✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Investment Banking/Venture
Breach intelligence, attack campaigns, and threat reports targeting the Investment Banking/Venture sector.
Explore Other Sectors
Investment Banking/Venture Threat Reports
Ostium's $23.75 Million Crypto Theft: A Wake-Up Call for DeFi Security
In July 2026, Ostium, a decentralized trading platform on the Arbitrum blockchain, suffered a significant security breach resulting in the theft of approximately $23.75 million from its liquidity provider vault. The attacker compromised off-chain infrastructure responsible for feeding price data into the protocol, submitting falsified price reports to artificially generate profits. This manipulation allowed the attacker to rapidly open and close large positions, effectively draining the vault. Notably, trader collateral held in separate contracts remained unaffected, and existing positions were preserved. This incident underscores the critical vulnerabilities associated with off-chain components in decentralized finance (DeFi) platforms. As DeFi continues to gain traction, the reliance on external data feeds presents a substantial risk vector. The Ostium breach highlights the urgent need for enhanced security measures and robust validation mechanisms to protect against similar exploits in the future.
14 hours ago
Kill Chain
US Charges Two Over $43 Million Investment Fraud Laundering
In July 2026, U.S. prosecutors charged Zhuoying Chen and Haojie Zhang, residents of New York, for orchestrating a sophisticated money laundering network between 2020 and 2022. The duo managed over a dozen individuals who opened approximately 140 bank accounts under 45 shell companies, facilitating the transfer of at least $43 million from cyber investment fraud victims to bank accounts in China. The fraudulent schemes involved contacting victims via social media, building trust, and persuading them to invest in fake opportunities, ultimately leading to significant financial losses. This case underscores the escalating threat of cyber-enabled financial fraud and the critical need for robust cybersecurity measures. With investment fraud accounting for 49% of all scam-related incidents in 2025, resulting in losses of $8.6 billion, organizations must prioritize the implementation of advanced security protocols to protect against such pervasive threats.
3 days ago
Kill Chain
Spanish Authorities Dismantle €140 Million Cyber Fraud Network
In July 2026, Spanish National Police dismantled a cybercrime network responsible for defrauding victims of approximately €140 million through various schemes, including man-in-the-middle attacks, CEO impersonation scams, and fake investment platforms. The operation led to the arrest of four key individuals across Spain, Portugal, and Panama, and the seizure of 15 computers and over 170 smartphones. Authorities also froze €3 million in illicit funds, which were returned to victims. The network utilized a complex money laundering apparatus involving 19 registered companies and nearly 1,000 financial accounts to conceal the origins of the stolen funds. This incident underscores the evolving sophistication of cybercriminal organizations and the necessity for robust cybersecurity measures. The use of advanced social engineering tactics and complex financial networks highlights the importance of international cooperation in combating cybercrime.
4 days ago
Kill Chain
Dutch Authorities Dismantle €100 Million Investment Fraud Network
In July 2026, Dutch authorities dismantled a sophisticated international investment fraud scheme that operated 20 call centers across multiple countries, employing over 700 individuals posing as financial advisors. The organization is estimated to have defrauded tens of thousands of victims, amassing over €100 million per month at its peak. The fraudsters built trust with victims over extended periods, introducing them to realistic-looking investment platforms that displayed fictitious profits. Victims were persuaded to increase their investments, often through cryptocurrency transfers, while the criminals siphoned the funds and presented fake dashboards showing inflated returns. This incident underscores the evolving complexity and scale of cyber-enabled financial fraud, highlighting the need for enhanced vigilance and regulatory measures in the financial sector. The use of sophisticated social engineering tactics and the exploitation of cryptocurrency platforms for illicit gains reflect broader trends in cybercrime, necessitating continuous adaptation of security strategies by organizations and individuals alike.
5 days ago
Kill Chain
OkoBot Malware Exploits Ledger and Trezor Apps to Steal Seed Phrases
In April 2025, the OkoBot malware framework emerged, targeting Windows users by infiltrating legitimate cryptocurrency hardware wallet applications such as Trezor Suite and Ledger Live. The malware's 'SeedHunter' module monitors for the launch of these applications, injecting malicious code that prompts users to enter their recovery seed phrases. This deceptive tactic enables attackers to gain unauthorized access to victims' cryptocurrency assets. Kaspersky's GReAT team reported that OkoBot has affected hundreds of users across more than 25 countries, with significant concentrations in Brazil, Vietnam, Canada, Mexico, and Turkey. The malware remains active as of July 2026, continually evolving its methods to exploit hardware wallet users. The persistence and adaptability of OkoBot underscore a broader trend of increasingly sophisticated attacks targeting cryptocurrency holders. This incident highlights the critical need for users to remain vigilant against phishing attempts and to adhere strictly to security protocols, such as never entering recovery phrases into software interfaces. The ongoing evolution of such malware emphasizes the importance of continuous security education and the implementation of robust protective measures within the cryptocurrency community.
5 days ago
Kill Chain
Spanish Authorities Dismantle €140 Million Cyber Fraud Network
In July 2026, Spanish authorities dismantled a cybercrime and money-laundering network responsible for defrauding €140 million through investment fraud and Business Email Compromise (BEC) schemes. The operation led to the arrest of four individuals across Spain, Portugal, and Panama. The criminals managed over 800 bank accounts, utilizing sophisticated social engineering tactics such as impersonating executives and issuing false invoices to divert funds into accounts they controlled. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spanish-police-take-down-140-million-cyber-fraud-ring-arrest-four/?utm_source=openai)) This incident underscores the escalating threat of BEC attacks, which exploit organizational trust and email communications to execute financial fraud. The substantial financial impact highlights the necessity for organizations to implement robust email security measures, employee training, and stringent verification processes to mitigate such risks.
6 days ago
Kill Chain
Protect Your Crypto Assets: Understanding the 'Ill Bloom' Vulnerability
In July 2026, blockchain security firm Coinspect disclosed a critical vulnerability named 'Ill Bloom' affecting cryptocurrency wallets across multiple blockchains, including Bitcoin, Ethereum, Polygon, Rootstock, Tron, and Solana. The flaw stems from weak randomness in the generation of recovery phrases in certain software wallets, particularly lesser-known mobile applications created as early as 2018. This vulnerability has led to unauthorized access and the draining of funds, with at least $5 million stolen since May 27, 2026, including $3.1 million from 431 wallets in a coordinated attack on that date. ([crypto-economy.com](https://crypto-economy.com/coinspect-flags-ill-bloom-vulnerability/?utm_source=openai)) The 'Ill Bloom' incident underscores the critical importance of secure cryptographic practices in wallet generation. It highlights the ongoing risks associated with software wallets that may not adhere to robust security standards, emphasizing the need for users to verify the security of their wallet applications and consider using hardware wallets or reputable software wallets with strong security measures to safeguard their digital assets.
1 week ago
Kill Chain
SCMBANKER Malware Targets Mexican Banks Using ClickFix Lures
In July 2026, a sophisticated cybercriminal operation targeted customers of Mexican financial institutions, including banks, fintech companies, payment processors, and cryptocurrency exchanges. The attackers employed a social engineering technique known as ClickFix, presenting victims with fake CAPTCHA verification pages that instructed them to execute a malicious command. This command installed a PowerShell-based toolkit named SCMBANKER, enabling the threat actors to monitor banking sessions, capture screenshots, manipulate clipboards, and deploy remote access tools for full system control. The campaign, identified by Elastic Security Labs as REF6045, demonstrated a high level of automation and adaptability, with evidence suggesting the use of large language models to develop the malware components. ([thehackernews.com](https://thehackernews.com/2026/07/scmbanker-malware-uses-clickfix-lures.html?utm_source=openai)) This incident underscores the evolving nature of cyber threats targeting the financial sector, particularly in Mexico. The use of AI-assisted malware development and advanced social engineering tactics like ClickFix highlights the need for continuous vigilance and adaptive security measures to protect sensitive financial data and maintain customer trust.
1 week ago
Kill Chain
JaredFromSubway MEV Bot Hacked: A $15 Million Crypto Heist
In June 2026, the Ethereum-based MEV bot known as JaredFromSubway suffered a $15 million loss after an attacker exploited its opportunity-detection logic. The attacker created fake cryptocurrency trading opportunities by deploying contracts designed to appear as profitable MEV opportunities. The bot, upon analyzing these deceptive routes, granted ERC-20 token approvals to contracts controlled by the attacker, who subsequently withdrew WETH, USDC, and USDT from the bot's contract via the transferFrom function. This incident underscores the vulnerabilities inherent in automated trading systems and highlights the need for robust security measures in the rapidly evolving DeFi landscape. As MEV bots continue to play a significant role in blockchain ecosystems, their susceptibility to sophisticated attacks poses ongoing risks to financial stability and trust in decentralized platforms.
4 weeks ago
Kill Chain
Crypto Heist Leveraging Fake Reputation Networks to Distribute Malware
In June 2026, cybercriminals orchestrated a sophisticated campaign to distribute a Rust-based clipboard hijacking malware targeting both Windows and macOS users. The attackers created a comprehensive fake reputation network, utilizing GitHub repositories, SourceForge projects, AI-generated YouTube videos, and manipulated VirusTotal comments to lend credibility to their malicious tools. These tools, masquerading as crypto trading and gambling aids, were designed to steal cryptocurrency by intercepting wallet addresses copied to the clipboard, affecting assets like Bitcoin, Ethereum, Monero, Binance Chain, and Solana. This incident underscores a significant evolution in cybercriminal tactics, highlighting their ability to exploit multiple trusted platforms to build false credibility and deceive users. The campaign's success demonstrates the urgent need for enhanced vigilance and skepticism towards online reputation signals, especially in the cryptocurrency domain, where the allure of quick profits can cloud judgment.
4 weeks ago
Kill Chain
USB Worm Targets Cryptocurrency Wallets via Windows Shortcut Files
In June 2026, a sophisticated USB worm emerged, targeting cryptocurrency wallets by distributing clipboard-stealing malware through Windows shortcut (LNK) files on USB drives. Upon execution, the malware scans the system for document files, hides the originals, and replaces them with malicious shortcuts. It monitors clipboard activity to detect and replace cryptocurrency wallet addresses with those controlled by the attacker, captures screenshots, and exfiltrates data via the Tor network. The worm also propagates by copying itself to newly connected USB devices, facilitating further spread. This incident underscores the evolving tactics of threat actors leveraging removable media to infiltrate systems, emphasizing the need for heightened vigilance and robust security measures to protect sensitive financial information.
1 month ago
Kill Chain
FBI Issues Warning on New Cryptocurrency Scam Involving In-Person Couriers
In June 2026, the FBI issued a warning about a new tactic in cryptocurrency investment scams, commonly referred to as 'pig butchering' or 'romance baiting.' Fraudsters initiate contact through social media, dating sites, and messaging apps, building trust with victims before introducing them to fake investment schemes. When traditional financial institutions block suspicious transactions, these scammers dispatch couriers to collect cash directly from victims, often using agreed-upon passwords or specific dollar bill serial numbers for identification. Victims are led to believe their investments are growing, but when they attempt to withdraw funds, they are prompted to provide additional cash for fraudulent taxes and penalties, perpetuating the cycle. This incident underscores the evolving nature of cryptocurrency scams, highlighting the shift towards in-person interactions to circumvent financial safeguards. The FBI's alert serves as a critical reminder for individuals to exercise caution when approached with unsolicited investment opportunities, especially those involving direct cash transactions facilitated by couriers.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports