further unauthorised transfers are possible.

That does not make the breach less serious. It shifts the focus from key custody to the systems around it. If Bitget’s account is confirmed, the attacker did not need to possess a wallet key; it needed access to infrastructure capable of producing transfer information that the approval process accepted.

The full incident report therefore matters more than the early North Korea clue. It needs to explain how manipulated data entered the authorisation flow, what controls failed to stop it and what has changed before withdrawals resume.

A Protection Fund Can Cover Losses, Not Restore Access

Bitget says its cold wallets were not affected and that the $351.6 million loss falls within the coverage of its User Protection Fund, which it says holds more than $464 million. The exchange also says customer account balances remain accurate.

This is the practical distinction for users. The protection fund addresses whether Bitget says it can absorb the financial loss. It does not, by itself, restore confidence that the wallet systems are ready for normal withdrawals.

Deposits and trading remain available, according to Bitget’s official security notice. Withdrawals remain suspended while the exchange works on remediation and security hardening. Chen said Bitget would announce a restart schedule only once it can give a confirmed timeframe.

The Remaining Question Is Inside Bitget’s Systems

The initial $170 million alert asked whether the suspicious wallet movements were real. Bitget has now answered that part: it says the transfers were unauthorised and the total exposure was far higher.

The harder question remains. If private keys were not stolen, how did a compromised backend system generate transfer data that Bitget’s authorisation process accepted?

That answer—not another revised loss estimate—will show whether the exchange has addressed the weakness that allowed the breach in the first place.

This article is provided for informational purposes only and does not constitute financial or investment advice. Attribution and technical findings can change as Bitget and independent investigators release further evidence.

The post Bitget Breach: North Korea Link Probed, Withdrawals Paused appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-breach-north-korea-link-probed-withdrawals-paused/

The post Binance Iran Scrutiny Tests Its Post-Settlement Controls appeared first on Coindoo.

The question is what Binance knew

US federal prosecutors are investigating whether Binance violated sanctions against Iran by failing to prevent certain trading activity, according to a Reuters report citing Bloomberg.

The Manhattan US Attorney’s Office is reportedly leading the inquiry, with the Justice Department’s criminal division also involved. Prosecutors are said to be examining whether Binance knowingly allowed the trading.

That is a higher threshold than establishing that Iran-linked funds reached the exchange. Investigators would need to determine what information Binance possessed, whether its systems generated warnings and how the company responded.

The Justice Department declined to comment to Reuters, while the Manhattan US Attorney’s Office could not immediately be reached. The report relies on unnamed sources, and no public charging document has been filed.

Binance made specific compliance promises in 2023

Binance pleaded guilty in November 2023 to violating the Bank Secrecy Act, failing to register as a money-transmitting business and breaching the International Emergency Economic Powers Act.

Under its Justice Department resolution, the exchange agreed to approximately $4.32 billion in forfeiture and penalties. It was also required to strengthen its anti-money-laundering and sanctions systems and retain an independent compliance monitor for three years.

A separate Treasury Department settlement imposed a five-year monitorship. The monitor received access to Binance’s books, records and systems and must report its findings to FinCEN, the Office of Foreign Assets Control and the Commodity Futures Trading Commission.

The earlier case already involved Iran. US authorities said Binance intentionally failed to stop its American customers from trading with users in sanctioned jurisdictions. Between January 2018 and May 2022, the exchange caused more than $898 million in trades between US users and people ordinarily resident in Iran, according to the Justice Department.

The latest scrutiny therefore matters most if it concerns conduct after the settlement. The issue would no longer be whether Binance once had inadequate controls—it admitted that. The issue would be whether the replacement controls performed differently.

No compliance program can guarantee that illicit funds will never reach a platform. Its effectiveness depends on whether suspicious activity is detected, investigated and stopped within a reasonable period.

The $61 million forfeiture case is relevant—but proves less than it may appear

The reported investigation emerged days after Manhattan prosecutors filed a separate civil action seeking approximately $61 million in cryptocurrency allegedly derived from black-market Iranian oil sales.

The Justice Department’s complaint alleges that two Hong Kong companies, Blessed Trust and Hexa Whale, used Binance accounts to move proceeds from Iranian oil transactions.

Prosecutors connected the companies to a group of crypto addresses that allegedly received and distributed more than $1.5 billion. Some funds were reportedly routed to businesses and addresses associated with Iran’s Islamic Revolutionary Guard Corps.

The complaint concerns activity extending through 2024 and 2025, after the Binance settlement. However, it seeks forfeiture of the assets and does not charge Binance with laundering the money.

The two developments may be connected, but no public source has established that the forfeiture complaint is the basis of the reported Binance inquiry. Treating them as one confirmed case would go beyond the available evidence.

An Iranian connection is only the first step

Several separate facts would need to be established before activity on Binance could become evidence of knowing corporate misconduct.

Iran is subject to broad US restrictions, but nationality, residency and inclusion on an OFAC sanctions list are not interchangeable. The legal analysis can depend on who controlled the account, the underlying transaction, the counterparties involved and whether the activity touched the US financial system.

Binance says it investigates and removes prohibited users

Binance told Reuters that it follows a zero-tolerance approach to sanctions violations, cooperates with law enforcement and works to remove bad actors.

The company has separately denied that it reduced cooperation with US crypto investigations, making its handling of alerts and law-enforcement requests part of the wider dispute.

Binance offered a similar defense after Reuters traced at least $676 million from addresses associated with the Dubai-based exchange Shelbit to its platform. The company said Shelbit itself did not hold a Binance account and had not been sanctioned. According to Binance, its compliance team investigated related users, froze their accounts and reported them to law enforcement.

READ MORE:

How Robinhood Chain’s 10M Daily Transactions Boost Arbitrum

The response describes what a working control system should eventually do. It leaves several questions unanswered:

The timeline will decide what this story becomes

The reported inquiry could end without charges, produce another enforcement action or lead to findings from Binance’s monitors. Until authorities disclose more, it cannot be treated as proof that the company breached its settlement obligations.

The most important evidence would show when Binance learned about the relevant customers and what happened next. A prompt investigation, account freeze and report to authorities could indicate that the post-settlement controls worked. Continued trading after clear internal warnings would suggest that the changes failed at the point where they mattered.

The presence of Iran-linked funds on Binance is therefore not the conclusion of the story. The decisive question is whether the exchange’s compliance machinery recognized the risk, and whether anyone chose to ignore it.

This article is provided for informational purposes only. A reported investigation does not establish wrongdoing, and allegations in civil complaints remain unproven unless established in court.

The post Binance Iran Scrutiny Tests Its Post-Settlement Controls appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/binance-iran-scrutiny-tests-its-post-settlement-controls/

The post One Attacker, Multiple Tokens: Inside the Fetch.ai Breach appeared first on Coindoo.

Fetch.ai’s update changes the scope of the incident

Initial reports focused on approximately 8.7 million FET, worth around $1.5 million, removed from Fetch.ai’s TokenConversionManagerV3 contract on Ethereum.

Blockaid said the attacker presented a valid conversion-authorizer signature, allowing the contract to release its remaining FET balance. Fetch.ai has since published a preliminary onchain analysis tracing the attack path to a leaked signing key.

An on-chain analysis of the exploit is now available on ASI:One. It traces the attack from the compromised signing key to the attacker’s cash-out wallets. This is not the final analysis.

Read the report: https://t.co/W95r50VMaY

Together with @SingularityNET, we have deactivated…

— Fetch.ai (@Fetch_ai) September 20, 2026

The project said it worked with SingularityNET to deactivate the affected wallets and contracts. It also cautioned that the analysis is preliminary and that the investigation remains open.

The same wallet that received the FET was later linked to approximately 409 million NTX created through a NuNet deployer account. The tokens were valued near $460,000 when issued.

The incident widened again when PeckShield reported that the wallet was also connected to unauthorized mints of approximately 260 million AGIX and 54 million WMTX. The attacker’s holdings were valued near $17 million when the security firm’s findings were reported.

The shared wallet is why researchers have attributed the transactions to the same attacker. It does not yet show whether one leaked key provided access to every affected contract or whether several credentials were compromised.

The dollar totals hide two different kinds of damage

The FET and NTX incidents did not affect holders in the same way.

The FET transaction removed tokens that already existed. That created a known loss and gave the attacker assets that could be sold, but it did not directly increase the total number of FET tokens.

The reported NTX transaction reached the token’s issuance process. Instead of transferring a balance from one wallet to another, the deployer account apparently created tokens outside the expected distribution schedule.

CoinGecko lists a maximum supply of one billion NTX. The reported unauthorized mint was therefore equal to roughly 41% of that amount.

That does not mean every unauthorized token entered circulation. Data providers may also exclude tokens that NuNet later invalidates, burns or replaces through a contract migration. The comparison shows why traders could no longer rely on the displayed supply figure without further clarification from the project.

The later AGIX and WMTX findings make this distinction more important. The central question is no longer how much was removed from one contract, but how widely the compromised permissions could be used to create or release assets.

Why NTX fell much harder than FET

NTX fell roughly 70% after the incident became public and reached a new all-time low on September 20. FET declined by a much smaller percentage while the wider crypto market was also trading lower.

The timing and scale of the unauthorized mint provide a plausible explanation for the difference, although they do not prove that the incident caused every part of the NTX decline.

The reported mint was large relative to supply

Creating an amount equal to approximately 41% of the stated maximum supply introduced immediate dilution concerns. Traders also had no clear information about how many of the tokens could reach exchanges or decentralized liquidity pools.

NTX trades in a thin market

CoinGecko showed less than $50,000 in rolling 24-hour NTX volume when checked. The unauthorized tokens had been valued near $460,000 when created, making the reported mint roughly ten times larger than the token’s recent daily turnover.

The comparison does not measure how much the attacker sold. It illustrates the available market depth: attempting to sell even a fraction of such a position could move the price sharply when relatively few buyers are waiting nearby.

The market could not immediately verify that minting had stopped

A stolen balance has a measurable limit. An exposed minting permission creates a more open-ended risk because holders need evidence that the authority has been revoked before they can rule out further issuance.

A valid signature can still authorize an attack

A smart contract can verify that a signature came from an approved key, but it cannot determine whether the legitimate owner intended the transaction. Once the signing key was compromised, the attacker’s instruction could appear valid to the contract.

This is why describing the incident only as a smart-contract exploit would be incomplete. The code controlling the withdrawal and the security of the key authorizing it formed one system. A failure in either part could expose the assets.

SlowMist noted that Fetch.ai’s incoming conversion function relied on a single externally owned account signature and lacked some of the additional restrictions present in another conversion function. Fetch.ai’s final report will need to establish how that design interacted with the leaked key.

Blockchain transparency helps researchers follow the resulting transactions, but it does not prevent an approved credential from being misused. A similar limitation appeared in Polymarket’s reported $10 million fraud attempt: public records can expose what happened after an instruction was accepted, while the harder security problem is deciding who should have been permitted to issue it.

READ MORE:

Ethereum Jumps Above $2,600, Reaches Highest Price Since January

Deactivating the contracts contains the risk, but does not resolve it

Fetch.ai’s decision to deactivate affected wallets and contracts is an important containment step. Holders still need a final account of which permissions were exposed and how the affected tokens will be handled.

The permissions now matter more than the first loss estimate

The incident was initially described as an attack involving approximately $2 million. The later findings make that figure a poor measure of its potential reach.

The more important boundary is the authority the leaked credentials provided. Fetch.ai and the connected projects will need to show that the affected permissions have been removed and that unauthorized tokens cannot continue moving through recognized contracts.

Until that evidence is available, token prices will reflect more than the assets already taken. They will also carry uncertainty over which supply figures and contract permissions the market can still trust.

This article is provided for informational purposes only and does not constitute financial or investment advice. The investigation remains ongoing, and the reported figures may change as the affected projects and security researchers publish additional findings.

The post One Attacker, Multiple Tokens: Inside the Fetch.ai Breach appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/one-attacker-multiple-tokens-inside-the-fetch-ai-breach/

The post US Plans BTC-e Notices for 300,000 Email Addresses appeared first on Coindoo.

The case has moved slowly since the 2017 seizure

BTC-e was taken offline in 2017 as US authorities pursued the exchange and people connected to its operation. The current civil forfeiture case concerns assets the government alleges were held in BTC-e operating wallets and connected to unlawful activity.

The additional emails are intended for addresses associated with accounts that showed positive balances when the servers were seized. The order does not say that every address remains active, belongs to a different person or corresponds to a valid claim.

The 300,000 figure measures notice, not ownership

The government’s list comes from BTC-e account records. It therefore measures the number of email addresses selected for outreach—not the number of verified customers, successful claimants or eventual recoveries.

One person may have controlled more than one account, some addresses may now be inactive and some records may not contain enough information to connect an account to its former owner. Other recipients may decide that the value involved does not justify entering a federal forfeiture proceeding.

The court also granted late-claim requests submitted by several specifically identified parties after the government withdrew its opposition. That ruling applies to those requests; it is not a general extension for every former BTC-e customer.

The government is trying to prevent a notice challenge

Judge Nichols declined to stop the additional notice round because Supplemental Rule G requires the government to make a reasonable effort to contact people who may claim an interest in property targeted for forfeiture.

That requirement affects more than former users. If the notice process is later found inadequate, a settlement or final judgment could face a challenge from someone who was entitled to notice but did not receive it. Sending emails to the wider account list reduces that risk before the court resolves ownership of the assets.

This is forfeiture, not a bankruptcy payout

BTC-e’s former customers are not automatically creditors waiting for an estate administrator to distribute funds. In a civil forfeiture case, the government asks the court to transfer specified property to the United States. A former user seeking part of that property generally must assert a legal interest and support it with evidence.

That means an old account balance is useful evidence, but it does not reserve a corresponding amount of cryptocurrency for its former owner. The court must still consider whether the person has standing, whether the documentation is credible and whether the claimed interest can be connected to the property in the case.

Recipients face two separate response routes

These are separate procedures, and filing one may not preserve rights under the other. Anyone who receives a notice should follow the dates and instructions in that document rather than relying solely on general deadline summaries.

A positive balance does not establish a claim by itself

FinCEN said in 2017 that BTC-e often collected little customer information beyond a username, password and email address. That history may make it harder to match some accounts with real-world identities nearly a decade later.

The forfeiture complaint concerns assets allegedly held in BTC-e’s operating wallets rather than property already separated into customer-specific accounts. Former users asserting legitimate balances may therefore need records such as account statements, deposit and withdrawal histories, transaction hashes, archived emails or proof that they controlled the relevant funding address.

The government’s allegations against BTC-e do not mean every customer participated in illegal activity. They do mean that a database entry alone may not answer who owns the seized property.

READ MORE:

CLARITY Vote and Fed Decision: Crypto Scenarios to Watch

Unexpected BTC-e emails should be verified carefully

A mass notice concerning old cryptocurrency balances is likely to attract impersonation attempts. Before opening attachments, submitting documents or following payment instructions, recipients should:

Neither a verified claim nor a remission petition requires someone to surrender the credentials controlling a cryptocurrency wallet.

Monthly reports should show how the notice round develops

The court ordered the government to file an initial progress report by September 15 and another report every 30 days until the additional notice process is complete. The contents of the first report were not available in the public sources reviewed for this article.

Those filings should provide the next measurable update: whether the emails have been sent, how quickly the government is working through the list and whether the expanded outreach brings more claims into the case.

Until those claims are reviewed, 300,000 describes the reach of the proposed notice, not the likely number of recoveries. The monthly filings will indicate whether the wider effort produces additional ownership claims or extends an already lengthy proceeding.

This article is provided for informational purposes only and does not constitute legal or financial advice. Deadlines and filing requirements may depend on the notice received and the circumstances of an individual claim.

The post US Plans BTC-e Notices for 300,000 Email Addresses appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/us-plans-btc-e-notices-for-300000-email-addresses/

The post Revolut Exposes Bitcoin Activity in Fake Request Incident appeared first on Coindoo.

Key Takeaways

The problem began with a fake legal request

CoinDesk reported that Revolut notified affected users after responding to an emergency government request it later determined was fraudulent when it contacted the relevant authority. The reported disclosure included personal and Bitcoin-related records.

The incident was not described as an attacker taking over a wallet or breaking into a customer account. Instead, the failure appears to have occurred while Revolut was verifying a request for customer data. That makes it different from a typical exchange hack: sensitive information may be released without an attacker first defeating a user’s password or two-factor authentication.

The notice was shared publicly on X. Revolut had not published a wider public statement or disclosed the number of affected accounts at the time of writing, so the incident’s scale remains unclear.

Revolut customers were targeted in a fraudulent emergency data request sent via an email at a “government agency.” https://t.co/sS2sbwAt8r

— Mark Karpelès (@MagicalTux) September 12, 2026

Why Bitcoin records raise the stakes

CoinDesk reported that the material included identity documents, account information, withdrawal records and Bitcoin-related transaction history. The customer notice did not indicate that private keys, seed phrases or direct access to customer funds had been exposed.

Blockchain records do not contain passport details. The risk begins when a regulated platform’s records connect transactions to a verified identity. If reported wallet references, withdrawal details or transaction identifiers can be matched with public blockchain activity, that link may remain useful to attackers after an account password is changed.

Safe funds do not end the risk

This was not a custody breach in the usual sense. But a detailed identity-and-activity profile can support months of fraudulent contact. An attacker who knows a person used Bitcoin, has their contact information and can cite a genuine withdrawal has a far more credible basis for a fake support or compliance message.

That is the same risk identified after the Bits of Gold customer-data breach: even when assets and private keys remain inaccessible, identity and wallet-related records can make impersonation attempts much more convincing.

A scammer does not need a seed phrase to exploit this information. They may instead ask for a one-time code, claim a wallet must be moved to a “secure” address, or direct a victim to a clone of a legitimate support page. The useful response is caution, not a rushed transfer.

Not every Bitcoin record identifies a public wallet

Revolut says it maintains an internal ledger for customer crypto exposure. For that reason, the reported Bitcoin transaction history may refer to activity recorded inside Revolut rather than a complete list of public blockchain addresses.

The distinction matters. Revolut should clarify whether the data included external wallet addresses, transaction identifiers, destination information or only internal account history. These create very different levels of exposure and would determine how easily an attacker could connect a customer’s real identity to visible on-chain activity.

The available evidence supports a narrower conclusion: no private-key leak has been reported, but the stated combination of identity documents and crypto-related records creates a distinct security concern.

READ MORE:

EU Crypto Wallet Makers Now Have 24 Hours to Report Exploits

What Revolut users can do now

Users who received a Revolut notification should confirm it through the app’s support channel or by visiting Revolut directly, rather than following links in an email or social-media post. They should ask which exact data fields were disclosed and retain a copy of the response.

Revolut users who have not received a notice do not need to move assets or assume their data was exposed. They should watch for an in-app message or a notification sent through Revolut’s verified channels, review the security of their recovery email and phone number, and be especially cautious of unsolicited messages that mention crypto withdrawals or ask them to “secure” a wallet. Changing a password can protect account access, but it does not undo an identity-data disclosure, so the priority is to prevent impersonation rather than make rushed transfers.

Anyone concerned that identity-document data may be involved should treat unsolicited account-recovery, compliance and wallet-verification messages as high risk. No legitimate agent needs a seed phrase, password or one-time authentication code. The European Data Protection Board lists fraud, identity theft and financial loss among the possible consequences of personal-data breaches.

The next answer needs to be about linkability

Revolut now needs to explain whether the disclosed records included external wallet addresses, transaction identifiers or only internal account history. That distinction will determine whether affected customers face a conventional identity-fraud problem or a more durable link between their real identity and publicly traceable Bitcoin activity.

This article is for informational purposes only and does not constitute legal, financial or cybersecurity advice.

The post Revolut Exposes Bitcoin Activity in Fake Request Incident appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/revolut-exposes-bitcoin-activity-fake-request-incident/

The post Mexico Raids Cartel-Linked Crypto Farm Over Power Theft appeared first on Coindoo.

Authorities are investigating an alleged power-theft operation

Authorities in Puebla dismantled a cryptocurrency facility near the Nuevo Necaxa hydroelectric system in the Sierra Norte region. Reuters reported that the site contained around 300 graphics processing units, medium-voltage equipment and satellite antennas.

Authorities are investigating whether the site was connected illegally to nearby power infrastructure. If confirmed, stolen electricity would lower the cost of running the machines, allowing the operator to retain mining rewards without paying what is usually one of the largest recurring expenses.

Mining cryptocurrency is not prohibited in Mexico by itself. According to the authorities cited by Reuters and El País, the investigation centres on suspected power theft. Reuters also reported that officials are examining possible organised-crime and laundering links, while Mexico’s federal prosecutor declined to comment because the case is active.

The equipment list does not prove Bitcoin was mined

A machine seizure establishes capacity, not financial output. The published list does not show which asset was mined, how much was produced or who received any proceeds.

That gap matters in this case because the equipment described was GPU-based. GPUs can support different crypto and computing workloads. Bitcoin mining, by contrast, has long been dominated by specialised ASIC machines, which displaced GPU mining because they are far more efficient at Bitcoin’s SHA-256 calculations, according to the Cambridge Centre for Alternative Finance.

The GPU list therefore cannot establish that the facility was producing Bitcoin rather than another asset or running another type of high-intensity computing. Reuters reported that this was the fourth crypto farm found near the dam since early 2025, which gives authorities reason to investigate the area’s power infrastructure. It does not establish common ownership or a single criminal network.

Mining does not by itself establish a laundering trail

If the site was mining, stolen electricity may have reduced the cost of generating crypto rewards. That economic incentive helps explain why authorities examine alleged illegal mining operations, but it does not show that the Puebla site produced or laundered criminal proceeds.

A solo miner receives a reward through the blockchain’s block-reward transaction—unrelated to the Coinbase exchange. A miner using a pool receives payouts based on its share of computing work. Identifying either an address or a pool account would allow investigators to examine later transfers and seek records from exchanges if funds were sent there.

Attribution is the difficult part. A transaction does not reveal its owner on its own, and intermediary wallets or pooled payouts can obscure the route. Once investigators identify a relevant address, however, each subsequent transfer can provide additional transaction history. The difference matters when authorities assess whether crypto was simply the alleged output of stolen power or part of a wider laundering route.

The same problem appears in the analysis of illicit funds that remain traceable onchain: moving crypto between wallets does not necessarily remove the record investigators can analyse.

READ MORE:

BNB Chain Surpasses Solana With $3.6B RWA Growth

Power theft is often the first operational clue

A legal mining business must cover electricity, equipment, cooling, maintenance and the changing difficulty of mining. An operator that allegedly bypasses the grid still has equipment and upkeep costs, but may avoid one of the largest expenses.

Remote sites can reduce visibility, but the Puebla operation still drew attention through unusual electricity use and mechanical noise, Reuters reported. Meter anomalies, transformer records, equipment purchases, satellite-internet accounts and property access can help establish who ran a site before investigators identify any wallet.

Similar raids point to an energy-theft model

Puebla is not an isolated example of alleged power theft involving crypto equipment, although the available cases do not establish a shared criminal network. In recent mining raids in Malaysia, the focus was likewise on suspected unauthorised connections to the power grid rather than the act of mining itself.

The common incentive is simple: shifting the cost of electricity onto a utility or public grid can change an operation’s economics. The crypto element then becomes a separate financial question, what asset was generated, who controlled it and how it was moved.

What evidence would connect the raid to a wider financial network?

The next disclosures matter more than the number of seized machines. Ownership documents could link the equipment to an operator. Mining-pool records or wallet addresses could identify output, while exchange deposits, cash-out activity or transfers connected to known criminal entities could show whether that output entered a broader financial network.

The raid may show how the alleged operation was financed day to day: through an attempt to avoid electricity costs. Wallet, pool and cash-out records would show whether the resulting crypto became part of a provable cartel-finance or laundering chain.

This article is provided for informational purposes only and does not constitute legal, financial or investment advice.

The post Mexico Raids Cartel-Linked Crypto Farm Over Power Theft appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/mexico-raids-cartel-linked-crypto-farm-over-power-theft/

The post EU Crypto Wallet Makers Now Have 24 Hours to Report Exploits appeared first on Coindoo.

Key Takeaways

The 24-hour reporting rule starts before the wider CRA

From September 11, manufacturers must report actively exploited vulnerabilities and severe security incidents affecting products with digital elements made available on the EU market. The report is submitted through the Single Reporting Platform operated by ENISA to the CSIRT in the Member State of the manufacturer’s main establishment and, in normal circumstances, to ENISA.

Most of the EU Cyber Resilience Act (CRA) applies from December 11, 2027, including its wider requirements around product design, documentation and conformity. Article 14, the provision covering exploited vulnerabilities and severe incidents, starts earlier.

That means a wallet company may not yet face the full CRA compliance regime, but it can already have a statutory deadline if an exploit is active. The requirement also applies to in-scope products made available in the EU before December 2027, not only to future devices and software releases.

Hardware and software wallets may be covered

The CRA applies to hardware and software products made available commercially in the EU when their intended or reasonably foreseeable use includes a direct or indirect logical or physical connection to a device or network. Commercial hardware wallets and desktop or mobile wallet applications could therefore fall within scope.

The legal obligation sits with the manufacturer: the person or company that develops a product, or has it developed, and markets it under its own name or trademark. A business selling a hardware device or distributing wallet software in the EU is a clearer example than an individual contributor to an unrelated open-source project.

Because crypto wallets are not named in the CRA, a specific product’s status may still require a legal assessment.

What wallet makers must report in 24 hours

The first submission is an early warning, not a completed technical investigation. When a manufacturer becomes aware of an actively exploited vulnerability, it must notify the authorities without undue delay and no later than 24 hours later. The early warning must indicate the Member States where the company knows the affected product has been made available, where applicable.

The same deadline applies to a severe incident affecting product security. In that case, the early warning must at least state whether the company suspects unlawful or malicious activity caused the incident, as well as the relevant markets where the product is available.

More detail is due within 72 hours. The European Commission’s reporting guidance says this notification must include available information about the product and the general nature of the exploit and vulnerability.

It must also cover corrective or mitigating measures already taken, steps users can take, and, where applicable, how sensitive the manufacturer considers the information to be.

Active exploitation is the key legal trigger

The 24-hour clock does not start whenever a researcher privately reports a bug. It applies when a manufacturer becomes aware of an actively exploited vulnerability, meaning the flaw is being used against the product, or of a severe incident affecting product security. A company can receive a report, investigate it and prepare a patch without automatically falling into the Article 14 deadline. Once it learns that attackers are exploiting the flaw before the fix is complete, the regulated reporting process begins.

Recent Coldcard coverage shows why this threshold matters. In a July warning involving potentially weak seed generation, the practical risk was not limited to identifying the flaw: affected users needed to determine whether their seed was exposed and move funds if necessary.

The report goes to authorities, not automatically to the public

A fast reporting deadline may sound like a requirement to reveal an unpatched wallet flaw immediately. That is not what the CRA says. The initial report goes to the relevant CSIRT and ENISA through the Single Reporting Platform; it is not an automatic public advisory or a mandatory blog post containing technical exploit details.

The regulation requires authorities and other parties involved in its application to protect confidential information, including source code, trade secrets and information that could undermine an investigation. In cases involving coordinated vulnerability disclosure, a CSIRT can delay dissemination of an exploited-vulnerability notification to other CSIRTs where justified cybersecurity grounds exist.

Public disclosure remains possible when it is needed to prevent or mitigate a severe incident, handle an ongoing incident or serve the public interest. A CSIRT may then inform the public or require the manufacturer to do so after consulting the company. Wallet makers must give authorities enough information to assess the risk while telling users how to protect themselves without disclosing details that could aid an attacker.

READ MORE:

Ripple Adds Governed AI to Its $1B Treasury Bet

Open-source wallets are not automatically exempt

The CRA does not apply to free and open-source software that is not made available on the market in the course of commercial activity. It also does not apply to people who merely contribute code to open-source software that is not under their responsibility.

That is not a blanket exemption for open-source wallet projects. The Commission’s open-source guidance states that a manufacturer placing a free and open-source product on the market remains subject to manufacturer obligations. A product being free does not necessarily mean its supply is non-commercial.

The CRA also creates a separate category for open-source software stewards: legal entities that provide sustained support for a specific open-source product intended for commercial activity. They are not subject to CRA administrative fines, but Article 14 can still require reporting when they are involved in the product’s development or when severe incidents affect the development systems they provide.

A patch may still leave wallet users exposed

For crypto wallets, the end of a technical incident is not always the moment a security update becomes available. An update can prevent new exposure while leaving keys, seed phrases or wallet setups created under affected software at risk.

That distinction was clear when Coldcard released a security update for an earlier seed-generation issue. Updating the device did not make previously generated affected seeds safe; holders still needed to create fresh keys and move their funds. Under the new CRA rule, that operational response may now run alongside a mandatory authority notification when active exploitation is identified.

Wallet makers now need a documented 24-hour process for deciding whether exploitation is active, notifying authorities, preparing mitigation and warning affected users. The next exploit will show whether firms can meet that legal deadline while the incident is still being investigated and a full remediation plan may not yet exist.

The post EU Crypto Wallet Makers Now Have 24 Hours to Report Exploits appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/eu-crypto-wallet-makers-now-report-exploits/

The post Bit2Me Builds a Crypto-Seizure Unit for Police and Courts appeared first on Coindoo.

Key Takeaways

Bit2Shield connects police operations to asset recovery

Bit2Shield is the trading name of CryptoShield S.L., a separate company within Bit2Me Group. Spain’s official commercial register shows that it began operating on July 23, 2026. Its registered activities include technological investigations, forensic analysis, expert reports, operational support and blockchain intelligence.

CryptoShield’s sole shareholder and administrator is Devteam S.L., which Bit2Me identifies among the companies in its corporate group. Bitcoinforme S.L., a separate entity in the same group, operates Bit2Me’s regulated exchange services.

Bit2Me says Bit2Shield will serve police, courts, public bodies and financial institutions. Its work will extend from the initial investigation to the eventual transfer of sale proceeds.

Bit2Shield is a private service provider, not an enforcement authority. It can assist with a seizure or liquidation only under instructions from the police, a court or another competent body.

Its investigations division will be led by Adrián Maroño, a former member of the Spanish Civil Guard’s Central Operational Unit, according to a statement Bit2Me shared with CoinDesk.

The €1.5 million figure needs context

Bit2Me says it processed approximately €1.5 million in seized cryptocurrency during 2025 while working on matters involving Europol, Interpol and Spanish police. According to the company, Chainalysis was used to trace the assets before their conversion into euros for the state.

The figure shows that the group performed seizure-related work before CryptoShield was formally established. It does not reveal the number of cases, the assets involved or whether €1.5 million represents their value when seized, transferred into custody or sold.

Bit2Me describes work on matters involving Europol and Interpol, but it has not published an agency statement or agreement establishing a formal partnership with Bit2Shield.

What seizing cryptocurrency actually involves

The first difficult step in the workflow is obtaining effective control of the cryptocurrency. The assets cannot be physically removed from a blockchain; authorities must instead prevent the previous controller from moving them.

With a self-custodied wallet, investigators may need to secure a hardware wallet, private key, recovery phrase, passphrase or another signing device. Finding one item does not guarantee access. A wallet may require an additional passphrase or several signatures, while a recovered phrase may control addresses that have not yet been identified.

This distinction has become more important as criminal groups reportedly use private vaults to store crypto credentials. The coins remain recorded onchain; the physical item provides a way to authorize transactions. Investigators must still determine which addresses the recovered credentials control and whether another password, device or signature is required.

If the cryptocurrency is held by an exchange or another custodian, authorities may instead serve a lawful freezing or transfer order on that provider. United Nations guidance notes that seized virtual assets may be transferred to a secure wallet controlled by a court, law-enforcement body, asset-management office or appointed private company.

Bit2Shield may participate at several stages, but each has a different legal purpose. Tracing identifies the assets, freezing or seizure prevents them from being moved, confiscation permanently removes them through a legal decision, and disposal determines whether they are sold, retained or returned to victims.

Blockchain records are only part of the evidence

A blockchain can show that a transaction occurred, but an address does not contain the legal name of its controller. A court-ready case therefore needs evidence connecting the onchain activity to a person, account, device or organization.

Exact requirements differ by jurisdiction, but a defensible chain-of-custody record should identify where the credentials were found, who handled them, which addresses they controlled and how the assets were transferred. Transaction hashes, timestamps and access records can preserve an audit trail after the initial seizure.

Bit2Shield says it will prepare digitally signed reports and can present its findings in court. A digital signature can establish that a report has not been altered since it was signed, but it does not prove that the underlying evidence was collected correctly. The company has not publicly detailed its evidence-retention policy, forensic standards or internal access logs.

READ MORE:

Cronos Halts Chain After $75M Tectonic Exploit

Multisignature storage reduces one-key risk

Bit2Shield plans to hold seized assets in multisignature cold storage. A multisignature wallet requires a specified number of keys to approve a transaction. In a two-of-three arrangement, for example, three keys exist but any two are needed to move the assets.

This can prevent one lost or compromised key from exposing the entire wallet. It can also divide approval between the service provider and the authority that ordered the seizure. If one organization controls enough keys to meet the threshold, however, it can still move the assets without an outside signer.

Bit2Me has not disclosed how many key shares Bit2Shield will create, who will hold them or whether a court or public authority will control at least one required signature. It has also not specified its recovery procedure, insurance coverage or liability if credentials are lost or misused.

Allegations involving the theft of $46 million from U.S. federal seizure wallets illustrate the risk created when contractors or employees receive excessive access to government-controlled assets. Moving keys offline reduces exposure to remote attacks, but it does not remove insider-access risk.

Authorities decide when seized crypto is sold

The competent authority, not Bit2Shield, will decide whether and when seized assets are sold.

That decision can materially affect the recovered amount because cryptocurrency prices may change between the initial seizure and the conclusion of a case. An early sale removes further price exposure but fixes the asset’s value at that point. Holding it preserves the possibility of appreciation while leaving the state or potential recipients exposed to losses.

Governments do not always follow the same approach. A proposed Arizona reserve funded with seized criminal assets, for example, would allow certain cryptocurrency to be retained rather than automatically converted into cash. The proposal shows that retention and liquidation are separate policy choices. Under Bit2Shield’s model, its role in a sale begins only after the competent authority orders one.

Bit2Me has not identified the trading venues, pricing benchmark, fees or slippage controls that would apply to a court-ordered sale. It has also not explained how Bit2Shield would handle a seized token without a liquid euro market.

Why the regulatory split matters

Bit2Shield says its investigative, forensic,, expert-report and training activities fall outside the scope of MiCA because CryptoShield S.L. is not operating as a crypto-asset service provider. When a case requires cryptocurrency cryptocurrency to be exchanged for euros, Bitcoinforme S.L. will conduct the conversion.

Bitcoinforme appears in the CNMV register of authorized crypto-asset service providers. That identifies the legal entity expected to perform the regulated exchange service rather than extending the same status automatically to CryptoShield.

The announcement does not identify which legal entity will act as custodian while assets remain in multisignature storage. Contracts with public authorities will need to define who controls the wallets, which which company bears responsibility for the assets and what protections apply before liquidation.

What authorities should establish before using Bit2Shield

Before appointing Bit2Shield, a public institution would need clear answers to five operational operational questions:

Until those controls are publicly disclosed, outside observers cannot fully assess the custody and execution safeguards behind behind Bit2Shield’s services.

The post Bit2Me Builds a Crypto-Seizure Unit for Police and Courts appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bit2me-builds-crypto-seizure-unit-police-courts/