The Public Prosecutor’s Office in Bielefeld, Germany, has seized approximately €10.1 million ($11.4 million) from Ignatova’s assets. Efforts to that end have been successful, the office announced on Monday, quoted by the Deutsche Presse-Agentur (DPA) news agency. The money came from the sale of two apartments in London and will be used to compensate Ruja’s victims, German prosecutors also detailed. A luxury penthouse and an adjacent flat in the British capital’s Kensington district, valued at £12.5 – £13.5 million, had been acquired through shell firms.

Germany believes properties were purchased with criminal proceeds

Authorities in Germany believe that the properties were purchased with criminal proceeds from the activities of the $4.5 billion cryptocurrency scam OneCoin that she co-founded and operated. Both hit the market in early 2023 at the request of the Bielefeld prosecutor’s office, after Ruja Ignatova was declared the owner of the property in the affluent neighborhood. This summer, a court in Guernsey, where the formal owners were based, made a decision.

In the hearing, it was determined that another £8.59 million held by Ignatova in a bank account on the island should be seized, too. These funds were also slated for return to the Federal Republic, where they will be used for further compensation of investors defrauded by the Cryptoqueen’s notorious pyramid structure. OneCoin was founded in 2014 and functioned as a multi-level-marketing network with global reach, pitching a fake cryptocurrency with the same name, which was advertised as a “Bitcoin killer.”

More than 3 million people are believed to have put money into the massive Ponzi scheme, based on the company’s own stats, with total investments exceeding $4 billion by the last quarter of 2016. Ruja Ignatova, who holds a German passport, was last seen in late 2017 when she boarded a flight for Athens from Sofia, the capital of Bulgaria, where she was born. She disappeared shortly after the United States issued a warrant for her arrest and is now wanted by the U.S. Federal Bureau of Investigation (FBI), Europol and Interpol.

Despite occasional reports of her whereabouts, including some suggesting Ruja may still be in Greece, she hasn’t been found yet, dead or alive, and the manhunt continues. The so-called Cryptoqueen is largely considered the mastermind of OneCoin, one of the largest frauds in crypto history, but she wasn’t the only one who orchestrated the project. The scam’s co-founder, Karl Sebastian Greenwood, a citizen of Sweden and Britain, was arrested in 2018. He pleaded guilty in 2022 and got 20 years in prison for wire fraud and money laundering.

Ignatova’s brother, Konstantin, who took over after her disappearance, was eventually detained in 2019 in the U.S., where he pleaded guilty to Onecoin-related charges while seeking witness protection. In September 2025, German prosecutors filed charges against Ignatova. The move sought to prevent the alleged offenses from becoming time-barred, the DPA reminded in its report. “The offences for which she is charged will reach the statute of limitations in 2031,” the German news agency highlighted this week, noting the charges include building a pyramid scheme.

The post Germany now controls $10M of missing OneCoin cryptoqueen’s assets first appeared on Coinfea.

As released in the FinCEN Financial Trend Analysis and an accompanying alert to financial institutions on September 3, 2026, this discovery increases the burden on exchanges, stablecoin issuers, and regulators, as fraudulently obtained funds are still transferred through the same channels used by legal customers. FinCEN has advised banks and cryptocurrency companies to be vigilant about the signs of scam operations and to provide information on scams on a voluntary basis according to Section 314(b) of the USA PATRIOT Act. However, it is quite difficult to tighten cross-border controls without hindering legitimate cryptocurrency activity.

FinCEN traces reported funds to criminal groups overseas

The figure of $12.7 billion relates to 33,904 reports submitted under the Bank Secrecy Act in the period between September 8, 2023 and December 31, 2025. The majority of these reports were made by money services businesses that were largely dependent on the digital assets industry, and depository institutions accounted for as much as 96% of all reports. FinCEN has pointed out that the total doesn’t represent confirmed losses by victims.

The overall data may consist of cases involving attempts to conduct these transactions, multiple reporting, transfers in both directions, as well as amendments made to some reports submitted earlier. The volume of reports filed increased by an average of 10.9% compared to the previous month, while the amount of money reported grew by approximately 18%. The number of victims is known across all 50 states plus some of the US territories.

FinCEN has made it clear that the rise in reporting can be attributed to the expansion of the vocabulary that is used to announce the alerts, which should not be taken as an indication of the growth in scam activities. “Digital asset investment scams pose one of the most significant fraud threats facing Americans today.” The organizations behind them “exploit both emerging technologies and human vulnerabilities.” — Gene Lange, performing the duties of Under Secretary for Terrorism and Financial Intelligence.

Criminal groups outsource operations on marketplaces

The alert from FinCEN provides an insight into a completely outsourced criminal system. The criminals operate through “guarantee marketplaces” to avail services ranging from account creation and phishing to money laundering. Professional money laundering service providers set up shell companies and mule accounts that allow for funds to be moved illegally through the financial system, including using stablecoins for transfers to exchanges outside the United States.

This trend can also be supported through reports from other regulatory organizations. For instance, the FATF report released in March regarding the usage of stablecoins and unhosted wallets mentioned that stablecoins accounted for the overwhelming 84% of illegal transactions related to virtual assets in 2025, citing Chainalysis. FATF also elaborated on the usage of unhosted wallets and sophisticated methods of laundering that are used to cover up the origin of funds.

The September 3 FATF report on underground banking and the hawala system also recorded the emergence of “digital hawala” where the operators communicate through encrypted messaging applications such as WhatsApp, Telegram, and Signal and settle accounts by means of virtual assets including stablecoins. According to an assessment from UNODC in July, crime syndicates in Southeast Asia are part of a growing service-based economy in which fraud, trafficking, and money laundering share the same infrastructure.

However, as shown by the FATF report from March that looks into offshore virtual assets service providers, the more pressing issue is that jurisdictions have unequal oversight, which criminals can exploit. According to FinCEN, its Rapid Response Program allows FinCEN to work with foreign financial intelligence units to identify and recover fraudulent transactions, but people are still advised to report their cases to the FBI’s Internet Crime Complaint Center (IC3) quickly. The main question here is how effective and fast such cooperation is while criminals use money laundering services more frequently.

The post FinCEN ties $12B in crypto scam funds to fraud groups overseas first appeared on Coinfea.

WAFF reported June 26 that investigators tracked the money through several wallets and exchanges before seizing it under a federal warrant. Court papers described a classic “pig butchering” scheme. In this scam, fraudsters gradually build victims’ trust over weeks or months and then direct them to fake investment platforms. The federal complaint states the victim connected with a person calling herself “Bella” who claimed to be a 23-year-old woman and offered to help him invest in crypto.

Florence man loses $222k to romance crypto scammers

According to reports, the conversations moved to the encrypted messaging app Telegram, where they became romantic. “Bella” then provided step-by-step instructions on how to transfer money out of the victim’s Alabama bank account to a Coinbase account. The money was then moved to cryptocurrency wallets controlled by the scammers. Federal prosecutors say more than $222,000 of the stablecoin USDT was laundered through a series of wallets and exchanges before being seized by law enforcement.

Now the government wants a federal judge to order the forfeiture of the seized money as proceeds of wire fraud. In February 2025, on-chain security firm Cyvers reported that crypto investors lost $5.5 billion to pig butchering scams in 2024. That grew to 200,000 identified cases on the Ethereum network alone, per Cryptopolitan’s earlier coverage. Data from Chainalysis during the same period found that pig butchering accounted for 33.2% of all crypto scam revenue by subclass. Deposits in these schemes were up by about 210% year-on-year.

Michael Pearl, vice president of GMT strategy at Cyvers, called pig butchering “by far the biggest threat” to crypto investors. He ranked it above outright hacks, which stole $2.3 billion in assets across 165 incidents in 2024. Across the data, 75% of pig butchering victims lost more than half their net worth, Cyvers found. The grooming period ran one to two weeks in 35% of cases. But some scams stretched to three months. Men aged 30 to 49 were the most targeted group, according to the firm’s data. Cyvers found 75% of pig butchering victims across the data lost more than half their net worth.

The grooming period was 1–2 weeks in 35 % of the cases. But some scams take up to three months. The firm’s data showed that men aged 30 to 49 were the most targeted group.“The rate at which bad actors are using elaborate pig-butchering scams to defraud innocent people is despicable,” Special Agent Stacey Moy of the FBI’s San Diego Field Office said in a statement tied to a separate 2024 forfeiture case in the District of Columbia. Federal prosecutors have not identified any suspects in the Florence case.

The post Crypto scammers defraud Florence native of $222K in a romance scam first appeared on Coinfea.

In addition to his sentence, he will be under surveillance for another three years after his release. According to court records, he lured investors by presenting himself as a skilled cryptocurrency trader who specialized in Bitcoin derivatives trading. He promised potential investors profitable returns without any risk to their initial investment under his protection. However, behind the curtains, Giri had a classic pyramid scheme running. He took money from new investors to return it to previous ones.

Crypto fraudster sentenced to nine years in prison

According to court documents, Giri has been losing all the bets he made with investors’ funds, causing a loss of the people’s money. He would make false reasons for refunds. In October 2024, Giri confessed to one wire fraud charge. However, he didn’t stop there. During the time he waited for his sentencing hearing, he kept on with his act, asking more investors for money, bringing in more victims under his web.

Before Monday’s sentencing, Giri acknowledged this additional wrongdoing through an updated agreement with the Department of Justice. Court filings show Giri attracted investors by talking about his supposed wealth and expensive lifestyle. He owned two Lamborghini sports cars, a Tesla, and an Audi R8. He also displayed costly watches, traveled on private aircraft, and stayed in high-end rental properties.

Rather than putting all investor money into cryptocurrency trading as he had promised, Giri used some of the funds for his own spending or to pay back earlier investors, following the typical pattern of a pyramid scheme. Meanwhile, a previous FBI report noted that crypto frauds have drained 11.4 billion from Americans last year. The report, as mentioned by Cryptopolitan previously, described these schemes as elaborate, long-running operations that use psychological tactics and false legitimacy.

The FBI found that most crypto scams come from organized criminal groups operating in Southeast Asia. These groups often force human trafficking victims to work running the scam operations. The number of victims jumped in 2025, with 181,565 complaints involving cryptocurrency, a 21 percent increase. The average loss per case reached $62,604, showing victims typically lose substantial sums rather than small amounts. Nearly 18,600 people each lost over $100,000, suggesting many victims are losing savings and retirement money.

Cryptocurrency scams now represent a major part of a broader increase in online fraud. Americans filed more than 1 million cybercrime complaints in 2025, with total losses exceeding $20.8 billion. However, the crypto industry has started responding to the threat. According to Binance, its artificial intelligence security systems stopped more than $10.5 billion in user losses from early 2025 through the first quarter of 2026. The exchange blocked 22.9 million scam and phishing attempts in just the first quarter of 2026, protecting about $1.98 billion in user money.

The post Crypto fraudster slammed with a nine-year jail term first appeared on Coinfea.

The team was previously stripped of the medal following his 22-month ban for testing positive for prohibited substances. He was later cleared of intentional doping but hasn’t competed since 2024. Brandon Mingeli, 25, who represented Great Britain in the 100m at the 2021 European U23 Championships, is also among those charged. The Eastern Region Special Operations Unit (ERSOU) executed simultaneous search warrants at 6 AM on April 29 across Chelmsford, Enfield, South London, and Wakefield.

British track stars implicated in seed phrase scam

According to reports, all ten suspects were charged with conspiracy to defraud. Margate Magistrates’ Court heard the charges the following day. The alleged scheme relied on social engineering rather than technical exploits. Callers posed as police officers or representatives of crypto companies. They then pressured victims into sharing their seed phrases or private keys to steal or spend the funds. Once victims handed over their seed phrase, the funds were drained. At least one person lost £300,000.

ERSOU received support from Kent Police, the City of London Police, the Metropolitan Police, and the Yorkshire and Humber Regional Organised Crime Unit. The Wakefield suspect was detained by the Yorkshire unit. Three defendants were remanded in custody. Mingeli and Jami Durston-McDonnel, 28, both of Chelmsford, along with Louis Richards-Miller, 24, of Greenwich. The remaining seven, including Ujah, were granted bail.

The full list of bailed defendants includes Joseph Umoru, 24; Adedeji Kujore, 24; Abdul-Azeem Taiwo Adeola Yusuf, 24; Abdul-Azeez Kehinde Adeolu Yusuf; Jayden Nakayama, 25; and Samantha Gyabaa, 23. The Court date is set for May 28. All ten defendants are scheduled to appear at Chelmsford Crown Court on May 28. No pleas have been entered. The case adds to a growing list of crypto theft prosecutions in England.

In November 2025, Thames Valley Police arrested four men after masked attackers forced a victim in Oxford to transfer roughly $1.5 million in crypto while also stealing a luxury watch, Cryptopolitan previously reported. Earlier this year, three teenagers who disguised themselves as Amazon delivery drivers to steal £3.1 million in crypto from an East London property received a combined 16 years in youth detention.

ERSOU issued guidance following the arrests of the ten defendants in the British sprinter crypto fraud case. Police will never call asking about crypto holdings, and no real company or officer will request a seed phrase. Anyone receiving such a call should hang up and verify independently by dialing 101 from a separate phone.

The post British police arrest sprinter in wallet seed phrase scam first appeared on Coinfea.

The group is facing accusations tied to a cryptocurrency fraud worth Rs 11.5 crore ($1.3 million), according to local media outlets. A special court granted the ED 10 days of custody to conduct further investigations. This scam goes back to 2017. That’s when Sriki and his crew allegedly broke into national and international websites and made off with Bitcoin. The stolen coins included a haul from a Dubai exchange, investigators think. The crypto then got funneled to people with political ties in Karnataka.

Indian authorities had been tracking Skiri since 2020

Sriki first landed on law enforcement’s radar in November 2020. He got arrested for allegedly buying hydro ganja on the dark web using Bitcoin. India’s ED has been chasing this Bitcoin scam for years now. The police are investigating illegal crypto transactions, hacking, and various financial irregularities. The case kicked up a lot of political noise in Karnataka. On April 20, the ED raided 12 locations linked to the accused and their associates.

Among the targets, places connected to Mohammed Haris Nalapad and Omar Farook Nalapad, sons of Shantinagar MLA N.A. Haris. Mohammed Hakeeb Khan, grandson of former Union Minister K. Rehman Khan, also had his residence searched. The ED thinks Mohammed Haris and Omar Farook ended up with proceeds from the crime. Investigators claim the hacked Bitcoin moved from the Dubai exchange to the Nalapads. The agency’s been tracing the digital trail.

Suspicious money transfers through Hakeeb Khan’s bank accounts triggered searches at his place, too. Transactions between Khan and Sriki are still under investigation as part of the wider probe. Bengaluru’s Central Crime Branch handled the Bitcoin scam initially. Then it got transferred to Karnataka’s Criminal Investigation Department. The ED eventually took over, using the Prevention of Money Laundering Act to track proceeds across crypto wallets and traditional banking channels.

In a separate case, the Himachal Pradesh High Court recently denied bail to Abhishek Sharma. He’s accused of running a crypto MLM scheme that allegedly ripped off +80,000 investors for Rs 500 crore, or ~$3.6 million, Cryptopolitan previously reported. The court called economic offenses “grave” because they hit the economy. Globally, crypto fraud losses keep climbing. The FBI’s latest annual report recorded $11.4 billion in cryptocurrency losses across the United States in 2025.

The post Indian authorities nab hacker in $1.3M BTC theft case first appeared on Coinfea.

In its press statement, the AFP mentioned that the criminals are using stolen information and impersonating law enforcement officers to steal funds from digital wallets. The criminals parade themselves as social engineers to steal private data, such as email addresses and phone numbers, then submit fraudulent reports through ReportCyber, the government’s official cybercrime reporting tool.

Once potential victims are identified, the criminals initiate contact, claiming to be AFP officers investigating a cybercrime case. “The scammers verify personal information in ways that match common expectations and act quickly to create a sense of urgency,” AFP Detective Superintendent Marie Andersson said. In a case the AFP explained, the agency revealed that someone received a call from someone claiming to be from the agency.

Australia alerts public over fraudsters using police identities to steal digital assets

The AFP mentioned that in a peculiar case, the fraudster provided an official-looking reference number linked to a supposed ReportCyber submission. The act was done to remove all doubts that the victim could have. The criminal then asked the victim to access the portal and enter their email address to verify the report. Another person, acting as a representative from the victim’s crypto platform, repeated the reference number to convince the individual of the call’s authenticity.

The scammers then urged the target to transfer funds from their platform wallet to a so-called “Cold Storage” account. Fortunately, the victim grew suspicious and ended the call before any funds were lost. “We encourage Australians to adopt necessary safety measures online and take a moment to stop their scroll, check for warning signs of scams, and protect themselves from cybercrime,” Andersson said.

She also added that legitimate law enforcement officers will never request access to cryptocurrency wallets, bank accounts, seed phrases, or other financial information. Victims or those who suspect they are being targeted should immediately terminate calls and notify ReportCyber or call 1300CYBER1 (1300 292 371). AFP Assistant Commissioner Richer Chin also mentioned that Australia became a target due to high levels of household wealth and savings.

“This is organised cybercrime. They’re incredibly well-drilled when it comes to their scripts and how they manipulate us and exploit our generosity,” Chin said. “I’m aware of a case involving an elderly gentleman caught up in a romance scam. He was convinced to part with $1.4 million.” Officials are asking residents of Australia to be cautious, especially when they are interacting with unfamiliar contacts who insist that they are law enforcement or financial institution representatives.

Even with legitimate platforms such as ReportCyber, criminals can manipulate information to appear credible and convince victims to share data or send funds in urgency. “Every cybercrime report can help police track criminals, assist in building intelligence on emerging cyber threats, and prevent other people from being targeted,” Andersson concluded in the recent AFP statement.

The post Australia warns residents of scams exploiting national cybercrime platform first appeared on Coinfea.

These screenshots included evidence of crypto transactions and conversations in other languages. According to the court filing, Rathod allegedly received $1.2 million worth of BTC through a network of seven bank accounts at six different financial institutions. His former partner noticed the scheme after Rathod repeatedly complained about his bank accounts being closed.

FBI charges man with conspiracy to commit wire fraud

The FBI has charged Rahod with multiple counts, including conspiracy to commit wire fraud, money laundering, and conspiracy to commit money laundering. The alleged crimes took place between November 2021 and June 2024.

In the court filing, the FBI revealed that as part of the investigations, the FBI had obtained records from Google for tushal27@gmail.com, Apple iCloud accounts belonging to the same email, and kluvbb110011@gmail.com, all via court order. The FBI also claimed that Rathod incorporated two companies he used in the scheme.

In 2016, Rathod registered T3 Telecom, LLC, a telecommunications company that tested and deployed network devices. He also incorporated TSV Telecom Constructions LLC in 2021. The agency also noted that between April 2022 and June 2024, the accused received over $1.7 million in suspected fraudulent proceeds from business email compromise (BEC) fraud and counterfeit checks.

The accused received the funds through six different financial institutions, with five accounts belonging to T3 Telecommunications and one for TSV Telecommunications. BEC fraud originates from compromised employee login credentials through spear phishing. Scammers intercept information about the company’s upcoming payments and deceive vendors into completing payments through fake domains.

The accused also allegedly recruited other people to aid his plan, including his former girlfriend, the owner of the iCloud account associated with kluvbb110011@gmail.com, to create businesses and open business bank accounts. According to the court filing by the FBI, Rathod also recruited his family members between May and July 2024 to assist in the scheme, which resulted in an additional $1 million deposited into accounts controlled by his girlfriend and family members.

Rathod’s first victim was a Rhode Island real estate law firm in 2022, with the firm losing approximately $163,298. The victim received an email that impersonated an employee at Northpointe Bank, directing the victim to send funds to an account supposedly belonging to a Mortgage Company, Carrington Mortgage, associated with a valid real estate transaction. His second victim was the California Credit Union. The firm lost approximately $8 million to bank accounts controlled by other scammers.

The post FBI charges New York native of conspiracy to convert fake checks into Bitcoin first appeared on Coinfea.

These letters ask recipients to provide their 24-word recovery phrases under the pretense of performing a security update. Ledger has responded by confirming the scam and assuring users that their devices remain secure.

Scammers use old data breach to target users

Tech commentator Jacob Canfield received a counterfeit letter from Ledger’s name which many other individuals also got. A legitimate branding presentation and proper business address and reference number made this communication seem official. Users who failed to validate a vital security upgrade would encounter restricted wallet access according to the message. The fraudulent emails might specifically target victims from the 2020 Ledger data breach that released details of more than 270,000 customers.Canfield reported this.

Other hardware wallet users and resellers have also reported receiving similar scam letters. Some users claimed to have received fake devices tampered with and designed to install malware. The scam appears to be an attempt to exploit the older breach to drain users’ wallets.

QR code scam asks for recovery phrases

The fraudulent letters contained QR codes while telling people to read them before following commands. According to the reported instructions people needed to provide their private recovery phrase which granted intruders access to their crypto wallets. According to a statement from Ledger the letters were determined fraudulent and the company denied any policy to request recovery phrases from users.

Canfield posted screenshots of the letter to warn others in the crypto community. He advised people to be cautious and to alert friends and family who may not be familiar with security threats. Ledger emphasized that while it blocks scammers and reports them, it cannot fully control what others publish on platforms or send by mail.

Ledger urges users to stay alert

Ledger praised Canfield for raising awareness and reminded users that the company does not make unsolicited requests for recovery phrases. The company also confirmed that it would never contact users by phone or social media to ask for sensitive information. Ledger added that its hardware wallets are designed to protect user funds, even in cases of external fraud attempts.

The company encouraged all users to ignore suspicious messages and avoid contact with anyone claiming to be from Ledger offering help with fund recovery.

The post Ledger Users Targeted by Scam Letters Demanding Recovery Phrases first appeared on Coinfea.

Email breach exploitation leads to massive crypto theft

At the heart of this scam is the strategic use of a compromised email list from a January breach of Mailer Lite, laying the groundwork for this and potentially other phishing schemes. The scam has specifically preyed on dormant wallet owners, many of whom had disengaged from their crypto investments following BlockFi’s bankruptcy.

According to Plumferno, the scheme has amassed nearly $4.5 million in ether since March 17, alongside valuable NFTs like Mutant Apes and Otherdeeds, further compounding the victims’ losses. This operation not only reflects the high stakes of digital asset security but also the cunning methods employed by scammers to exploit the aftermath of the crypto market’s upheavals.

A reminder of persistent crypto security challenges

The revelation of this phishing operation serves as a stark reminder of the persistent threat of crypto scams, which continue to evolve in complexity and audacity. Despite increased awareness and preventive efforts, the crypto community remains vulnerable, with losses to phishing scams totaling $300 million last year alone. This incident underscores the critical importance of vigilance and informed skepticism in managing digital assets, especially in light of the targeted approach taken by scammers toward individuals already affected by the volatile crypto market.

The crypto industry’s response to such threats is a testament to its resilience and capacity for innovation in security practices. As the sector grapples with the implications of this latest scam, enhancing educational outreach and implementing stronger security protocols are paramount. This situation highlights the ongoing need for heightened cybersecurity awareness and the adoption of rigorous safeguards to protect against the sophisticated tactics of cybercriminals, ensuring the safety and trustworthiness of the digital asset ecosystem.

The post Phishing scam drains millions from crypto wallets first appeared on Coinfea.