investigation

FlashRescue co-founder @DarcyAri posted on the X platform that on July 28, 2026, the funding project ODY targeting victims in China issued an additional 10 billion tokens and absconded with approximately 15 million USDT from the trading pool. Currently, it is known that there are over 10,000 victims, and the case has been accepted and is under investigation.Including subsequent transfers and transaction fees, ODY has aggregated at least 15,669,118 USDT. Further tracking revealed that the same main aggregation address previously received 5,383,428 USDT transferred from the KXG wallet, confirming that ODY and KXG share a common fund pool.

According to Wired, a security researcher who has been infiltrating a North Korean hacking organization for nearly two years has issued a warning, pointing out that the attack methods targeting individual employees and contractors are extremely effective and have a wide-ranging impact, leading to numerous organizations worldwide suffering breaches.Greek cybersecurity researcher Vangelis Stykas stated that since gaining access to the North Korean system 22 months ago, he has found evidence indicating that 1,640 companies in 57 countries have been affected by North Korean hacking operations. Among them, approximately 700 to 800 affected organizations have suffered "highly destructive" breaches.

Galaxy Research Research Director Alex Thorn stated that the attack targeting Coldcard wallet address generation is still ongoing. They are currently continuing to collect victim information and adding new victim addresses and attacker addresses to the investigation database.If users are still using affected Coldcard single-signature addresses, they should immediately migrate their funds. According to current investigation results, all single-signature Coldcard addresses generated after the firmware upgrade in March 2021 may ultimately be emptied by attackers; it is just a matter of time.According to Galaxy Research's analysis, the first three confirmed rounds of attacks exhibit highly programmatic characteristics, with similar attack transaction patterns. A large amount of stolen Bitcoin remains in the attackers' addresses and has not yet been transferred.At the same time, some new opportunistic attackers are emerging, transferring and laundering funds through methods such as stripping the funding chain, cross-chain services (like ThorChain), and overseas betting platforms.Additionally, Alex Thorn mentioned the limitations of AI tools in security investigations. Some large language models in the United States have restricted researchers' ability to track stolen funds, and the team has even had to turn to Chinese open-source AI models to assist in protecting user assets and conducting on-chain tracking.He finds this phenomenon "incredible" and plans to promote discussions on related issues at the government and industry levels. Alex Thorn concluded by stating that a large amount of stolen funds remains stagnant, and the team is continuously tracking relevant addresses, having shared information with relevant U.S. agencies and industry partners. He calls on the Bitcoin community to learn from this incident, strengthen self-custody security education, and raise awareness of wallet complexity.

According to Hongxing News, Hu Xiaowei, a core figure of the Prince Group, left Japan on July 29 and was deported to the United States. The Federal Bureau of Investigation (FBI) has contacted him, and subsequent investigations will be conducted in the United States.The report states that Hu Xiaowei previously used a Cypriot passport in Japan and operated under the name "Hu Shi." In June of this year, he was arrested by Japanese police for allegedly violating Japan's Immigration Control and Refugee Recognition Act. On July 24, the Japanese prosecution filed a summary indictment against him and imposed a fine equivalent to approximately 100,000 yuan.Public information shows that Hu Xiaowei has also operated under names such as Hu Yanming and Hu Shi. The report indicates that relevant agencies believe these identities belong to the same person.

According to Jinshi reports, the National Highway Traffic Safety Administration is investigating the hanging failure of 1.2 million Tesla (TSLA.O) vehicles.

In response to the abnormal volatility in the SK hynix perpetual contract market, Hyperliquid stated that the platform is an unlicensed blockchain, and the HIP-3 market can be independently deployed and operated by different teams. The xyz:SKHYNIX perpetual contract is deployed and operated by the Trade.xyz team, which is currently investigating the incident and will announce progress after reaching a conclusion.Hyperliquid also explained that HIP-3 deployers can independently push the market's mark price, oracle price, and external perpetual price inputs. If a pricing mechanism similar to that used by platform validators for operating perpetual contracts is adopted, the protocol only provides one of the three median components, namely the on-chain latest transaction price, the best buy price, and the best sell price median, while the other two components are provided by the deployer, who jointly determines the final mark price.

It has been reported that the mayoral candidate of Incheon, South Korea, is accused of falsely reporting assets, suspected of failing to declare the spouse's cryptocurrency assets.

According to Bitcoin.com, the U.S. Attorney's Office for the District of Columbia and the U.S. Secret Service Washington Field Office announced that a cyber fraud task force has seized over $25 million in cryptocurrency as part of multiple investigations related to international fraud schemes targeting residents of the United States and Canada. The U.S. Attorney for the District of Columbia has filed five civil forfeiture complaints seeking the forfeiture of the recovered cryptocurrency.Investigators have confirmed multiple money laundering networks and thousands of victims globally, with the largest complaint involving a romance scam affecting over 200 victims, totaling approximately $12.1 million. Another complaint involves a network of suspicious cryptocurrency wallets reported by Canadian authorities to the U.S. Secret Service, amounting to about $10.4 million.Agents tracked over 270 suspected victim transactions related to fraudulent investment platforms, with these two cases accounting for approximately 85% of the assets involved in the five forfeiture complaints. The remaining cases involve blocked withdrawals, fake investment accounts, and recovery of fraud. Investigators stated that most suspected money launderers are located in Southeast Asia and identified internet protocol addresses associated with China, Malaysia, and Cambodia; the five investigations are still ongoing.

Fang Xinghai, former member of the Party Committee and Vice Chairman of the China Securities Regulatory Commission, is suspected of serious violations of discipline and law, and is currently undergoing disciplinary review and supervisory investigation by the Central Commission for Discipline Inspection and the National Supervisory Commission.

According to Dawn, the Federal Investigation Agency (FIA) of Pakistan has established a virtual currency investigation department within the newly launched National Command and Control Center (NC3), focusing on combating money laundering and terrorist financing using virtual assets.Officials responsible for the counter-terrorism department stated that this department will work in conjunction with the newly established Pakistan Virtual Assets Regulatory Authority (PVARA) to specifically investigate criminal activities related to crypto assets, and recommend that the National Cyber Crime Investigation Agency (NCCIA) and the Anti-Narcotics Force (ANF) set up similar units to address the use of crypto assets in cybercrime and drug trafficking.The FIA has also integrated functions such as anti-money laundering, border entry and exit monitoring, human trafficking, and smuggling investigations within the NC3, and is promoting new regulations and personnel expansion to shorten case processing times and enhance law enforcement coordination efficiency.

According to News.bitcoin, the Kenyan government is investigating the hacking incident of President William Ruto's official website, where attackers briefly disabled the site and altered the homepage content, demanding a ransom of 5 Bitcoins.William Kabogo, the Cabinet Secretary for the Ministry of Information, Communication and the Digital Economy, stated that the Kenyan law enforcement agency ICT Authority immediately activated the cybersecurity response protocol to control the incident and conduct forensic investigations, temporarily restricting public access to the portal. Currently, there is no evidence that sensitive data has been accessed without authorization, leaked, or lost, and government systems and digital services remain securely operational.

According to Darcy, co-founder of FlashRescue, approximately $22 million in illicit funds flowed into the cryptocurrency exchange HitBTC in 2026. He pointed out that during two instances of cooperating with police investigations, HitBTC refused to assist in the verification process, and multiple on-chain investigators reported that this is a consistent practice of the platform.He mentioned that in the Bybit theft case, as much as $3.68 million from a money laundering network linked to the DPRK (North Korea) flowed into HitBTC, but the platform also did not cooperate with relevant authorities for further investigation.

Summer.fi officially announced that it has suffered an attack and has suspended all vaults under the Lazy Summer Protocol. An investigation into the root cause is currently underway, and updates will be provided continuously.

According to informed sources, U.S. regulators are investigating allegations made by Susquehanna International Group. The allegations claim that unknown insider traders profited $100 million through options bets before recent regulatory crackdowns on cross-border brokers Futu and Tiger Brokers in China. Susquehanna publicly disclosed these allegations in a lawsuit filed on June 29 in Manhattan federal court. Sources indicate that the U.S. SEC is reviewing the trades described in the market maker's complaint.Susquehanna claims in the lawsuit that it lost over $70 million as the counterparty to most of the alleged insider trading. The lawsuit states that traders purchased U.S. exchange-traded options from Chinese securities firms, which subsequently became targets of the regulatory crackdown on May 22. The scope and stage of the SEC investigation remain unclear. A U.S. judge approved Susquehanna's request to freeze related accounts on June 29. The Chinese government stated that Futu and Tiger Brokers provided unlicensed trading services to mainland residents. Following the announcement on May 22, the stock prices of both companies fell. Futu was fined 1.85 billion yuan in regulatory penalties, and founder Leaf Li's wealth decreased by $1.7 billion in a single day.

According to BBX data, the prediction market faced a dual attack yesterday, with traditional exchange infrastructure accelerating its on-chain transition. The core dynamics are as follows:The prediction market/event contract ecosystem where Robinhood Markets, Inc. (NASDAQ: $HOOD) operates suffered a dual regulatory blow yesterday: first, the U.S. Commodity Futures Trading Commission (CFTC) has launched a comprehensive investigation into Polymarket (privately held), covering its social media activities and suspected wash trading behaviors; second, a Michigan court ruled to prohibit Kalshi (privately held) from offering sports betting services to residents in Michigan. Although these two incidents directly target Polymarket and Kalshi, their strategic importance to Robinhood cannot be ignored—Robinhood provides event contract products linked to KalshiEx LLC or ForecastEx LLC through its subsidiary Robinhood Derivatives LLC, making it the largest distribution channel for prediction markets among regulated brokers in the U.S. The CFTC's escalation of enforcement investigations into similar platforms will directly impact Robinhood's event contract business compliance framework and product expansion speed; in June, the average daily trading volume in this sector reached a historic record.Nasdaq, Inc. (NASDAQ: $NDAQ) announced yesterday that it has chosen Pyth Network (on-chain price oracle protocol) as its on-chain distribution partner for TotalView (Nasdaq's full market depth data product), marking the first time Nasdaq has integrated its core institutional-level market data into a blockchain network—TotalView provides full-level buy and sell quotes and transaction data for the U.S. stock market, historically only available to traditional financial institutions (subscription-based); on-chain distribution means that DeFi protocols, decentralized exchanges, and smart contracts can now access Nasdaq-level real-time equity market data as an on-chain pricing basis for the first time. The Pyth Network token (PYTH) subsequently rose by over 6%, with the market interpreting this as a historic fusion point between traditional securities market infrastructure and decentralized finance.

According to the official report, the Dutch Public Prosecution Service (OM) has applied to the Rotterdam court to declare the cryptocurrency trading platform Knaken Cryptohandel B.V. and its subsidiary Stichting Knaken Payments bankrupt.OM stated that the Dutch Authority for the Financial Markets (AFM) had previously warned that the platform was illegally providing exchange and custody services for crypto assets without the necessary licenses. Although the platform claims to have ceased operations and is undergoing liquidation, it has currently completely stopped making payments to customers. OM is concerned that its liquidation process lacks order and may harm investors' interests, thus applying for bankruptcy, aiming to appoint a liquidator to take over and safeguard creditors' funds.In addition, based on the report from AFM, the Dutch Financial Intelligence and Investigation Service (FIOD) has launched a parallel investigation into the alleged criminal activities of the platform. Law enforcement executed multiple searches on June 29, seizing relevant digital storage devices and freezing some of the company's assets, with no arrests made so far.

According to Bloomberg, the Commodity Futures Trading Commission (CFTC) is conducting a broad investigation into the prediction market platform Polymarket, covering its business activities including social media operations.Previously, The Wall Street Journal reported that Polymarket hired dozens of social media creators, primarily of college age, to create fake trading videos to attract users. This investigation encompasses other aspects of the company's business. The CFTC and the Department of Justice concluded an investigation last year into whether Polymarket violated the ban on U.S. users, but some U.S. users still access its main platform by circumventing the ban through VPNs and other means.Since reaching a settlement with the CFTC in 2022, Polymarket has technically prohibited U.S. users from using its main platform, but the company is taking steps to reintroduce its main exchange to the U.S. and is cooperating with the CFTC to lift the ban. Senators Adam Schiff and John Curtis sent a letter to the CFTC last Thursday, requesting confirmation of whether an investigation into Polymarket's advertising practices is ongoing and inquiring how the agency has prevented Polymarket from attracting U.S. users since the 2022 action.

According to the Wall Street Journal, several U.S. lawmakers are calling for an investigation into the prediction market platform Polymarket, as its advertising is alleged to potentially contain misleading content.It is reported that the lawmakers believe Polymarket may not clearly disclose the nature of its products and associated risks in its marketing, which could mislead users. Some legislators have requested regulatory agencies to intervene and assess the compliance of its advertising and information disclosure standards.

According to "On-Chain Detective" ZachXBT's post on his personal channel, Polish social engineering attacker Wojtek Kulisz (online name "Merry") was recently suspected of being raided by Polish law enforcement, along with three others being taken away.Although the official press release did not disclose his name or photo, several designer clothing and jewelry items displayed on his public Instagram account "wojtekk" are highly consistent with the items seized during the police operation. The related case is led by the Polish Central Cyber Crime Fighting Department (CBZC) and has received assistance from agencies such as the FBI and HSI.