Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime
Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, Binance hackers laundered stolen funds through memecoins, U.S. authorities cut off MEXC Global, Bitcoin Core disclosed three security flaws, a Scottish prisoner sentenced for plotting a $2.7 million theft, Web3Auth protected $5.6 million from vulnerable Keplr wallets and a former FBI agent admitted stealing $2.47 million in cryptocurrency.
See Also: Revolutionizing Cross-Border Transactions with Permissioned DeFi
Binance Hackers Use Memecoins to Launder Stolen Funds; Firm CFO Exits
North Korean hackers behind the $6.43 billion Binance breach are using newly created memecoins and complex cryptocurrency transactions to conceal stolen funds.
Blockchain analysis firm Elliptic said that attackers converted approximately $124 million in stolen cryptocurrencies into bitcoin, in addition to the $1.48 billion in bitcoin taken during the Oct. 29 attack. The operation has involved thousands of wallets and transactions across multiple blockchains. Elliptic says little money has been converted into cash.
Elliptic also found that attackers created six disposable memecoins, cryptocurrencies typically built around internet jokes and trends, to disguise stolen funds.
Between Nov. 5 and Nov. 7, approximately $430,000 worth of Near tokens passed through these memecoins. The attackers used decentralized trading pools, which allow cryptocurrencies to be exchanged without traditional intermediaries, to separate wallets holding stolen assets from those receiving the proceeds. The tokens were subsequently abandoned.
Elliptic identified similar activity involving existing tokens on Solana and said the tactic had previously appeared in the 2025 Bybit hack. Although these transactions remain traceable, the additional steps can delay investigators.
The FBI has attributed the Binance attack to North Korea's TraderTraitor hacking group. Binance's incident report described a months-long operation involving a fake job interview, malicious developer software and compromised internal artificial intelligence tools (see: How North Korean Hackers Interviewed Their Way Into Binance).
Binance has replenished virtually all stolen customer assets and is gradually restoring withdrawals. Elliptic estimates that $2.85 billion in stolen assets has been frozen.
Binance Chief Financial Officer Kaiser Ng is stepping down after more than five years at the company, Bloomberg reported. Justin Yek, formerly vice president of finance at payments company Airwallex, will replace him.
Binance co-CEO Yi He said Ng was pursuing a new venture and that the company had planned the leadership transition over the preceding six months. No departure date was disclosed.
Gnosis Pay Data Breach Exposes Customer Information
Gnosis Pay disclosed a data breach that exposed customer information after attackers gained unauthorized access on Nov. 3 to an older system supporting its debit cards.
The company said it contained the breach within two hours, replaced compromised security credentials and fixed the weakness that allowed the intrusion. Customer funds were safe, while its separate business platform, which supports card services offered by other companies, was unaffected.
Gnosis Pay has made 3D Secure, an additional identity verification step for online card payments, mandatory until it retires the affected system on Dec. 20.
US Cuts Off MEXC Global Over Alleged $16B in Illicit Transactions
The U.S. Department of the Treasury cut off cryptocurrency exchange MEXC Global from the American financial system over allegations that it facilitated $16 billion in transactions linked to Iran, North Korea and Russia.
Treasury's Financial Crimes Enforcement Network issued an order identifying MEXC Global as a money laundering concern.
Officials said the exchange had serious weaknesses in its safeguards against illegal financial transactions, despite claiming to restrict users from sanctioned countries, including Iran and North Korea.
Treasury Secretary Scott Bessent said the action aimed to prevent Iran from using cryptocurrencies to bypass U.S. economic restrictions.
MEXC Global said that its operations were normal and customer assets were secure. CEO Vugar Usi acknowledged increased withdrawal activity but said deposits and withdrawals continued without disruption. Usi also said the exchange was taking FinCEN's concerns seriously.
Bitcoin Core Discloses 3 Security Flaws
Bitcoin Core disclosed three security vulnerabilities that could disrupt bitcoin mining, delay transaction processing and weaken network protections. Developers fixed all three flaws in October 2025 but publicly disclosed their details on Tuesday.
The most serious vulnerability, CVE-2025-62861, affected software versions 28.0 through 28.2 and 29.0 through 29.1. It could leave the mempool, where pending bitcoin transactions wait for confirmation, in an inconsistent state. Affected miners would need to restart their nodes before creating valid blocks of transactions, said the company’s security advisory.
A second flaw, CVE-2025-62859, allowed malicious network participants to delay block processing by up to 10 minutes under certain conditions. Attackers could potentially repeat the disruption, said Bitcoin Core's notification.
The third vulnerability, CVE-2025-62860, affected nodes using specific Tor network settings, potentially removing protections against service disruptions and weakening privacy safeguards. Bitcoin Core said thousands of publicly reachable nodes had configurations affected by the flaw in its security advisory.
Developers released fixes in Bitcoin Core versions 30.0 and 29.2 in October 2025. The final vulnerable version reached the end of its support period in October 2026.
Scottish Prisoner Jailed for Plotting $2.7M Cryptocurrency Theft
A Scottish court sentenced Robert Barr to eight years in prison for organizing an attempted 2 million pound - $2.7 million -cryptocurrency theft while serving a sentence for an earlier cryptocurrency fraud.
The High Court in Glasgow also sentenced his accomplices, Sean Favier and Iain Doyle, to four and five years in prison, respectively. All three pleaded guilty to involvement in serious organized crime.
Barr planned to have his accomplices enter a couple's home and force them to install AnyDesk, software that allows someone to control a computer remotely. He intended to use the connection to transfer cryptocurrency from the victims' digital wallets into accounts he controlled. The attempt failed in April 2024 when the couple spotted the accomplices through their doorbell camera and refused entry.
Investigators later uncovered messages detailing the plot on Barr's seized phone. The judge considered Barr's decision to organize the crime from prison an aggravating factor.
Web3Auth Secures $5.6M After Keplr Wallet Security Breach
Web3Auth, a cryptocurrency wallet login provider owned by Consensys, moved approximately $5.6 million from vulnerable Keplr wallets into recovery addresses following a security breach that exposed users' private keys.
The flaw affected some Keplr users who created wallets through Google or Apple sign-ins. Keplr co-founder Josh Lee estimated that about 20% of these accounts were vulnerable, although fewer appear to have been exploited.
Web3Auth transferred funds from exposed wallets before attackers could reach them. Some users initially mistook these protective transfers for theft, prompting the company to publish its recovery addresses.
The company has not disclosed how much cryptocurrency attackers stole before the recovery operation.
Keplr advised affected users to avoid depositing funds into existing accounts and transfer remaining assets to wallets secured by recovery phrases or hardware devices. Users who originally created wallets using those methods were unaffected.
Former FBI Agent Admits Stealing $2.47M
Former FBI agent Patrick Steven Yaroch has pleaded guilty to stealing approximately $2.47 million in cryptocurrency from wallets linked to FBI investigations.
Yaroch, 37, admitted to wire fraud and money laundering. He faces up to 20 years in prison for each charge, with sentencing scheduled for March 4, 2027, said the U.S. Department of Justice.
Beginning in December 2024, Yaroch accessed FBI databases, including classified systems, to obtain cryptocurrency wallet credentials. He made approximately 100 unauthorized transfers from at least 79 wallets connected to 35 investigations, show court documents.
He moved stolen funds through several cryptocurrencies, including bitcoin and monero, to conceal their origins before transferring money into personal accounts. Prosecutors said he used some proceeds to repay debts and finance a Lexus.
Investigators also uncovered plans to relocate to Portugal, including discussions with ChatGPT about purchasing property abroad.
Under his plea agreement, Yaroch must pay at least $2.4 million in compensation and surrender assets linked to the thefts.
