Also: Trump Signs Pro-Crypto EO, Credix Disappears After $4.5M Hack
Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, include Do Kwon’s guilty plea, Trump’s crypto-linked executive order, Credix’s post-hack disappearance, $7M Odin.fun exploit and hackers using fake Firefox crypto wallet extensions for theft.
See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation
Terraform Labs founder Do Kwon pleaded guilty in Manhattan federal court to the charges of conspiracy to defraud and wire fraud. Terraform created the cryptocurrencies TerraUSD and Luna, whose 2022 collapse wiped out about $40 billion in value.
The 33-year-old South Korean entrepreneur initially faced nine charges, including securities and commodities fraud, but struck a deal requiring him to plea guilty to just one count of conspiring to commit fraud and one count of committing wire fraud. Prosecutors recommend a sentence of no more than 12 years, if he accepts responsibility. He could face up to 25 years when sentenced on Dec. 11.
Prosecutors said Kwon misled investors in 2021 about TerraUSD, a stablecoin meant to maintain a $1 value. When the coin lost its peg, he claimed the “Terra Protocol” algorithm restored stability. In reality, prosecutors alleged, he arranged for a high-frequency trading firm to secretly purchase millions of dollars’ worth of TerraUSD to artificially boost its price. These misrepresentations drove retail and institutional investment, inflating Luna’s market value to $50 billion by early 2022 before both coins collapsed.
Kwon in court admitted to making false statements and apologized, acknowledging he failed to disclose the trading firm’s role. His case is one of several high-profile prosecutions following the cryptocurrency market downturn of 2022.
U.S. President Donald Trump signed an executive order to protect financial institutions from federal regulators targeting them for working with the crypto industry. The order eliminates “reputational risk” as a basis for increased regulatory oversight, a practice critics say was used to unfairly “debank” crypto firms.
Credix, a decentralized lending project that lost about $4.5 million in an exploit, shut down its website and social media. It did so after promising to reimburse users within 24 to 48 hours, said blockchain security firm CertiK, suggesting an exit scam, where operators abandon the project and disappear with investor money. Assets have moved from sonic to ethereum, and parked in a few addresses (see: Credix Exploit Drains $4.5M via Admin Wallet Takeover).
Bitcoin-based memecoin launchpad Odin.fun lost about $7 million in a liquidity manipulation attack, said PeckShield. Hackers inflated token prices, then withdrew liquidity to cash out in bitcoin, causing deposits to drop sharply. Co-founder Bob Bodily said the treasury can’t fully cover losses but remaining funds are safe, and a compensation plan is in development. The exploit targeted the platform’s automated liquidity tool, with most attackers linked to Chinese entities.
A malicious campaign called GreedyBear infiltrated Mozilla’s Firefox add-ons store with 150 fake cryptocurrency wallet extensions, stealing around $1 million from users. Koi Security discovered the extensions, initially appearing harmless to gain approval and positive reviews, but keylogger updates state that wallet credentials and IP addresses were stolen. The operation links to Russian-language pirated software sites hosting malware like Trojans, info-stealers and ransomware, all controlled through a single server. GreedyBear’s use of AI helps attackers quickly scale and evade removal, the researchers said. The group is also targeting Chrome’s Web Store.
