# Theft Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Theft", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

They Made Huge Profits from the Latest XRP Hacking Incident

Bridge Operations Halted Following XRP Exploit: $200K Stolen A critical vulnerability in the software of a bridge connecting the XRP Ledger (XRPL) to the "tx" transaction network was exploited on August 9th, leading to the theft of approximately 200,000 XRP (worth roughly $200,000). The attacker manipulated the bridge's deposit detection mechanism, causing it to record transactions as successful deposits even though no actual XRP was sent to the bridge's address on the XRPL. This allowed the creation of unbacked, bridged XRP balances on the "tx" blockchain, which were then used to withdraw real XRP from the bridge's reserve. The incident is contained to the bridged XRP on the "tx" chain, with all other collateralized assets reportedly fully insured. User funds on centralized exchanges, decentralized exchanges, or held directly in blockchains were not affected. Following the discovery, the bridge connection was suspended. The security flaw has been identified and patched. The "tx" team is tracking the stolen funds, cooperating with blockchain analytics firms, and has filed a complaint with the FBI's Internet Crime Complaint Center (IC3). Management is considering options to compensate affected users and will pursue all legal avenues against the attacker. The XRPL bridge will remain offline until security audits and system upgrades are complete.

cryptonews.ru08/12 20:06

They Made Huge Profits from the Latest XRP Hacking Incident

cryptonews.ru08/12 20:06

Losses from the Coldcard Hack: How Researchers Track Stolen Bitcoin

A security breach affecting Coldcard hardware wallets highlights the challenges of estimating losses from attacks on non-custodial wallets, as there is no complete list of compromised addresses. Analytic firms have provided differing estimates. CryptoQuant confirms losses of 1,432 BTC, using a strict methodology that only counts funds from publicly reported victim addresses. Galaxy Research and TRM Labs assess a higher minimum of around 1,730 to 1,816 BTC stolen from over 5,200 addresses. They combine direct victim reports with analysis of on-chain transaction patterns linked to the attack's waves. Galaxy notes that while victim reports have helped identify over 450 BTC in confirmed losses and pattern-matching suggests over 730 BTC more, many suspected funds remain unconfirmed. Experts agree that establishing a precise total is difficult. Julio Moreno of CryptoQuant stated the final figure will always be an estimate, as researchers can only verify what victims disclose publicly. The lack of a central entity, like an exchange, complicates verification, and relying solely on on-chain patterns risks false positives and overestimation.

cryptonews.ru08/11 13:11

Losses from the Coldcard Hack: How Researchers Track Stolen Bitcoin

cryptonews.ru08/11 13:11

ZachXBT Reveals Identity of Cryptocurrency Scammer Involved in $5M Theft

ZachXBT, a blockchain investigator, has identified Tiffany Milanovich as a threat actor linked to at least $5 million in cryptocurrency thefts. Milanovich's scam involves impersonating customer support staff from centralized exchanges or hardware wallet services, tricking victims over the phone into granting access to their funds. Her associate, using aliases like "bled" and "harm," creates phishing websites mimicking login pages for crypto services. When victims enter their credentials, the criminals gain access to their wallets. In one June incident, a victim lost $1.2 million in Bitcoin and Ethereum from a Trezor hardware wallet after being tricked by a fake representative. ZachXBT notes that Milanovich publicly boasts about her illicit gains on her Telegram channel, mocking victims and flaunting luxury purchases and casino bets funded with stolen money. She was exposed after her associate, John Daghita (previously implicated by ZachXBT in a $46 million theft), leaked her real name online following a dispute.

cryptonews.ru08/11 10:22

ZachXBT Reveals Identity of Cryptocurrency Scammer Involved in $5M Theft

cryptonews.ru08/11 10:22

Coinsbuy offers $100K reward after Sunday security breach

Crypto payments platform Coinsbuy suffered a security breach on Sunday, resulting in the draining of over $7.9 million from its wallets on Ethereum and TRON networks, according to a blockchain investigator. The attacker reportedly began converting the stolen funds into Monero. Coinsbuy temporarily paused services and has since restored them. The company confirmed the incident, stating that unauthorized withdrawals affected several platform wallets. Coinsbuy has covered all client losses from its own reserves, ensuring no financial impact on its users. An investigation is ongoing, but technical details will not be disclosed until it is complete. Additionally, Coinsbuy is offering a $100,000 reward for information leading to the identification of the responsible party, with an extra bonus for assistance in recovering the stolen funds.

cointelegraph08/10 19:00

Coinsbuy offers $100K reward after Sunday security breach

cointelegraph08/10 19:00

Crypto service Coinsbuy hacked, loses $7.9 million

Cryptocurrency service Coinsbuy suffered a hack, losing approximately $7.9 million. Security firm PeckShield suggested the breach may have been caused by compromised private keys or a critical infrastructure vulnerability. The stolen funds were drained simultaneously from hot wallets on the Ethereum and Tron networks. The attacker subsequently began splitting the assets and moving them through exchange services like FixedFloat, ChangeNOW, and BingX, converting a portion into the privacy-focused cryptocurrency Monero. The Coinsbuy team, in collaboration with ChangeNOW, managed to freeze some of the stolen assets before they could be fully withdrawn. Coinsbuy stated that gateway operations were temporarily suspended for several hours due to frozen deposits and withdrawals, but all services have now been restored and are functioning normally. This incident follows recent reports from PeckShield and blockchain researcher ZachXBT about a hack on the cross-chain exchange protocol THORChain, which resulted in an estimated loss of $10 million.

cryptonews.ru08/10 11:38

Crypto service Coinsbuy hacked, loses $7.9 million

cryptonews.ru08/10 11:38

FBI Agent Steals from Within: Millions in Cryptocurrency Stolen by Memorizing Recovery Phrases

A criminal complaint filed in the U.S. District Court for the Eastern District of Virginia details the case of Patrick Steven Yaroch, a former FBI supervisory special agent. Yaroch is accused of using his position to steal nearly $1 million in cryptocurrency from accounts associated with a "foreign adversary" (reportedly Russia) that were under FBI monitoring. He allegedly accessed the accounts' seed phrases from an FBI system, memorized them, and transferred the funds to personal wallets over 10-12 transactions in late 2024 or early 2025. Some stolen assets were held on the Kraken exchange and others were deposited into the Suilend DeFi protocol to earn yield. Despite his senior GS-14 position and high security clearance, Yaroch claimed his actions stemmed from frustration with the FBI's perceived inaction against the monitored accounts. However, evidence from his phone, including ChatGPT conversations from May and June 2026, revealed plans to move to Europe (specifically Portugal) with $1 million and retire early. He booked flights for his family and initiated steps for Portuguese residency. Tormented by guilt, Yaroch voluntarily confessed to the Justice Department and FBI in late July 2026, surrendering the seed phrase and a hardware wallet. He was immediately fired and arrested. He faces charges of interstate transportation of stolen property and receipt of stolen goods. The case highlights vulnerabilities within law enforcement, including excessive access to sensitive data like seed phrases, inadequate internal oversight, and the difficulty of detecting such insider theft on-chain. It echoes past corruption cases, such as those involving agents Carl Force and Shaun Bridges during the Silk Road investigation, where officials misappropriated Bitcoin. The incident underscores that human fallibility remains a critical risk in managing digital assets, even within heavily monitored agencies.

marsbit08/09 07:11

FBI Agent Steals from Within: Millions in Cryptocurrency Stolen by Memorizing Recovery Phrases

marsbit08/09 07:11

July Became One of the Worst Months for the Crypto Industry Due to Theft of Over $247M

July 2026 was one of the worst months for the crypto industry due to hacks totaling over $247 million, making it the second-largest loss of the year so far. The significant losses were largely driven by several hardware wallet exploits targeting Coldcard, which Galaxy Digital reports led to over $130 million in losses. Analysts confirmed three major attacks on Coldcard, with a potential fourth wave under investigation. According to DefiLlama, the losses from Coldcard alone were approximately $115 million. This series of attacks highlights that even cold storage is not immune to technological risks that can endanger thousands of wallets simultaneously. Other notable incidents in July included the $9 million hack of the Bonzo Lend DeFi protocol, a $2.6 million theft from a Cardano-based SecondFi wallet, a $24 million theft from the Arbitrum-based AFX exchange, and a $7.5 million exploit via the Verus Ethereum Bridge.

cryptonews.ru08/08 15:27

July Became One of the Worst Months for the Crypto Industry Due to Theft of Over $247M

cryptonews.ru08/08 15:27

Bitcoin Lightning Network Nodes Affected, BTCPay Announces Emergency Patch 2.4.2

Bitcoin's ecosystem faces another security incident. The open-source, self-hosted cryptocurrency payment processor BTCPay Server is under an active attack exploiting a critical vulnerability that can lead to loss of funds, as reported by the Bitcoin Red Team. The BTCPay team urgently advises all users to immediately update to version 2.4.2. If an immediate update isn't possible, they recommend disabling the server until it can be updated. Users must also refresh server authentication files and move funds from any "hot" wallets generated by BTCPay. At least two incidents of stolen funds have been confirmed, affecting nodes from Foundation's Zac Herbert and the Lightning Citadel 21 node. Observers note that these targeted attacks on tools like Coldcard and BTCPay Server seem aimed at the core of Bitcoin's enthusiast community.

cryptonews.ru08/07 23:55

Bitcoin Lightning Network Nodes Affected, BTCPay Announces Emergency Patch 2.4.2

cryptonews.ru08/07 23:55

The Number of Attacks on Crypto Investors Has Increased. What Are the Scale and Losses?

The number of physical attacks targeting cryptocurrency investors has surged, with victims losing over $30 million in the first part of 2026 alone, according to a Chainalysis report. This year is on track to be the worst on record. Including attempted extortions, the total financial impact rises to $107 million. France has seen a dramatic spike in incidents, linked to a major 2024 leak of crypto investor data containing personal and financial details. Attacks have spread nationwide, with home invasions and kidnappings now common. Notably, over 40% of attacks in France target victims' family members or acquaintances, indicating extensive planning. Globally, the success rate for thieves is falling, with only 26% of attacks resulting in a payment in 2026, compared to 49% in 2025. Chainalysis warns the reported figures are likely understated, and stolen funds are laundered through both simple and sophisticated crypto channels.

cryptonews.ru08/07 13:18

The Number of Attacks on Crypto Investors Has Increased. What Are the Scale and Losses?

cryptonews.ru08/07 13:18

Hacker Coldcard Resumes Transfer of Stolen 30 BTC to a New Wallet

A hacker associated with the major Coldcard exploit has resumed activity after a period of dormancy, transferring 30.185 BTC (worth approximately $1.94 million) to a newly created wallet. This constitutes about 1.5% of the 2,055 BTC ($130 million) they initially stole. The transfer is seen as a potential early signal of an attempt to liquidate the stolen funds, which typically involves moving them through multiple wallets or mixers to avoid detection. The underlying theft, stemming from a firmware vulnerability in Coldcard Mk3 devices that weakened cryptographic randomness, resulted in losses exceeding $116 million from over 5,200 addresses. Canadian users accounted for roughly a quarter of the losses. Analysts and blockchain security researchers are closely monitoring the recipient wallet for subsequent movements to determine if the hacker is testing laundering routes or consolidating funds. This activity confirms the stolen coins remain traceable on the public ledger but also increases the risk they may soon become harder to track.

cryptonews.ru08/07 09:17

Hacker Coldcard Resumes Transfer of Stolen 30 BTC to a New Wallet