Find notable cyber news and cases, enriched with sources, timelines, and signals.

Large group of crypto thieves campaign expands across multiple victims

Campaign
First reported
Last updated
Happening score
H score 23
1 unique sources, 1 articles

Summary

Hide ▲

A multi-victim social-engineering campaign that compromised cryptocurrency accounts has now been tied to guilty pleas, underscoring the scale of the theft operation and the laundering network behind it. The operation ran from October 2023 to March 2025 and used access gained through social manipulation to move funds into attacker-controlled wallets. The case spans multiple participants, several U.S. states, and overseas involvement, showing a coordinated theft effort rather than an isolated fraud.

Related Happenings

Dubai Police international crypto scam-center crackdown

Law Enforcement
First: 30.04.2026 14:21 Last: 30.04.2026 14:21 Sources 1

About this happening: Authorities **arrested at least 276 suspects** and **shut down nine cryptocurrency investment fraud centers**, disrupting a cross-border fraud network tied to **pig-butchering sch...

DoJ/FBI/USSS crypto-fraud domain seizure and charges

Law Enforcement
First: 27.04.2026 18:00 Last: 27.04.2026 18:00 Sources 1

About this happening: **DoJ**, **FBI**, and **US Secret Service** investigators **seized 503 domains** linked to **fraudulent crypto platforms**, disrupting infrastructure used in a Cambodia-based scam...

Tyler Robert Buchanan guilty plea in Scattered Spider crypto-theft case

Law Enforcement
First: 20.04.2026 16:33 Last: 20.04.2026 16:33 Sources 1

About this happening: **Tyler Robert Buchanan** **pleaded guilty** in the **United States** in a **Scattered Spider** cybercrime case, increasing his criminal exposure for **wire fraud** and **aggravat...

Scattered Spider SMS phishing and SIM-swap crypto theft campaign

Campaign
First: 20.04.2026 16:33 Last: 20.04.2026 16:33 Sources 1

About this happening: The **Scattered Spider** campaign used **SMS phishing** and **SIM swap** attacks to steal employee credentials, hijack phone numbers, and take over email and **virtual currency wa...

Approval phishing crypto wallet fraud campaign

Campaign
First: 13.04.2026 11:00 Last: 13.04.2026 11:00 Sources 1

About this happening: **Approval phishing** fraud networks were identified at scale, with **more than 20,000 victims** and at least **$33m** in additional stolen crypto tied to the operation. The fraud...

Timeline

  1. 19.11.2025 14:13 2 articles · 6mo ago

    Large group of crypto thieves campaign expands across multiple victims

    Initial Disclosure

    The campaign began with **social engineering** used to gain access to victims' **cryptocurrency accounts** and move funds into attacker-controlled wallets. That initial access pattern ran from **October 2023** and set up the later laundering and wire-transfer layers.

    Show sources