Thefts, drains and exploits · 15 recent stories
An investigation reported on 12 November says AI helped hackers gain access to organisations, with the article's headline citing 10 unnamed victims. The body says there were 25 operations against at least 19 organisations between August and September, with humans assigning targets and able to steer the AI. The article is not specific to crypto and gives no details of losses or affected platforms.
The US Department of Justice has secured court authorisation targeting more than $1.2 billion of crypto stolen from Binance, which it attributes to North Korea-linked hackers. Around $2.7 billion in related funds has been frozen by Tether, Ripple, Circle, World Liberty Financial and Arbitrum, and the DOJ also seized cloud infrastructure and 900 webcam videos tied to the separate FaceStealer scheme, which reportedly stole over $400 million in 18 months. North Korea has denied any involvement, with Kim Yo Jong calling the allegations a political provocation.
Kava Lend lost roughly $3.8 million in a hack, and the KAVA token fell nearly 40%. About 49.2 million KAVA was bridged to BNB Chain via LayerZero and sold for roughly $2.1 million in BNB and USDT.
The FBI says a North Korean scheme, called FaceDealer in one report and FaceStealer in another, used hijacked accounts, deepfake-style footage and fake Zoom or Microsoft Teams meetings to plant malware on crypto and Web3 workers' computers. Agents said they found videos from more than 900 victims and linked the scheme to over $400 million in thefts in 18 months. Separately, the DOJ is reported to be moving to seize $1.2 billion tied to the Binance hack, and Pyongyang has rejected the accusations.
Indian exchange Unocoin confirmed on Saturday 14 November that attackers stole roughly $200,000 in cryptocurrency from three compromised hot wallets, reversing its earlier statement that no funds were lost. The company also acknowledged that sensitive customer information may have been exposed.
An exploit on Kava Lend, a DeFi lending protocol, has coincided with a 40% fall in the KAVA token. Several exchanges have halted withdrawals. The article gives no figures for the amount drained or the timing of the exploit.
TSMC confirmed that employee information appeared on external websites, but said its own systems were not breached and customer and production data were not affected. Sellers on DarkForums and BreachForums reportedly offered around 46,000 records for 3 Bitcoin, with samples showing names, national ID numbers and bank details. TSMC says it is working with a cloud service provider, cybersecurity firms and law enforcement, and the same wave of incidents has hit other Asian firms and Coinbase's analytics vendor Amplitude.
Robinhood, Kalshi and Crypto.com have asked the US Supreme Court to review losses in cases brought by Nevada and New Jersey over their sports event contracts. The companies argue these are not taxable wagers and have not been collecting federal wagering tax, and responses in all three cases are due on 7 December. Robinhood has warned that an unfavourable tax ruling could be material and make event contracts uneconomical.
Unocoin says BitGo's freeze on its account held on 6 November, yet funds left a wallet BitGo had confirmed as frozen on 13 November. It suspects a backup recovery path in BitGo's multisignature wallets was exploited, while BitGo's documents say its recovery tool lets clients move assets without BitGo and bypass their policies. Unocoin has suspended services since 9 November and is rebuilding its server stack.
Binance said on 12 November that it had completed coverage of assets affected by its 29 October hack and published a new Proof of Reserves snapshot. Its reserve page shows a 104.34% ratio for USDT, with the onchain wallet holding about 1.06 billion more USDT than customer balances, though users cannot yet verify this through the zero-knowledge proof.
Binance has published what it describes as final numbers following a reported $6.34 billion hack, saying its Shiba Inu (SHIB) reserves are covered at 100.04%. Arkham data cited in the report shows 16% more SHIB held in Binance wallets. The article gives no further detail on the attack, so the figures should be checked against Binance's own statement.
TRM Labs has launched a new service that aims to let police seize stolen crypto within minutes. The service runs on the Beacon Network, which has more than 200 members and covers 80% of crypto trading volume.
According to Cointelegraph's Asia Express digest, North Korean hackers are launching memecoins to launder funds stolen in the Binance hack. The same roundup says xStocks plans to add hundreds of Hong Kong-listed equities in the coming weeks. The article gives no figures for the amount stolen or the size of the listings.
Trezor has cut its reseller network by 80% after finding more spy implants in wallets sold by Malaysian vendor CryptoBilis, with only 20% of vendors meeting its new sourcing and access rules. It says an update released on November 11 changes the order of display commands so the implants no longer capture the seed phrase, but it still advises CryptoBilis customers to move funds to a new wallet because backups captured earlier remain at risk. Three Trezor Safe 5 units have been found implanted, all bought between August 20 and September 23, and Trezor says no funds have been stolen.
Gemini's parent company has reportedly sold its UK and European operations to stablecoin firm KAST for less than $10 million, according to an anonymous source. Gemini announced last February that it would exit the UK, Europe and Australia, alongside cuts that removed 25% of its workforce. Gemini's GEMI shares have reportedly fallen almost 93% since its 2025 IPO, to $2.72.