Cryptohack Roundup: Trezor's Phishing Warning

Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, Trezor warns customers after email provider breach, Liquid pauses network after $320 million Bitcoin withdrawal, man pleads guilty in $245 million theft and India targets 15 crypto platforms over compliance failures.

See Also: Revolutionizing Cross-Border Transactions with Permissioned DeFi

Trezor Warns Customers After Email Provider Breach

Trezor said customers are being targeted with fake security emails after attackers breached the hardware wallet maker's third-party email provider. Phishing messages falsely claim that a flaw in Trezor devices could expose wallet recovery phrases.

The emails appear to come from Trezor's help address and urge users to respond to an alleged security problem involving a chip used in its wallets. Trezor said the warning is fake and told customers not to click any links.

The company has taken down the domain used in the campaign and is investigating how attackers gained access to its legitimate email system.

The incident follows a separate breach involving shipping provider ShipMonk, which exposed customer information. Trezor later said that breach affected 81,000 U.S. customers, along with some customers in several other countries.

Liquid Pauses Network After $320M Bitcoin Withdrawal

Liquid Network paused activity after self-described white-hat hackers withdrew 4,000 Bitcoin, worth roughly $320 million.

The amount represented 95% of Liquid's reported Bitcoin reserves before the incident. Liquid said the funds were withdrawn through a key used to approve Bitcoin transfers out of the network, but said the key itself was not compromised. The network has not explained the weakness that allowed the withdrawal.

A message attached to a Bitcoin transaction said the parties responsible were white-hat hackers. Blockstream, Liquid's technology provider, is trying to the hackers through a signed blockchain message.

Liquid temporarily disabled transaction-submitting bridge nodes and said exchanges had suspended deposits and withdrawals of LBTC, its Bitcoin-backed token. Other assets on the network were not affected, Liquid said.

Man Pleads Guilty in $245M Crypto Theft

A 22-year-old Singaporean man pleaded guilty in U.S. federal court to helping lead an international fraud operation that stole and moved more than $245 million worth of cryptocurrency.

Malone Lam, who lived in Miami, admitted to participating in a federal racketeering conspiracy, which involves organized criminal activity, the U.S. Attorney's Office in Washington said .

Prosecutors said Lam led a network that used social engineering to target victims. He identified victims and coordinated other members of the group.

Authorities first charged Lam and another defendant in 2024. Several people have since faced charges or sentences linked to the operation.

Prosecutors said the group spent stolen funds on expensive nightclub visits, luxury watches and handbags, high-end rental properties, and cars.

Lam faces a maximum prison sentence of 20 years. A status hearing is scheduled for Dec. 8.

India Targets 15 Crypto Platforms Over Compliance Failures

India's Financial Intelligence Unit issued non-compliance notices to 15 cryptocurrency platforms for operating in the country without meeting anti-money laundering requirements.

The agency also sought to block public access to their apps and websites. The platforms named include Weex, Blofin, Bitunix, DigiFinex, Toobit, XT.com, WOO X, Pionex, WhiteBIT and others.

India brought companies providing virtual digital asset services, including cryptocurrency platforms, under its anti-money laundering rules in March 2023. These businesses must register with the Financial Intelligence Unit, maintain records and report required information even if they have no physical presence in India.

Several major exchanges have previously changed their Indian operations to meet these requirements. Binance returned in 2024 after paying a penalty, while Bybit and Coinbase later restored or expanded services after registration.

The Financial Intelligence Unit also warned that cryptocurrency products and NFTs, or unique blockchain-based digital items, remain unregulated in India.

Blockchain & Cryptocurrency

Fraud Management & Cybercrime

-Generation Technologies & Secure Development

Senior Associate Editor, APAC, ISMG

Ramesh has more than 10 years of experience writing and editing stories on finance, enterprise and consumer technology, and diversity and inclusion. She has previously worked at formerly News Corp-owned TechCircle, business daily The Economic Times and The New Indian Express.