Daniel Rhyne, 59, was sentenced by Judge Michael A. Shipp on September 28 in Trenton. Rhyne, of Kansas City, Missouri, entered a guilty plea to two counts in April. One was extortion related to a threat to damage a protected computer; the other was intentional damage to one. At the time, Rhyne made a demand of 20 BTC, promising that more servers would go down if his demands weren’t met. At the firm, he specialized in virtual machines, the FBI complaint stated.

Missouri native demanded crypto in return for the servers

The firm sits in Somerset County, New Jersey, and counts biopharmaceutical and oil and gas companies as clients. From November 8 to November 25, 2023, Rhyne employed an administrator account he was not authorized to access to remotely get into the network. Jobs he queued on the domain controller, then wiped out 13 domain admin accounts. The same tasks also set 301 user passwords and the administrator’s password to “TheFr0zenCrew!”

Two local admin accounts ended up at “PsPasswd,” locking staff out of 254 servers. Another alteration locked 3,284 workstations. For several days that December, machines across the network went down randomly. Administrators began getting alerts around 4 p.m. on November 25 as password resets triggered across hundreds of accounts, the complaint says. All other domain admin accounts were already gone.

Forty-four minutes later, the staff got an email titled “Your Network Has Been Penetrated.” It claimed backups were deleted. If 20 BTC wasn’t received by December 2, 40 servers a day would be turned off for 10 days. On Wednesday, the crypto traded near $83,000, making 20 BTC worth about $1.7 million, more than double the demand’s 2023 value. On November 22, Rhyne’s account on the hidden machine looked up how to reset domain user passwords, delete domain accounts, and clear Windows logs, court papers said.

His company laptop had run analogous searches a week before, including how to remotely shut down a computer from the command line. The case was investigated by the FBI Newark Field Office, led by Stefanie Roddy, with assistance from Kansas City. Rhyne was picked up by agents in August 2024 and was released after his first court date. Assistant U.S. Attorney Robert Taj Moore, Cybercrime Unit, prosecuted the case. Brightly Software, a SaaS company, was targeted for $2.5 million by one of its own contractors.

In March, contractor Cameron Curry, a 27-year-old data analyst from North Carolina, got two years. Adam Iza was sentenced on October 5 to six and a half years in a federal court in California for schemes including stealing more than $37 million from Meta, Cryptopolitan reported. In July, Cryptopolitan reported that 34-year-old Armenian Karen Serobovich Vardanyan, who was extradited from Ukraine, pleaded guilty over a Ryuk ransomware campaign. It raked in over $15 million in bitcoin from U.S. companies, with a Michigan firm coughing up 200 BTC.

The post Crypto-for-ransom lands Missouri native a 32-month sentence first appeared on Coinfea.

According to reports, the agency did not carry out any arrests in the sweep, with the raid only the second of such in 2026. Along with recent documents from the regulator detailing the particulars of the crypto regime that kicks off in 2027, businesses running illegal crypto trading operations in the UK are now on alert. In its September 17 statement, the FCA said it had sent letters on September 10 ordering traders at multiple London locations to halt any suspected illegal crypto activity.

FCA alerts crypto businesses on need for authorization before 2027

Businesses need FCA authorization to run a peer-to-peer crypto trading operation, and per the regulator, no entity is currently registered to run such a business in the UK. These unregistered operators sit outside the channels the UK can monitor for dirty money flows. Consumers can check whether a crypto firm is registered through the FCA’s Firm Checker. The operation ran under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.

“Working with partners, we continue to track and disrupt illegal crypto activity,” said Steve Smart, the FCA’s executive director of enforcement and market oversight. “Anyone running an unregistered peer-to-peer crypto business should assume we are looking at them.” Detective Sergeant Sathish Alalasundaram of the Metropolitan Police sounded the same warning, saying that the force is adapting as criminals change their tactics.

Before this September action, the FCA, HMRC and the South West Regional Organised Crime Unit inspected eight London sites in an April operation. The regulator said that it is using evidence it collected then in active criminal investigations and for further enforcement. The FCA is adding crypto convictions to its portfolio, playing a pivotal role in Olumide Osunkoya landing a four-year sentence for the unregistered crypto ATM network he ran between December 2021 and September 2023.

The first conviction of its kind in the UK took down an operation that processed £2.6 million in lifetime volume. The regulator arrested two others suspected of operating a separate illegal crypto exchange. Crypto stays largely unregulated in the UK outside anti-money laundering and financial promotion rules until October 25, 2027, when the country’s full cryptoasset regime takes effect. The FCA opened its authorization gateway for firms on September 30, 2026, and published guidance the same week on which activities will need clearance, Cryptopolitan reported.

The post FCA raids crypto P2P sites in London amid rise in crackdown first appeared on Coinfea.

Total stablecoin card volume rose to $1.076 billion across 10,671,980 transactions and 283,653 active addresses.

August was the second straight month crypto card spending exceeded $1 billion. Active addresses increased from 261,000 in July, while average spending per transaction reached roughly $100.80.

RedotPay Leads Stablecoin Card Activity

RedotPay remained the largest provider in the tracked market, processing about $390.1 million during August. That represented roughly 36% of sector volume, while its transaction count exceeded 6.34 million and accounted for more than half of tracked payments.

Its average purchase value was around $61.50, below the market average. The spending pattern indicated that RedotPay users were making smaller purchases more frequently. EtherFi and KAST ranked second and third by monthly transaction volume.

Growth was visible across emerging markets. Singapore-based StraitsX, which supports Visa card programs for crypto companies, reported a 600% increase in gross transaction value across lower-GDP regions between early 2025 and 2026.

Binance said average users of its Brazil card increased 53% from the launch quarter to the second quarter of 2026. Average spending volume rose 80%, with ride-hailing, food delivery, groceries, restaurants, and online subscriptions among the leading uses.

Kraken reported that weekly Krak Card payments more than doubled over the past year to 8.3 per user. Retail and store purchases represented 59.3% of spending.

Stablecoin Card Infrastructure Expands

Mastercard enabled stablecoin settlement on June 3 for USDC, Paxos-issued tokens, RLUSD, and SoFiUSD across eight blockchains. Visa said more than 160 stablecoin card programs are either live or under development.

Providers including Rain, Reap, and Stripe’s Bridge have also reduced float and licensing costs that previously limited smaller onchain card purchases.

Despite the growth, market concentration remains high. Three programs account for 55.6% of total volume. Paymentscan also relies on self-reported RedotPay figures rather than fully onchain observations.

RedotPay is facing an approximately $472.8 million claim in Hong Kong from Binance affiliates over alleged user diversion. Its planned $1 billion US listing now appears unlikely before 2027.

Card Spending Rises as Stablecoin Supply Falls

Stablecoin supply has declined 3.6% from its May peak to about $304 billion, based on DefiLlama data. Card activity still reached a record level during the same period.

August volume annualizes to about $12.9 billion, roughly 0.06% of the traditional card market, which exceeds $20 trillion.

The divergence marks a change from the previous three years, when onchain payment activity broadly moved alongside stablecoin supply. Spending, transactions, and active users now reached highs even as the overall stablecoin pool contracted.

The post Crypto Payment Cards Set August Records Across Spending, Transactions and Users first appeared on Coinfea.

Monaco has filed Bill No. 1131, which would repeal the 2022 law that split crypto and digital-asset work into issuance and operational services cleared by the State Minister, and crypto-linked investment services authorized by the Commission de Contrôle des Activités Financières (CCAF). Under the 2022 law, providers were forced to register a company inside Monaco, and foreign firms were banned from cold-marketing to residents.

Monaco wants to join EU’s MiCA regime

The proposed change would require any firm wanting to offer crypto-asset services to gain clearance from the CCAF, but before that, the firm would have been reviewed by the Autorité Monégasque de Sécurité Financière and the Agence Monégasque de Sécurité Numérique. The bill lists exactly which crypto services are allowed in Monaco and sets clear rules for how companies must run their operations, manage risks, and behave professionally.

It also gives the CCAF more power to oversee and penalize firms, which the government says will help stop money laundering and other financial crimes. Blockchain intelligence firm TRM Labs found that firms that have not been authorized by MiCA are far more likely to carry a high or severe risk rating. Monaco has sat on the Financial Action Task Force (FATF) grey list since the summer of 2024, and was added to the European Commission’s list of high-risk money-laundering jurisdictions more than a year ago.

The country’s alignment with MiCA is in the hope that it gets taken off these lists, as designations like this can result in slow international transactions, raised compliance costs and even increased borrowing costs for local businesses. However, only 281 of 1,343 crypto service providers operating across the European Economic Area have secured MiCA authorization.

The post Monaco submits proposal to align with EU’s MiCA regime first appeared on Coinfea.

The measures extend transaction restrictions to 14 crypto service platforms operating across six countries, including Belarus.

The European Union says the platforms support channels that help Russia avoid financial restrictions linked to its war in Ukraine. The package also gives the bloc authority to prohibit dealings with crypto providers across an entire third country when that country assists Russian sanctions evasion.

Belarus Crypto Platforms Face Transaction Ban

The expanded transaction ban covers crypto-related platforms in Belarus, Georgia, Panama, the United Arab Emirates, the Marshall Islands and Kyrgyzstan. European companies and citizens are barred from conducting transactions with the listed services.

Belarus plays a central role in the measures because it hosts platforms that the EU says Russia uses to move funds around existing restrictions. The bloc aims to prevent Belarus from serving as an alternative route for Russian financial activity.

The package also freezes assets and blocks funding access for 94 Russian banks and major financial institutions. Transaction restrictions now apply to an additional 33 Russian credit and financial institutions.

EU foreign policy chief Kaja Kallas said on X that the measures target more than 100 banks and crypto operators. They also cover over 40 shadow-fleet vessels and several oil refineries in Russia and Belarus.

Belarus operates the Naftan and Mozyr oil refineries. Naftan has remained under EU sanctions since summer 2022. The bloc also imposed import bans on goods generating substantial revenue for Belarus and export controls on items linked to military production.

EU Gains Country-Wide Crypto Ban Power

The new rules allow the EU to block transactions between European companies or citizens and every crypto provider in a country helping Russia evade sanctions.

The bloc introduced the country-wide authority after observing operators replace sanctioned platforms with new services. TRM Labs found that operators linked to Garantex launched a similar exchange called Grinex after authorities seized Garantex in March 2025.

The EU said individual listings were ineffective because “any further listing of individual crypto asset service providers is therefore likely to result in the set-up of new ones to circumvent those listings.”

A7A5 Token Linked Garantex and Grinex

Old Vector, a Kyrgyzstan-registered company, created the A7A5 stablecoin on the Tron and Ethereum blockchains. The token allowed users to transfer balances from Garantex to Grinex.

The EU had already banned A7A5 under an earlier sanctions package. The latest measures also fix the Russian oil price cap at $44 per barrel for one year, preventing its automatic increase to $58.

The sanctions package broadens the EU’s effort to restrict crypto, banking, oil and trade routes connected to Russia and Belarus under the new framework.

The post EU Bans Belarusians From Crypto Exchange Ownership Under New Russia Sanctions first appeared on Coinfea.

The company, trading as Paymonade, cleared the July 1 deadline that left only 280 crypto asset service providers fully authorized across the region.

The approval allows Paymonade to offer regulated crypto asset services across all 30 nations in the Euro Area. European authorities have adopted a unified framework, with no announced plan to return crypto trading oversight to separate national regulators.

“The era of lightly regulated crypto is ending,” said Calvin Cheng, founder and chairman of Paymonade.

“Getting this licence over the finish line, at a time when the vast majority of firms in our industry have not, shows the strength of the institution we’ve built. We expect the next generation of leaders in digital assets to be firms that pair innovation with regulatory trust, and we intend to be one of them.”

MiCAR Approval Supports European Operations

Paymonade provides fiat ramp services for crypto traders and settles fiat transactions for crypto service providers, fintech companies, and exchanges. These clients use its infrastructure to convert funds into euros or other fiat currencies.

The company recorded an annualized transaction volume of $1.8 billion based on its performance during the first half of 2026. According to the supplied information, that level places Paymonade among the European Union’s most liquid fiat infrastructure providers.

Only 280 Firms Retain Full Authorization

Only one in 10 firms secured full authorization by the July 1 deadline. More than 3,000 crypto companies had previously operated in Europe under registrations and restrictions imposed by local financial authorities.

Firms without full approval must leave the market, restructure their operations, or continue operating in breach of the law. Some companies are still seeking authorization. Even Binance did not clear the MiCAR requirements before the deadline.

Paymonade said its authorization protects its European position and reduces the risk of an abrupt closure that could disrupt clients moving funds. The company now enters the regulated market while several large competitors remain without full approval.

Insurance Policy Meets MiCAR Capital Rules

Damoon Technology met MiCAR’s Article 67 regulatory capital requirements through an insurance policy provided by a third party. The policy is published transparently on the company’s website.

The insurance remains valid for at least one year and includes a 90-day cancellation notice period. Paymonade chief executive Milos Winter Bogdanovic is responsible for updating the policy and keeping it publicly available.

Paymonade plans to double its European workforce during the next 12 months as it adds institutional clients. The company also expects rapid turnover growth in 2027 and projects annualized volume above $7.4 million within the coming year.

The post Paymonade MiCAR License Secures Access Across 30 European Markets first appeared on Coinfea.

Alaska’s Department of Law alerted victims after Bitcoin Depot Operating LLC sought bankruptcy protection in the Southern District of Texas.

The company operated cash-to-crypto kiosks across Alaska and nationwide. Alaska’s Consumer Protection Unit urged residents to review eligibility and submit claims before the deadline.

More than 3,200 Alaskans reported about $40 million in fraud losses to the FBI’s Internet Crime Complaint Center last year, according to Wasilla State Senator Cathy Tilton. Seniors represented a large share.

How Crypto Kiosk Scams Targeted Victims

Bitcoin Depot’s machines resembled bank ATMs, but they converted cash into cryptocurrency and sent it to a wallet address entered during the transaction. Scammers exploited that process by directing victims to wallets they controlled.

According to the Department of Law, fraudsters often posed as police officers, government agencies, or major businesses. They pressured victims to deposit cash into kiosks and transfer cryptocurrency, leaving little chance of reversing payment.

Cori Mills, Alaska’s acting attorney general, called the technology a double-edged sword. “Cryptocurrency is an emerging financial tool that opens up possibilities for Alaskan consumers, but as with all advancements, there are perils too,” Mills said. She also described the kiosks as machines “used to take advantage of vulnerable Alaskans.”

The department warned that legitimate government agencies do not demand payment through cryptocurrency kiosks. Residents should verify any payment request before sending money.

Alaska Lawmakers Seek Stronger Kiosk Rules

Tilton is sponsoring SB 249, which would require licensing, identity verification, and safeguards for crypto-kiosk operators in Alaska. She linked the bankruptcy notice to her push for stricter oversight.

Regulators and courts elsewhere have acted against crypto ATMs amid rising fraud. Indiana, Tennessee, and Minnesota have banned the machines.

On July 7, a federal judge allowed Tennessee to keep enforcing its ban while CoinFlip challenges the law. FBI complaint data showed nationwide crypto-ATM scam losses reached $247 million in 2024, with older adults among the most common victims.

Bankruptcy Filing Offers Recovery Path

Bitcoin Depot operated more than 9,000 kiosks across North America before filing for Chapter 11 in May. Its first-quarter 2026 revenue fell nearly 50% year over year.

Massachusetts’s attorney general sued the company in February. In Texas, local sheriffs seized company kiosks, while victims lost about $56.8 million to crypto-kiosk fraud last year, the highest total.

Eligible Alaskans may follow the case through the court-appointed restructuring administrator’s claims website. The Department of Law advised residents to type the address into a browser if they distrust email links.

Filing is optional. Victims should not share personal or financial information with anyone offering assistance unless they independently verify that person’s identity.

The post Bitcoin Depot Bankruptcy Gives Alaska Victims July 21 Claim Deadline first appeared on Coinfea.

The security firm stated then that about $6 million had been “drained so far” while the transactions were still moving. A follow-up post from Blockaid published the exploit transaction, the crypto attacker’s wallet, the exploit contract, and the list of affected Lazy Summer contracts. The target was a single vault that PeckShieldAlert identified as LazyVault_LowerRisk_USDC, ticker LVUSDC, a strategy risk-managed by the firm BlockAnalitica. According to PeckShieldAlert, “LVUSDC’s displayed APY briefly spiked to ~2.08M%,” and added that the largest holder of the vault after the exploit “appears to be associated with Torben Jorgensen.”

Crypto scammers steal $6M from Summer.fi

According to BlockTempo, which cited Blockaid’s timing of 05:17, the crypto attacker ran a donation-based inflation attack against an ERC-4626 vault. The ERC-4626 standard is the default interface for vaults that issue shares against deposited tokens, and it calculates share price based on the ratio of assets held to shares outstanding.

If an attacker donates a small amount of tokens directly into the vault, they could theoretically distort that ratio and push the price of a single share far above its fair value, then redeem for more than they put in. BlockTempo reported that the operation was funded by a flash loan taken from Morpho, a loan borrowed and repaid inside one transaction, with the trades routed through Uniswap, Curve, and Balancer. The exploited figure is modest by the standards of crypto’s largest breaches, but it is large relative to Summer.fi‘s size.

The protocol has around $34.8 million in total value locked, most of it on Ethereum, and over $32.4 million is on Ethereum, per Defillama data. The $6 million drain is close to a fifth of the platform’s assets, which is substantial. Summer.fi markets itself as a yield aggregator that lets users “borrow, multiply and earn” across lending venues, with the Lazy Summer vaults routing deposits into strategies built on protocols such as Morpho. Q2 2026 saw the most attacks on record by incident count, with over 83 separate exploits.

That quarter was characterized by many smaller drains, and share-price and accounting manipulations sit alongside bridge flaws and admin-key theft as recurring vectors. Summer.fi has acknowledged the attack, writing on X, “We are aware of the reported exploit a little earlier today and are investigating the root cause. The protocol guardians are currently pausing all Vaults across the Lazy Summer Protocol.” The team states that they will provide more updates as they come.

The post Crypto scammers drain $6M from Summer.fi’s USDC vault first appeared on Coinfea.

WAFF reported June 26 that investigators tracked the money through several wallets and exchanges before seizing it under a federal warrant. Court papers described a classic “pig butchering” scheme. In this scam, fraudsters gradually build victims’ trust over weeks or months and then direct them to fake investment platforms. The federal complaint states the victim connected with a person calling herself “Bella” who claimed to be a 23-year-old woman and offered to help him invest in crypto.

Florence man loses $222k to romance crypto scammers

According to reports, the conversations moved to the encrypted messaging app Telegram, where they became romantic. “Bella” then provided step-by-step instructions on how to transfer money out of the victim’s Alabama bank account to a Coinbase account. The money was then moved to cryptocurrency wallets controlled by the scammers. Federal prosecutors say more than $222,000 of the stablecoin USDT was laundered through a series of wallets and exchanges before being seized by law enforcement.

Now the government wants a federal judge to order the forfeiture of the seized money as proceeds of wire fraud. In February 2025, on-chain security firm Cyvers reported that crypto investors lost $5.5 billion to pig butchering scams in 2024. That grew to 200,000 identified cases on the Ethereum network alone, per Cryptopolitan’s earlier coverage. Data from Chainalysis during the same period found that pig butchering accounted for 33.2% of all crypto scam revenue by subclass. Deposits in these schemes were up by about 210% year-on-year.

Michael Pearl, vice president of GMT strategy at Cyvers, called pig butchering “by far the biggest threat” to crypto investors. He ranked it above outright hacks, which stole $2.3 billion in assets across 165 incidents in 2024. Across the data, 75% of pig butchering victims lost more than half their net worth, Cyvers found. The grooming period ran one to two weeks in 35% of cases. But some scams stretched to three months. Men aged 30 to 49 were the most targeted group, according to the firm’s data. Cyvers found 75% of pig butchering victims across the data lost more than half their net worth.

The grooming period was 1–2 weeks in 35 % of the cases. But some scams take up to three months. The firm’s data showed that men aged 30 to 49 were the most targeted group.“The rate at which bad actors are using elaborate pig-butchering scams to defraud innocent people is despicable,” Special Agent Stacey Moy of the FBI’s San Diego Field Office said in a statement tied to a separate 2024 forfeiture case in the District of Columbia. Federal prosecutors have not identified any suspects in the Florence case.

The post Crypto scammers defraud Florence native of $222K in a romance scam first appeared on Coinfea.

The figure brings the month in as the third in 2026, where monthly losses were under $100 million. Phishing alone accounts for around $2.6 million of the total. Funds returned across the same period reached $9.38 million, partially offsetting the gross loss figure. The May numbers come in well below the numbers recorded in April. The CertiK report counted 60 separate incidents through the month, the highest monthly count of 2026 so far.

CertiK releases detailed report on crypto scams in May

According to the CertiK report, the figure runs above the 50 incidents seen in February, the 55 logged in March, and the 58 recorded in April. The January count had been 48 incidents. Total May losses came in at the $68.3 million figure, lower than April’s $547.3 million and below the $97 million logged in January. February and March had also recorded losses under $100 million, and March posted the lowest dollar figure of the year so far at $38 million.

Phishing losses moderated through the month at $2.6 million, the second-lowest figure of 2026 to date. January had posted $331.3 million in phishing losses, with February at $86.1 million and March at $21.6 million. The April phishing figure had fallen to $7.5 million before the May reading. The Verus attack was rated first in terms of monthly losses at $11.52 million, while the Thorchain attack was second at $10.12 million, and both attacks comprised almost one-third of the monthly total.

Third, fourth, and fifth spots in the list of greatest loss incidents went to TrustedVolumes at $6.58 million, Victim 0x2cFED at $5.94 million, and Gravity Bridge at $5.40 million. All five biggest incidents in the period under analysis brought total losses amounting to $39.55 million, almost half of the total loss figure. Several less significant incidents made up the rest of the top ten by losses

Stablr incurred monthly losses of $3.50 million, while New Market Trading suffered losses totaling $3.10 million. TAC, Ossie, and Haveno/RetoSwap all had losses of $2.80 million and $2.70 million. In terms of category, code vulnerabilities accounted for $45.13 million of the monthly losses, equal to around 66 percent of the total. Wallet compromises followed at $13.77 million, with validator compromises at $5.40 million and phishing at $2.66 million. Backend incidents posted the smallest category figure at $0.82 million in losses.

The May report also tracked recoveries across the month. Funds returned came to $9.38 million against the $68.3 million in gross losses, equal to around a 13.7 percent recovery rate. This is in line with a trend emerging across 2026 where certain compromised projects have succeeded in recovering some amounts of funds that were stolen. From the KelpDAO bridge hack in April, where Arbitrum froze about $75 million out of the $292 million stolen, along with law enforcement efforts, to Operation Atlantic that disrupted the flow of about $45 million from cryptocurrency scams.

The post Crypto industry lost $68.3M to scammers in May 2026 first appeared on Coinfea.