Loading story…
Check Point Research reported that scammers and attackers used fraudulent crypto tokens and misconfigured smart contracts to steal funds from investors and liquidity pools. The activity included tokens with hidden or adjustable buy and sell fees, owner-controlled anti-sell mechanisms, and minting functions that let creators manipulate supply or trap holders. Examples included the M3 token’s concealed fee logic and the MINI BASKETBALL token’s owner-controlled restrictions that could prevent users from selling.
The report also detailed exploits tied to weak contract design and operational failures. In one case, the Levyathan contract was compromised after an exposed private key and flawed emergencyWithdraw logic were abused, while the Zenon Network incident involved an externally callable burn function that was exploited to drain about $814,570. Researchers urged users to rely on established exchanges and tokens and to verify marketplace URLs carefully to reduce exposure to token fraud, phishing, and smart-contract abuse.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published an analysis describing fraudulent token patterns and smart-contract misconfigurations used to steal investor funds, including the M3, MINI BASKETBALL, Levyathan, and Zenon Network cases.
The report states that scammers obtained $14 billion in cryptocurrency in 2021, providing broader context for the scale of crypto fraud.
The report states that the Zenon Network lost approximately $814,570 after an attacker abused an externally callable burn function, manipulated the token's internal pricing logic, and drained the liquidity pool.
Check Point Research found that Levyathan also had an emergencyWithdraw flaw using rewardDebt instead of user.amount, and said attackers exploited it multiple times with more than 57 observed calls.
After obtaining the exposed MasterChef private key, an attacker minted millions of tokens and later withdrew all funds from the Levyathan contract.
According to the report, a Levyathan developer mistakenly uploaded the MasterChef contract private key to the project's GitHub repository, exposing control of the contract.
The report identified MINI BASKETBALL as a token whose transfer logic initially prevented anyone from selling and later allowed only two addresses to sell. Check Point said the token had more than 3,500 buyers and over 14,000 transactions.
Check Point Research said the M3 token contract contained a hidden fee mechanism and that its operators initially set the fee parameter to 8 before later changing it to 99 after blockchain tools had scanned the contract.
The article references the SQUID token scam, which BBC reported stole $3.38 million from crypto investors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as **AI token jacking**. The activity has generated nearly **$1 million in fraudulent charges** before some victims detected the abuse, with malicious infrastructure in some cases driving **tens of millions of API calls per day**. Stolen credentials are being monetized directly and also funneled through gray-market **"transfer stations"** that resell access to legitimate AI services using compromised or discounted accounts. The stolen keys are being obtained through **phishing**, **infostealer malware**, exposed file shares, public code repositories, and poisoned software packages, including self-propagating `npm` packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Aug 19, 2026
A cryptocurrency theft campaign used at least nine YouTube tutorials purporting to teach users how to create Claude-powered arbitrage bots. The videos directed viewers to counterfeit compiler websites styled after Remix, which silently substituted the displayed benign smart-contract code with Ethereum drainer code. From February 12 through August 11, 224 wallets deployed and funded 234 malicious contracts, sending **274.60 ETH**—about **$517,205** at the time of transfer—to six operator-controlled collection addresses. The fraud bypassed common wallet protections because victims themselves deployed the contracts and authorized the transfers, rather than signing conspicuous malicious approvals or interacting with phishing domains. Operators used AI-generated presenters and voices, near-identical scripts, fabricated testimonials, and fake error messages to make the tutorials credible and encourage additional deposits. TRM Labs traced stolen funds through decentralized swaps, cross-chain bridges, and at least one mixer; it found no centralized exchange in the observed outbound flow. Earlier versions of the scheme used ChatGPT branding, indicating a reusable AI-themed lure.
Sep 18, 2026
**Step Finance**, a Solana-based DeFi platform and analytics dashboard, reported a breach in which attackers **compromised devices belonging to company executives** and used that access to drain multiple **treasury wallets**. The incident was detected on **January 31**, with the threat actor described as leveraging a **“well-known attack vector,”** though Step Finance did not publicly disclose the specific technique or attribution. Initial third-party estimates from blockchain analytics firm **CertiK** put the theft at **261,854 SOL (~$28.9M)**, but Step Finance’s internal investigation later assessed total losses at **~$40M**. Step Finance said it has recovered **~$3.7M in Remora assets** and **~$1M in other positions** through partner coordination and **Token22 protections**, temporarily halted some operations to reinforce security, and stated that **Remora Markets is isolated** from the incident with **rTokens remaining 1:1 backed**; users were also advised **not to engage with the `STEP` token** until the investigation concludes.
Jun 29, 2026