Loading story…
Roger Ver, a prominent early bitcoin investor known as "Bitcoin Jesus," agreed to pay nearly $50 million to the U.S. Department of Justice to settle federal tax charges related to his cryptocurrency holdings. Ver entered into a deferred prosecution agreement after admitting that he willfully omitted a significant portion of his bitcoin assets when filing expatriation-related tax returns in 2016, which reduced his tax liability by over $16.8 million. The settlement included back taxes, penalties, and interest, and following the payment, prosecutors moved to dismiss the indictment against him. This case highlights the increasing scrutiny by U.S. authorities on cryptocurrency investors who attempt to evade taxes by renouncing citizenship or failing to report digital assets. In a separate incident, a trader suffered a loss of approximately $21 million on the decentralized exchange Hyperliquid due to a private key compromise. The attacker was able to access the trader's wallet and transfer the funds, underscoring the persistent risks associated with private key management in decentralized finance (DeFi) platforms. The Hyperliquid incident demonstrates the ongoing threat of targeted attacks against high-value cryptocurrency accounts, where a single compromised key can result in substantial financial losses. Additionally, the Ethereum Foundation and Keyring launched a fund to support the legal defense of Tornado Cash developers, reflecting the broader legal and regulatory challenges facing the crypto ecosystem. Indian authorities initiated an investigation into Binance traders for alleged crypto tax evasion, signaling a global trend of increased regulatory enforcement in the digital asset space. Hackers executed a $32.5 million dump, marking the largest crypto liquidation event of the week, which had significant market impact and raised concerns about the security of large-scale digital asset holdings. New York City established the nation's first mayoral office dedicated to digital assets and blockchain, indicating growing institutional interest in the sector. These incidents collectively illustrate the multifaceted risks in the cryptocurrency landscape, including legal, regulatory, and technical threats. The convergence of high-profile tax settlements, major thefts, and regulatory actions highlights the need for robust compliance and security measures among digital asset holders and service providers. The events also emphasize the importance of secure key management practices and the potential consequences of lapses in operational security. As the digital asset market matures, both individual investors and organizations must remain vigilant against evolving threats and regulatory developments. The week's developments serve as a reminder that the intersection of technology, finance, and law in the crypto space is increasingly complex and fraught with risk. Ongoing education, proactive risk management, and engagement with legal and regulatory frameworks are essential for mitigating exposure in this rapidly changing environment.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
A cryptohack roundup reported that 'Bitcoin Jesus' Roger Ver agreed to settle U.S. tax charges for $50 million. No additional dated developments or intermediate events were provided in the referenced content.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Illicit actors continue to hold and move significant amounts of cryptocurrency, with on-chain balances linked to criminal activity now exceeding $75 billion. According to blockchain analytics, nearly $15 billion is directly held by entities identified as illicit, with stolen funds representing the largest share of these holdings. Downstream wallets, which have received more than 10% of their inflows from illicit sources, collectively hold over $60 billion, indicating that the reach of criminal proceeds extends far beyond the original perpetrators. Darknet market administrators and vendors alone control over $40 billion in on-chain value, highlighting the scale of underground digital economies. Bitcoin remains the dominant cryptocurrency among illicit balances, accounting for 75% of the total, though stablecoins and ether have seen substantial growth in criminal usage. The concentration of these funds is typically high, with a small number of wallets holding the majority of assets. Illicit actors are adapting their laundering techniques, increasingly using more cashout addresses for shorter periods to evade detection. Direct transfers from illicit entities to exchanges have dropped significantly, from about 40% of quarterly value in 2021–2022 to just 15% in Q2 2025, reflecting changes in both enforcement and criminal tactics. Law enforcement agencies, particularly in the United States, are responding by establishing strategic reserves and stockpiles of seized digital assets, and have already confiscated over $12.6 billion in illicit funds with the help of blockchain analytics firms. The timing of enforcement actions varies, with market-based illicit services tending to operate longer before being disrupted. Once illicit entities stop receiving funds, the speed at which they empty their wallets depends on the type of cryptocurrency held. Meanwhile, specific high-profile incidents continue to occur, such as the $21 million theft from SBI Crypto, a subsidiary of Japan's SBI Group. In this case, hackers stole a variety of cryptocurrencies, including bitcoin, ethereum, litecoin, dogecoin, and bitcoin cash, and laundered the proceeds through Tornado Cash, a mixing service favored by cybercriminals. Investigators noted that the tactics and laundering patterns in the SBI Crypto heist closely resembled those used by North Korean hacking groups, suggesting a possible link to Pyongyang's ongoing campaign to finance illicit activities through digital asset theft. The SBI Crypto incident is part of a broader trend, with North Korean threat actors reportedly stealing a record $2 billion in cryptocurrency so far this year. These developments underscore the persistent threat posed by sophisticated cybercriminals and nation-state actors in the cryptocurrency ecosystem, as well as the evolving strategies of both criminals and law enforcement in the battle over digital assets. The growing landscape of seizable crypto assets presents both a challenge and an opportunity for authorities seeking to disrupt illicit financial flows. As criminals refine their methods, the need for advanced analytics and coordinated international enforcement becomes increasingly critical. The ongoing arms race between cybercriminals and law enforcement is likely to shape the future of digital asset security and regulation.
Jun 29, 2026
Law enforcement agencies in multiple countries have made significant progress in prosecuting individuals and groups involved in large-scale cryptocurrency-related cybercrimes. In the United States, a California man pleaded guilty to laundering at least $25 million as part of a group that stole $230 million in cryptocurrency through social engineering and account takeovers. The group, composed of young adults from several states and abroad, used various tactics to compromise victims' crypto accounts and launder the proceeds, with several members facing charges including wire fraud, racketeering, and money laundering. In the United Kingdom, prosecutors secured a civil recovery order to seize over £4.11 million ($5.39 million) in crypto assets from Joseph James O'Connor, who was convicted for his role in the 2020 Twitter mega-hack. O'Connor and his associates used SIM-swapping and social engineering to hijack high-profile Twitter accounts, soliciting Bitcoin from followers and amassing illicit gains. These actions demonstrate the increasing effectiveness of international law enforcement in tracing, prosecuting, and recovering assets from cybercriminals who exploit cryptocurrency for large-scale fraud and theft.
Jul 12, 2026
US authorities arrested **John Daghita** (online handle **“Lick”**) in Saint Martin for allegedly stealing **more than $46 million** in cryptocurrency tied to the **U.S. Marshals Service (USMS)**. The arrest was conducted in a joint operation between the **FBI** and France’s **Groupe d’Intervention de la Gendarmerie Nationale (GIGN)**, and reportedly involved the seizure of cash, hard drives, and security keys. Reporting links Daghita to a USMS digital-asset management contractor (CMDSS), and notes that blockchain investigator **ZachXBT** publicly traced USMS-linked wallet movements to addresses he associated with Daghita, helping bring attention to the alleged theft. Separately, South Korea’s **National Tax Service** reportedly lost roughly **$5 million** in seized cryptocurrency after officials circulated a press release that exposed a wallet’s **mnemonic recovery phrase/password**, enabling an unknown party to drain the funds. The incident was described as part of a broader pattern of **crypto custody lapses** in South Korean law enforcement, with additional cases cited involving missing seized bitcoin and investigations tied to potential phishing and internal control failures. Together, the incidents underscore that government-held digital assets remain a high-value target and that operational security failures (credential exposure, weak key management, and inadequate redaction/review processes) can directly translate into rapid, irreversible losses.
Jun 29, 2026