Crypto news

Another week brought a whole range of incidents—from the dismantling of a fraudulent network in Ukraine to the pioneering use of blockchain in the arsenal of extortionists. I break down the key events shaping the threat landscape in the crypto industry and beyond.

Ukrainian cyber police neutralized the network of fake exchange offices Money 24/7

Ukrainian law enforcement disrupted the activities of an organized group that, under the guise of a legitimate exchange point, deceived clients over an extended period. The scheme was built on creating a convincing "storefront": high-quality websites, an active Telegram channel, a registered trademark, and even an office with a cash register. Clients who submitted online applications to purchase cryptocurrency were invited to the office, where they handed over cash but never received the digital assets.

To delay victims from contacting the police, the perpetrators used psychological tactics: partial payouts and "written guarantees." During more than 20 searches across seven regions of the country, over 20 million hryvnias in cash, computer equipment, and documentation were seized. In one confirmed episode, the damage amounted to nearly 1.6 million hryvnias. The organizer faces up to 12 years in prison with asset confiscation. This is a telling example of how classic offline scams adapt to the crypto market, leveraging trust in "physical" presence.

FBI warns of a wave of attacks on intimate photos and data of athletes

The Bureau and the U.S. National Collegiate Athletic Association are recording a surge in cyberattacks targeting the theft of personal photos and videos from social media and cloud storage. Attackers are paying particular attention to student-athletes. A typical scenario begins with a phishing SMS or email mimicking an account suspension warning. After the breach, hackers demand a ransom to prevent the distribution of materials, but even after payment, they often sell the stolen content and personal data on the dark web, triggering a new wave of extortion.

Cyberattack aboard a Delta Air Lines flight: hackers from DEF CON tested the Wi-Fi's resilience

The incident on flight 591, traveling from Las Vegas to Atlanta, became a vivid illustration of the vulnerability of passenger networks. The attackers, presumably participants of the just-concluded DEF CON 34 conference, forcibly disconnected other passengers' devices from the legitimate Wi-Fi and deployed a fake network called "Delta WiFi Fast." When connecting to it, users saw a phishing authorization page aimed at stealing Google account passwords. As a precautionary measure, the crew cut power to the onboard Wi-Fi for 30 minutes. After landing, police interrogated the suspects and seized their equipment. It is important to note that the aircraft's navigation systems are isolated from the passenger network, so flight safety was never at risk.

Chinese group Jewelbug: the double life of spies and crypto scammers

Symantec analysts exposed the activities of the Jewelbug (Earth Alux) group, which combined cyberespionage in government structures with large-scale crypto fraud. The hackers, allegedly linked to a legitimate SEO company, attacked government and military agencies in the Middle East and Asia. They compromised a telecom provider's web hosting platform, gaining access to the email of 15 ministries. Injected JavaScript code stole session cookies, and for particularly valuable targets, they installed Antino backdoors and a PDF Viewer extension.

In parallel, the group ran a fraudulent business: neural networks generated fake articles on hundreds of fake domains masquerading as Binance and OKX, while botnets pushed them to the top of search engines. The hackers' database contained over a million logs of malicious activity, 580,000 stolen cookies, and thousands of credentials. A custom Rust-based trojan called ClientKing was used to infect Linux servers, and malicious payloads were hidden in public Google Docs documents.

DeadLock ransomware goes decentralized: Polygon smart contracts at the core of its infrastructure

The DeadLock ransomware group, responsible for about a hundred victims in the U.S., Europe, and Turkey, has taken a revolutionary step in building its infrastructure. Instead of traditional servers, they have fully migrated to the Polygon blockchain ecosystem. The ransom note is now a standalone HTML file (RECOVERY_CHAT.<UID>.html) that operates in the browser as a full-fledged web application with a chat, a stolen-data explorer, and a leak log.

The JavaScript code inside the file interacts with Polygon smart contracts to rotate proxy server addresses. If law enforcement blocks one address, hackers only need to update a record in the smart contract, and communication with the victim is restored. Posts about breaches and leaked data are also tied to smart contracts and distributed via the decentralized Wasabi protocol. Technically, the malware uses hybrid encryption with Curve25519 and XChaCha20, masks its processes under high CPU and RAM load, and is strictly blocked from running in CIS countries.

Cyberattack on a Polish combined heat and power plant: the first case of penetration via a private cellular network

The CERT Polska team revealed details of an attack on a combined heat and power plant providing heat to about 50,000 residents. The incident occurred in December 2025, but its analysis has only now been published. The uniqueness of the vector lies in penetration through the power grid operator's private cellular network. The attackers started with a wind farm where MFA was absent, then moved through a firewall and a Teltonika RUTX50 router into a network where misconfiguration allowed direct traffic between clients. Ultimately, they discovered a WAGO PFC200 controller at the target plant, protected only by a factory-default password.

On December 29, the hackers switched Siemens S7 controllers to stop mode and changed passwords, leading to the physical shutdown of the steam turbine and the water treatment system. To cover their tracks, they destroyed evidence by resetting equipment settings. Prompt staff intervention allowed systems to be restored. This case is a stark reminder that protecting critical infrastructure requires a comprehensive approach, including managing default passwords and network segmentation.

My comment: DeadLock's shift to decentralized infrastructure via Polygon is an alarming signal for the entire blockchain community. The use of public networks to manage malware sets a precedent where traditional methods of blocking domains and servers become ineffective. The industry needs to more actively develop on-chain data analysis tools to identify and neutralize such threats; otherwise, we risk seeing an avalanche of copycat models from other cybercriminal groups.