Binance Says Fake Job Interview Compromised Employee
The reported attack targeted an employee through social engineering, putting internal access controls in focus.
Scams are the cost of doing business in crypto — and one of the few risks this market can't route around with a hardware wallet. The Scams beat at Zipp tracks how fraud operators find victims, where the money actually flows, and which enforcement actions, on-chain analytics, or platform changes are closing the gap. We cover the full range: Rug pulls and exit scams on newly launched tokens, phishing campaigns that drain wallets through fake websites or signatures, address-poisoning attacks that rely on copy-paste mistakes, fraudulent airdrops engineered to capture approvals, and large Ponzi schemes that surface only when authorities step in.
A crypto reader needs this beat because the threat surface changes weekly, and the same headline can mean different things depending on the venue. A "whale moving funds to an exchange" might be a routine rebalance, an over-the-counter desk trade, or the prelude to a dump. A "flash crash on launch" can signal thin liquidity, a coordinated exit, or a misconfigured emission. Zipp's newsroom follows suspicious-transaction reports from firms like TRM Labs, Chainalysis, and Elliptic, court filings, exchange and stablecoin issuer statements, and project governance votes tied to team-held supply — and we publish what we confirm, not what influencers amplify.
Day to day, we watch address-poisoning campaigns targeting high-value BTC and ETH holders, fake-airdrop lures around trending tickers like SOL ecosystem projects, SIM-swap rings operating across borders, and regulatory moves that shift liability (recent examples include U.S. state-level rules making crypto ATM operators responsible for scam refunds). When a major incident breaks — a suspected rug pull, a seized-funds transfer between wallets, or a DOJ case that gets dropped or revived — we publish the on-chain evidence alongside the court record so readers can judge for themselves.
The reported attack targeted an employee through social engineering, putting internal access controls in focus.
The warning to avoid documentation links keeps phishing risk in focus while the investigation continues.
The incident highlights how a compromised developer portal can put users at risk even inside a device’s curated app store.
The case exposes how public filing systems can be misrepresented as regulatory approval, while more than $100 million in alleged losses remains unresolved.
The incident exposes how a compromised developer tool can put credentials within reach, even when attackers have not been shown to target crypto specifically.
The resolution widens the stated anti-corruption focus to cross-border capital and illicit-asset recovery, putting virtual currency and blockchain activity under scrutiny.
The affected sites shared Name.com as registrar, but responsibility remains disputed. The incident highlights how a compromised frontend can put wallet users at risk even when protocol contracts are…
An unlocked iPhone gave thieves access to crypto wallets, bank cards and trading accounts, showing how a street robbery can quickly become a financial breach.
Users who connected wallets or signed approvals on affected sites may need to revoke permissions and move funds.
The laundering combines automated wallet loops with steeply discounted swaps, while 18,270 BTC remain spread across 19 addresses.
The case shows how control of digital assets can become a target in violent, in-person crimes, extending custody risk beyond online theft.
The device has not been verified, but Trezor is urging affected buyers to create new wallets and move funds while its investigation continues.
Bloom says it fully refunded nine affected users, but the unresolved question is how wallet signing authority was accessed and whether any old keys remain exposed.
The alleged selling followed major exchange listings, putting scrutiny on token distribution and team-wallet controls.
The designations expose how disguised IT wages can become weapons-program revenue, while adding eight Ethereum and Tron addresses to the sanctions watchlist.
The case exposes how salaries from fraudulent remote jobs can move through stablecoins and Russian intermediaries into a sanctions-evasion pipeline.
A trusted sender’s account or device can be compromised, so familiarity alone is not a reliable reason to open a link or file.
The incident shifts attention from wallet security to third-party exposure, with contact data potentially enabling targeted phishing and social engineering.
The incidents highlight the persistence of social-engineering threats and the security burden facing exchanges as attackers target employees and users.
The affected-user count remains unknown, while legacy order data may have exposed customer information even though Passport devices and private keys were not compromised.
A rug pull is when the team behind a token project removes liquidity or sells its holdings, leaving buyers with a worthless asset. It is most common on newly launched tokens where developers retain a large share of the supply or control the liquidity pool.
Attackers send a tiny transaction from a wallet address that matches the first and last characters of a victim's real contacts, hoping the victim copies the wrong address during a future transfer. The attack relies on visual similarity, not on any code exploit.
It is a fraud that pays early participants with funds from new investors rather than with real revenue, and it collapses once inflows slow down. Crypto Ponzi cases are typically uncovered by chain analytics or whistleblower complaints rather than by users spotting the math.
Yes, established projects use airdrops to distribute tokens to active users, but the same word is also used by scammers to lure victims into signing malicious wallet approvals. Always verify the contract address and the official project channel before claiming.