https://opnorange.com/ The digital attack surface on wealth, infrastructure, and autonomy: state and criminal operations, exploits and ransomware, supply-chain compromise, AI-enabled offense — and the surveillance of money, from chain analysis to compelled access. en Fri, 23 Oct 2026 00:00:00 GMT https://opnorange.com/intel/railway-s-secret-store-was-read-and-200-addresses-were-swept-api-keys-rotate-pri https://opnorange.com/intel/railway-s-secret-store-was-read-and-200-addresses-were-swept-api-keys-rotate-pri Fri, 23 Oct 2026 00:00:00 GMT Railway, a cloud platform that said in January it serves about 2 million developers, disclosed on Wednesday, October 21, that an intruder had read customers' encrypted environment variables and decrypted some of them, paused every deployment, and told all users to rotate their secrets. By 19:36 UTC a sweeper script was emptying wallets whose private keys had lived in those variables: about $371,000 across more than 200 addresses and 19 chains, by security researcher Taylor Monahan's count. Railway says the campaign is after AI inference credentials. Those rotate. A private key is the account, and the only fix is to move. Threats https://opnorange.com/intel/tether-says-it-freezes-4-weeks-before-ofac-does-the-senate-s-34-hezbollah-wallet https://opnorange.com/intel/tether-says-it-freezes-4-weeks-before-ofac-does-the-senate-s-34-hezbollah-wallet Tue, 20 Oct 2026 00:00:00 GMT Tether chief executive Paolo Ardoino answered the Senate's September report on Monday with 3 numbers: since 2023 the company has frozen flagged addresses an average of 4 weeks before OFAC or Israel's counter-terror bureau designated them, 99% of them before Chainalysis labeled them, and Iran-linked stablecoin volume is down 94%. The report's own case study runs the other way: 39 addresses Israel tied to a Hezbollah financier in June 2023, 5 frozen early, 34 left open until March 2024. Both clocks are real. Neither is one a holder can read. Surveillance https://opnorange.com/intel/turkish-police-seized-6-cold-wallets-from-richard-heart-the-jurisdiction-that-ma https://opnorange.com/intel/turkish-police-seized-6-cold-wallets-from-richard-heart-the-jurisdiction-that-ma Sun, 18 Oct 2026 00:00:00 GMT Turkey's justice minister confirmed on Saturday, October 17, that Richard Heart, the founder of Hex and PulseChain, was detained in Istanbul on Wednesday, October 14, and that searches of 15 addresses produced $7.15 million in cash, 6 cold wallets, 7 firearms, and a stack of phones and computers. Heart had won dismissal of the U.S. Securities and Exchange Commission's case against him in February 2025 because a federal judge found no jurisdiction over a citizen living in Finland. Finland's tax and assault allegations produced an Interpol red notice instead, and Turkey acted on it 22 months later. What the 6 wallets yield now depends on their PINs, their passphrases and Turkish law, none of which the owner controls from custody. OpSec https://opnorange.com/intel/the-occ-s-debanking-report-says-banks-restricted-digital-assets-as-financial-cri https://opnorange.com/intel/the-occ-s-debanking-report-says-banks-restricted-digital-assets-as-financial-cri Thu, 15 Oct 2026 00:00:00 GMT The Office of the Comptroller of the Currency said on Wednesday, October 14, that all 9 of the largest national banks it supervises kept policies from 2020 to September 2025 that could deny or limit service over political or religious views or lawful lines of business, and that digital-asset issuers, exchanges, and administrators were among the restricted lines, with those restrictions 'often attributed to financial crime considerations.' The agency read nearly 100,000 complaints and about 420,000 pages of bank documents and says it still cannot count the customers cut off. Its remedies so far take reputation risk out of supervision and contemplate rules against political and religious discrimination; the financial crime label the banks put on crypto is not on the list. Surveillance https://opnorange.com/intel/europol-says-the-quantum-target-is-your-exposed-key-an-ethereum-researcher-says- https://opnorange.com/intel/europol-says-the-quantum-target-is-your-exposed-key-an-ethereum-researcher-says- Thu, 08 Oct 2026 00:00:00 GMT Europol's European Cybercrime Centre published a report on quantum computing and cryptocurrency on Wednesday, October 7, concluding that wallet keys, not blockchains, are the point of exposure, that coins behind an already-public key cannot be protected after the fact, and that cryptocurrencies 'will not collapse.' The same day, Ethereum Foundation researcher Justin Drake told the industry to plan a controlled migration to fresh addresses because AI-driven mathematics, not a quantum computer, might break the signature curve first, 'in the worst case in months not years.' Vitalik Buterin and Ledger's chief technology officer both answered that a rushed migration is the likelier way to lose money. OpSec https://opnorange.com/intel/tether-froze-2-76-million-no-police-had-flagged-a-second-lawsuit-in-5-weeks-asks https://opnorange.com/intel/tether-froze-2-76-million-no-police-had-flagged-a-second-lawsuit-in-5-weeks-asks Wed, 07 Oct 2026 00:00:00 GMT Conduit Technology, a Boston cross-border payments firm, sued 4 Tether entities in the Southern District of New York on October 5, alleging the issuer froze its entire $2.76 million USDT treasury wallet on September 24, 2025, pointed it to a Brazilian police investigation it was never part of, and has kept the funds for more than a year. The Brazilian Federal Police, per the complaint, say they never asked. It is the second suit in 5 weeks to put Tether's blacklist in front of the same court, and the first of the 2 to allege the issuer acted on no request but its own. Intel https://opnorange.com/intel/fincen-withdrew-the-10-000-self-hosted-wallet-rule-after-6-years-the-exchange-st https://opnorange.com/intel/fincen-withdrew-the-10-000-self-hosted-wallet-rule-after-6-years-the-exchange-st Tue, 06 Oct 2026 00:00:00 GMT The Financial Crimes Enforcement Network filed notices on October 5 withdrawing its December 2020 proposal to make banks and exchanges record the counterparty on self-hosted wallet transactions above $3,000 and report them above $10,000, and its October 2023 finding that international crypto mixing is a class of transactions of primary money laundering concern. Neither rule ever took effect. What they would have added was a report; what already exists, the identity check and the withdrawal address on file at every regulated on-ramp, is untouched. Surveillance https://opnorange.com/intel/a7-moved-17-billion-through-front-companies-with-accounts-at-435-institutions-tr https://opnorange.com/intel/a7-moved-17-billion-through-front-companies-with-accounts-at-435-institutions-tr Fri, 02 Oct 2026 00:00:00 GMT Treasury designated the A7 Network a significant transnational criminal organization on October 1, and FinCEN proposed a rule barring every institution the Bank Secrecy Act covers, crypto exchanges included, from moving funds for the network's front companies. The companies, not the ruble stablecoin, carried the $17 billion. The list of who they are will live in a portal your exchange can read and you cannot. Geopolitics https://opnorange.com/intel/a-senate-report-puts-87-of-iran-s-terror-finance-wallets-on-usdt-the-ask-is-a-fr https://opnorange.com/intel/a-senate-report-puts-87-of-iran-s-terror-finance-wallets-on-usdt-the-ask-is-a-fr Tue, 29 Sep 2026 00:00:00 GMT Senate Democratic investigators released a preliminary report on Monday analyzing 846 Iran-linked wallets and concluding that Tether's USDT sits at the center of Iran's shadow banking system. The complaint is not that Tether cannot freeze; it is that Tether waits for a sanctions notice or a seizure order before it does. Tether answered the same day with a count: about $550 million in Iran-linked USDT frozen in 2026. Both sides agree the switch works. The fight is over who gets to flip it, and on what evidence. Surveillance https://opnorange.com/intel/bitget-reopens-bitcoin-withdrawals-monday-at-08-00-utc-a-5-step-exit-that-surviv https://opnorange.com/intel/bitget-reopens-bitcoin-withdrawals-monday-at-08-00-utc-a-5-step-exit-that-surviv Sun, 27 Sep 2026 00:00:00 GMT Bitget said withdrawals will return in 4 phases starting with bitcoin at 08:00 UTC on Monday, September 28, after raising its September 24 loss to about $387.5 million. Stablecoin issuers have frozen $318,000 of it, the attacker moved $83 million in XRP that no issuer can touch, and Bitget is paying a 5% bounty for freezes. The recovery is the exchange's problem; the exit is yours, and the days around a reopening are when the phishing arrives. OpSec https://opnorange.com/intel/bitget-lost-351-6-million-without-losing-a-key-the-target-was-the-system-that-de https://opnorange.com/intel/bitget-lost-351-6-million-without-losing-a-key-the-target-was-the-system-that-de Fri, 25 Sep 2026 00:00:00 GMT Bitget said Thursday that about $351.6 million left its hot and warm wallets after an attacker compromised a backend wallet service, fed it spoofed transaction data, and let the exchange's own authorization process approve the transfers out. No private key was taken, cold storage was untouched, withdrawals are paused, and a bitcoin-denominated protection fund is pledged to cover the loss. It is the costliest exchange theft since Bybit, and it shares Bybit's shape: every signature was valid, and every signer was lied to. Threats https://opnorange.com/intel/20-000-of-governance-tokens-bought-9-4-million-then-the-cosmos-hub-halted-itself https://opnorange.com/intel/20-000-of-governance-tokens-bought-9-4-million-then-the-cosmos-hub-halted-itself Tue, 22 Sep 2026 00:00:00 GMT On September 22 an attacker bought about 31.6 million NTRN roughly 11 minutes before a Neutron governance vote closed, passed a proposal granting itself admin rights over 10 Astroport and Drop contracts, and drained about $9.4 million within 24 minutes. No contract was broken. The governance system executed exactly as specified, and the containment measure was Cosmos Hub validators halting their own chain to freeze about 1.2 million ATOM the attacker had moved onto it. Threats https://opnorange.com/intel/revolut-answered-a-forged-government-request-it-sent-back-passports-selfies-and- https://opnorange.com/intel/revolut-answered-a-forged-government-request-it-sent-back-passports-selfies-and- Sat, 12 Sep 2026 00:00:00 GMT Revolut confirmed on September 12 that it disclosed customer identity documents, verification selfies, account statements, and full transaction histories to an attacker who submitted data requests from inside a genuine government agency's email domain. The requests carried valid technical authentication, and staff processed them as routine legal compliance. The bank has not named the agency, the country, or the number of customers in the set. Surveillance https://opnorange.com/intel/the-sender-checks-passed-one-hacked-newsletter-vendor-sent-trezor-bitbox-and-coi https://opnorange.com/intel/the-sender-checks-passed-one-hacked-newsletter-vendor-sent-trezor-bitbox-and-coi Thu, 10 Sep 2026 00:00:00 GMT Trezor, BitBox, and the portfolio tracker CoinTracking warned on Wednesday that phishing emails reached their newsletter subscribers from the companies' own sending domains, clearing the checks that catch spoofed mail, after a shared email marketing provider was compromised. The lure was a fabricated 'STM32 entropy vulnerability' written in the vocabulary of the real Coldcard seed flaw, with a 'check if you're affected' link hosted on a Trezor mailing subdomain. No losses are confirmed. The devices were never the target. The inbox was. OpSec https://opnorange.com/intel/fincen-logged-12-7-billion-going-to-scam-compounds-its-new-red-flags-look-like-a https://opnorange.com/intel/fincen-logged-12-7-billion-going-to-scam-compounds-its-new-red-flags-look-like-a Sat, 05 Sep 2026 00:00:00 GMT The Financial Crimes Enforcement Network published a Financial Trend Analysis and an alert on September 3 tying roughly $12.7 billion across 33,904 Bank Secrecy Act reports to digital asset investment scams run from overseas compounds, with victims in every US state. The reports were filed while the money was leaving. The red flags FinCEN now wants banks and exchanges to act on describe a funding sequence, liquidated retirement accounts and home equity moving to crypto platforms, that looks a lot like a large, legitimate self-custody purchase. Surveillance https://opnorange.com/intel/a-ransomware-gang-leaked-the-atf-s-wiretap-support-files-the-collectors-cannot-p https://opnorange.com/intel/a-ransomware-gang-leaked-the-atf-s-wiretap-support-files-the-collectors-cannot-p Tue, 01 Sep 2026 00:00:00 GMT The Qilin ransomware gang published roughly 6.3GB of files stolen from a Bureau of Alcohol, Tobacco, Firearms and Explosives system tied to the agency's wiretap-support function, after a 72-hour ransom countdown expired. The dump appears to name investigation targets and agents and includes Cellebrite phone extractions. For the second time in 2 years, surveillance infrastructure is the breach, not the defense. Surveillance https://opnorange.com/intel/cronos-stopped-the-whole-chain-to-trap-a-75-million-exploit-your-exit-was-never- https://opnorange.com/intel/cronos-stopped-the-whole-chain-to-trap-a-75-million-exploit-your-exit-was-never- Mon, 31 Aug 2026 00:00:00 GMT Cronos, the blockchain backed by Crypto.com, halted all block production on August 30 after an attacker pumped Tectonic's thinly traded TONIC governance token roughly 100x and borrowed an estimated $75 million of harder assets against it. The freeze stranded about $60 million of the stolen funds on the chain, along with every honest balance. The exploit is a 4-year-old playbook. The off switch it triggered is the real disclosure. Threats https://opnorange.com/intel/cosmos-cleared-this-bug-in-april-the-public-fix-showed-attackers-how-to-drain-6- https://opnorange.com/intel/cosmos-cleared-this-bug-in-april-the-public-fix-showed-attackers-how-to-drain-6- Sun, 30 Aug 2026 00:00:00 GMT Cosmos Labs published a post-mortem on August 28 admitting that a critical Cosmos EVM bug, reported through its bug bounty program on April 25, was wrongly assessed as posing no risk to live networks and quietly patched in May. When the real severity surfaced in August, the fix and a public description of the exploit path went out hours before most chains could upgrade, and attackers moved first. 6 networks, including MANTRA, TAC, and KiiChain, lost roughly $5.7 million between August 20 and 25. Threats https://opnorange.com/intel/russia-s-central-bank-blacklisted-2-600-crypto-wallets-the-database-is-the-story https://opnorange.com/intel/russia-s-central-bank-blacklisted-2-600-crypto-wallets-the-database-is-the-story Sat, 29 Aug 2026 00:00:00 GMT The Bank of Russia disclosed that roughly 2,600 crypto wallets tied to suspected scams now sit in a database banks and law enforcement use for risk scoring, after more than 1 billion rubles flowed into them in the first half of 2026. The report landed 3 days before Russia's new crypto law takes effect on September 1, adding identity-linked reporting to every legal transfer. The scam list is real, and so is the general-purpose control rail it proves out. Surveillance https://opnorange.com/intel/moonwell-s-oracle-trusted-a-spot-price-the-8-7-million-exploit-cost-more-than-a- https://opnorange.com/intel/moonwell-s-oracle-trusted-a-spot-price-the-8-7-million-exploit-cost-more-than-a- Fri, 28 Aug 2026 00:00:00 GMT A lending protocol on Base lost roughly $8.7 million on August 27 after an attacker pumped the illiquid MAMO token and Moonwell's spot-price oracle accepted the inflated value as loan collateral. No contract code was broken: the price feed did exactly what it was configured to do. It is Moonwell's 3rd oracle-related failure in 11 months, and the loss exceeds a full year of the protocol's fee revenue. Threats https://opnorange.com/intel/maya-protocol-s-theft-alarm-paid-the-thief-6-chained-bugs-became-a-1-7-million-e https://opnorange.com/intel/maya-protocol-s-theft-alarm-paid-the-thief-6-chained-bugs-became-a-1-7-million-e Thu, 20 Aug 2026 00:00:00 GMT An attacker chained 6 bugs in a single 23-message transaction on August 18, tricking MAYAChain's theft-compensation routine into crediting a pool with 49 million CACAO that did not exist. Roughly $1.7 million left the protocol, including 20 native bitcoin from shared liquidity, and CACAO fell 89%. The mechanism built to make liquidity providers whole after a theft is what made the theft possible. Threats https://opnorange.com/intel/safepal-s-order-tracker-leaked-39-798-customer-records-the-seller-s-proof-is-saf https://opnorange.com/intel/safepal-s-order-tracker-leaked-39-798-customer-records-the-seller-s-proof-is-saf Tue, 18 Aug 2026 00:00:00 GMT SafePal disclosed that an authorization flaw in a 3rd-party order-tracking plugin exposed names, home addresses, phone numbers, and purchase details for 39,798 customers. Within a day the data was listed for sale on a cybercrime forum, with the seller pointing buyers at SafePal's own breach-verification tool to validate samples. It is the 2nd hardware wallet customer list to leak in a week, and the map of people who provably hold bitcoin at home keeps growing. Threats https://opnorange.com/intel/trezor-s-shipping-partner-leaked-13-689-home-addresses-the-devices-are-fine-the- https://opnorange.com/intel/trezor-s-shipping-partner-leaked-13-689-home-addresses-the-devices-are-fine-the- Sat, 15 Aug 2026 00:00:00 GMT Trezor confirmed that its fulfillment partner ShipMonk was breached through a zero-day flaw in the analytics platform Metabase, exposing names, home addresses, emails, and phone numbers for 13,689 recent hardware wallet buyers. No devices or keys were touched. What leaked is a verified list of people who hold self-custodied bitcoin, matched to where they live, and phishing against it has already started. Threats https://opnorange.com/intel/south-korea-just-set-the-travel-rule-threshold-to-zero-and-wants-fatf-to-follow https://opnorange.com/intel/south-korea-just-set-the-travel-rule-threshold-to-zero-and-wants-fatf-to-follow Wed, 12 Aug 2026 00:00:00 GMT South Korea's Cabinet approved a decree on August 11 that removes the 1 million won floor from the crypto Travel Rule, extending sender and receiver identity reporting to every exchange-to-exchange transfer from February 2027. The same decree sorts transfers to personal wallets into risk tiers with an outright ban on high-risk counterparties, and Seoul is lobbying FATF to make zero the global standard. Surveillance https://opnorange.com/intel/bybit-sued-north-korea-over-its-1-5-billion-hack-a-federal-judge-already-froze-3 https://opnorange.com/intel/bybit-sued-north-korea-over-its-1-5-billion-hack-a-federal-judge-already-froze-3 Sun, 09 Aug 2026 00:00:00 GMT Bybit filed a civil RICO suit in the US District Court for the District of Columbia against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 theft of roughly $1.5 billion, the largest crypto heist on record. The court granted a preliminary injunction freezing identified stolen assets, finding Bybit has demonstrated a likelihood of success on the merits. It is the first known attempt by a crypto exchange to haul a nation-state into a US courtroom over a hack. Intel https://opnorange.com/intel/the-patch-is-not-the-fix-btcpay-s-leaked-macaroons-keep-working-after-you-update https://opnorange.com/intel/the-patch-is-not-the-fix-btcpay-s-leaked-macaroons-keep-working-after-you-update Sat, 08 Aug 2026 00:00:00 GMT BTCPay Server confirmed on August 7 that attackers are actively exploiting a critical flaw to steal LND credential files and drain connected Lightning nodes, and it shipped version 2.4.2 as an emergency patch. Hardware wallet maker Foundation and the Bitcoin zine Citadel21 both lost node funds before the public warning existed. The catch: macaroon credentials copied before the patch keep working after it, and only a full rotation cuts off the access. Threats https://opnorange.com/intel/ill-bloom-s-root-cause-named-a-12-year-old-cryptojs-function-fed-weak-randomness https://opnorange.com/intel/ill-bloom-s-root-cause-named-a-12-year-old-cryptojs-function-fed-weak-randomness Fri, 07 Aug 2026 00:00:00 GMT Security firm Coinspect has named the root cause of the Ill Bloom wallet drains: CryptoJS.lib.WordArray.random(), a function in one of the most widely used JavaScript cryptography libraries, fed weak entropy into the recovery phrases of at least 5 wallet apps, and the library's maintainer published a Critical advisory on August 5. At least $5.7 million is already gone across 2 coordinated sweeps that began weeks before any public warning existed. The patch cannot repair a single existing seed: only migration can. OpSec https://opnorange.com/intel/phishers-are-now-hunting-coldcard-refugees-and-the-vendor-s-own-email-list-is-th https://opnorange.com/intel/phishers-are-now-hunting-coldcard-refugees-and-the-vendor-s-own-email-list-is-th Tue, 04 Aug 2026 00:00:00 GMT As Coinkite emails every customer address it can reach about the Coldcard flaw, Proofpoint has documented a phishing campaign impersonating exactly that outreach: a fake 'coordinated hardware audit' that installs remote-access software, complete with a live chat operator. Coinkite also conceded it retains purchase emails indefinitely, a list attackers now know exists. The rescue channel has become the attack surface. Threats https://opnorange.com/intel/the-coldcard-sweep-hits-88-6-million-and-the-not-affected-models-join-the-adviso https://opnorange.com/intel/the-coldcard-sweep-hits-88-6-million-and-the-not-affected-models-join-the-adviso Sun, 02 Aug 2026 00:00:00 GMT A suspected third wave pushed the Coldcard sweeps to 1,367 BTC, about $88.6 million, across 4,585 addresses, and Coinkite expanded its advisory on August 1: seeds generated on pre-fix Mk4, Mk5, and Q firmware carry about 72 bits of entropy instead of 128. Exchange deposits are spiking as holders flee self-custody, which trades a fixable bug for a permanent counterparty. OpSec https://opnorange.com/intel/triple-a-lost-11-8-million-over-31-hours-its-clients-lost-nothing-the-difference https://opnorange.com/intel/triple-a-lost-11-8-million-over-31-hours-its-clients-lost-nothing-the-difference Wed, 29 Jul 2026 00:00:00 GMT Singapore payments firm Triple-A confirmed that attackers drained an estimated $11.8 million from its corporate treasury wallets over roughly 31 hours, across 7 blockchain networks. Client funds were untouched: under Singapore's safeguarding rules, customer money sits with separate trust institutions, and the breach stopped exactly at that boundary. The incident is a clean natural experiment in who absorbs the loss when a licensed intermediary's hot wallets fail. Threats https://opnorange.com/intel/the-53-million-question-in-manhattan-is-exploiting-a-smart-contract-computer-fra https://opnorange.com/intel/the-53-million-question-in-manhattan-is-exploiting-a-smart-contract-computer-fra Sat, 25 Jul 2026 00:00:00 GMT Lawyers for Jonathan Spalletta, the Maryland man charged over the 2021 draining of Uranium Finance, argued in Manhattan federal court on July 24 that the case should be dismissed because the exchange's own code permitted every transaction he sent. The motion puts the government's main legal weapon against DeFi exploiters on trial, 14 months after the same courthouse threw out the Mango Markets convictions. Intel https://opnorange.com/intel/certik-counted-52-wrench-attacks-in-6-months-as-home-invasion-becomes-the-leadin https://opnorange.com/intel/certik-counted-52-wrench-attacks-in-6-months-as-home-invasion-becomes-the-leadin Fri, 24 Jul 2026 00:00:00 GMT CertiK's H1 2026 wrench attack report verified 52 physical-coercion incidents against crypto holders in 6 months, a 33% rise year-over-year, with recorded financial exposure jumping from $10.5 million to $124.1 million. Home invasion is now the most common attack type, and France accounts for 33 of the 52 verified cases. The attackers have stopped being opportunists and started doing targeting work. Threats https://opnorange.com/intel/the-verus-bridge-got-its-money-back-in-may-a-new-attacker-just-used-the-same-hol https://opnorange.com/intel/the-verus-bridge-got-its-money-back-in-may-a-new-attacker-just-used-the-same-hol Thu, 23 Jul 2026 00:00:00 GMT 3 cross-chain protocols lost a combined $35.55 million in roughly 6 hours between July 22 and 23: AFX Trade on Arbitrum, the Verus-Ethereum bridge, and Bitcoin layer 2 B2 Network. The Verus drain is the one that should stop you cold. Security firm Blockaid says the attacker used the same contract, the same entry path, and the same bug class as the bridge's $11.58 million May exploit, an incident that had ended with a negotiated return of most of the funds. The settlement put the money back. It did not put the fix in. Threats https://opnorange.com/intel/one-signature-4-transactions-8-minutes-wanchain-s-cardano-bridge-loses-515-milli https://opnorange.com/intel/one-signature-4-transactions-8-minutes-wanchain-s-cardano-bridge-loses-515-milli Tue, 21 Jul 2026 00:00:00 GMT Wanchain's bridge between Cardano and BNB Chain was drained of roughly 515 million NIGHT tokens, worth about $9 to $10 million, in 4 transactions over an 8 minute window. Security firm BlockSec traced the exploit to the bridge's TreasuryCheck validator, which built its signed messages by concatenating 14 variable-length fields with no delimiters, letting an attacker reuse 1 valid signature to authorize a vastly larger withdrawal. The cryptography held. The message format did not. Threats https://opnorange.com/intel/criminal-networks-are-minting-their-own-freeze-proof-stablecoins-fatf-s-annual-r https://opnorange.com/intel/criminal-networks-are-minting-their-own-freeze-proof-stablecoins-fatf-s-annual-r Fri, 17 Jul 2026 00:00:00 GMT The Financial Action Task Force said Thursday that organized crime groups are moving billions in illicit proceeds through crypto and that some criminal networks now issue their own stablecoins built to resist freezing and seizure. The same review shows only about a third of assessed jurisdictions are largely compliant with the watchdog's crypto standards 7 years after they were extended to virtual assets. The freeze authority regulators spent those years wiring into the rails has become the design constraint professional criminals engineer around. Surveillance https://opnorange.com/intel/bull-bitcoin-asks-france-s-highest-court-to-annul-the-decree-enforcing-eu-crypto https://opnorange.com/intel/bull-bitcoin-asks-france-s-highest-court-to-annul-the-decree-enforcing-eu-crypto Fri, 10 Jul 2026 00:00:00 GMT Bull Bitcoin, a Bitcoin-only non-custodial exchange licensed under MiCA through France's AMF, has petitioned the Conseil d'Etat, France's highest administrative court, to annul Decree No. 2025-1276, the rule that brings the EU's DAC8 crypto tax reporting directive into French law. It is the first legal challenge to DAC8 in any EU member state. The company argues that automatic, suspicionless reporting of customer identities and transactions builds a database nobody can secure, in a country that has logged 77 crypto-linked kidnapping and extortion cases in the first half of 2026. Surveillance https://opnorange.com/intel/hinkal-lost-820-000-after-its-privacy-proof-verification-failed-to-verify-anythi https://opnorange.com/intel/hinkal-lost-820-000-after-its-privacy-proof-verification-failed-to-verify-anythi Sat, 04 Jul 2026 00:00:00 GMT An attacker drained roughly $820,000, nearly the protocol's entire total value locked, from Hinkal, a zero-knowledge privacy protocol, on July 3, 2026, by submitting a deposit that skipped the required cryptographic proof and then withdrawing funds the contract should have refused. Blockchain security firm CertiK confirmed the technique targeted Hinkal's core proof-verification step, and the stolen funds moved through Tornado Cash and a Thorchain bridge to Bitcoin within hours. It's the latest entry in OPNorange's Trust Inversion series: a mechanism built to provide privacy and security became the exact vector that broke both. Threats https://opnorange.com/intel/1-7-million-drained-through-a-single-forged-proof-on-taiko https://opnorange.com/intel/1-7-million-drained-through-a-single-forged-proof-on-taiko Mon, 22 Jun 2026 00:00:00 GMT On June 22, 2026, an attacker forged source-signal proofs on Taiko's Ethereum L2 bridge and drained $1.7 million from an ERC-20 vault for withdrawals with no matching deposits on the source chain. Taiko halted block production and urged users to withdraw from every bridge on the network because chain state verification failure is not bounded to a single contract: when the proof mechanism fails, every bridge relying on it fails simultaneously. This is the Trust Inversion pattern at the cryptographic layer: the mechanism that was supposed to make bridges trustless became the attack surface. Native Bitcoin in self-custody has no proof verification layer, no source-signal mechanism, and no bridge to forge. Threats https://opnorange.com/intel/microsoft-identifies-a-usb-worm-swapping-crypto-addresses-on-windows https://opnorange.com/intel/microsoft-identifies-a-usb-worm-swapping-crypto-addresses-on-windows Fri, 19 Jun 2026 00:00:00 GMT On June 17, Microsoft's Security Response Center published a technical analysis of Trojan:Win32/CryptoBandits.A, a self-propagating malware worm that has targeted cryptocurrency holders on Windows PCs since February 2026. The worm spreads via infected USB drives, monitors the Windows clipboard every 500 milliseconds, silently swaps copied wallet addresses with attacker-controlled ones, and exfiltrates copied seed phrases and private keys over the Tor anonymity network. It also propagates itself to any clean USB drive inserted into an infected machine. The defensive answer is the same one it has always been for address verification: read the recipient address on your hardware wallet's display before approving the transaction. OpSec https://opnorange.com/intel/predatory-sparrow-sent-nobitex-s-90m-to-unspendable-addresses https://opnorange.com/intel/predatory-sparrow-sent-nobitex-s-90m-to-unspendable-addresses Thu, 18 Jun 2026 00:00:00 GMT On June 18, 2025, the Israel-linked hacker group Predatory Sparrow claimed responsibility for draining more than $90 million from Nobitex, Iran's largest cryptocurrency exchange, and destroying the funds by routing them to vanity blockchain addresses with no usable private keys and an anti-IRGC message embedded in the address data. The same group hacked Bank Sepah, an IRGC-linked state bank, the day before. A year later, on June 2, 2026, OFAC designated Nobitex and three other Iranian exchanges covering approximately 78% of Iran's 2025 crypto volume as Islamic Revolutionary Guard Corps (IRGC) sanctions-evasion infrastructure. The $90 million was not stolen. It was burned as a geopolitical statement, and Nobitex's users are the collateral. Geopolitics