Scams

On May 21, 2026, Ripple Chief Technology Officer David Schwartz cautioned the XRP community about a sharp uptick in AI-enabled scam campaigns, including deepfake videos and fake giveaways. He said schemes often push bogus XRP airdrops that lure users into sending funds or connecting noncustodial wallets to malicious sites that can rapidly drain holdings. Schwartz also described a separate phishing effort aimed at Robinhood users that leveraged Gmail address tricks and emails designed to look authenticated.

TRM Labs data published in May 2026 says North Korea was linked to $577 million of the $651 million lost to crypto hacks in January–April 2026, or 76% of the total. The losses were concentrated in two April incidents attributed to Lazarus subgroup TraderTraitor: $285 million from Drift Protocol on April 1 and $292 million from Kelp DAO on April 18–19.

Missouri Attorney General Catherine Hanaway's office said it filed a lawsuit Wednesday against GPD Holdings, which operates crypto ATMs under the CoinFlip brand, alleging the company knowingly facilitated fraudulent transactions. The state is asking the court to block CoinFlip from operating in Missouri, impose $1,000 per violation over the past five years (up to $1,826,000), and order restitution for consumers.

npm has revoked granular write-access tokens tied to compromised developer accounts in an effort to curb a new wave of the self-replicating “Mini Shai-Hulud” supply-chain worm. The platform also urged users to rotate secrets and move to Trusted Publishing, but researchers say infected machines can still leak data locally. The latest spike followed the compromise of the npm account “atool,” which published 637 malicious versions across 323 packages in 27 minutes.

Turkey expanded an eight-day crackdown on illegal betting with two May 18 raids in Antalya and Mersin that brought legal action against 233 additional suspects and cited more than TL 18 billion ($395 million) in alleged transaction volume. Across four major raids since May 11, authorities say the total has exceeded 670 suspects, while an earlier Adana case alleged that cryptocurrency platforms were among the channels used to launder proceeds.

Echo Protocol said Tuesday it is investigating a security incident affecting its Echo bridge on Monad and has suspended all cross-chain transactions after about 1,000 unauthorized eBTC was minted. The attacker moved part of the proceeds through Curvance and ultimately sent 384 ETH to Tornado Cash, while still holding 955 eBTC, according to DeBank.

Adshares said an attacker involved in its bridge incident returned 256 ETH (about $540,700), roughly 86% of the estimated $628,000 taken. The exploit was linked to bridge mint-validation failures, and analysts warned that recovery windows often trigger phishing “refund” sites and impersonator accounts.

Posts on X claiming a "10 million" Ripple USD (RLUSD) "Season 1" giveaway are not tied to the XRP Ledger Foundation or Xaman and are part of a coordinated phishing operation. The campaign relies on bot networks that mass-tag users, funneling them to fake sites that prompt wallet connections and malicious signing. Community figures also warn that Ripple and the real XRPL Foundation do not run surprise token airdrops or request seed phrases.

Bitcoin developer Jameson Lopp warned crypto holders on May 17, 2026 to adopt a “zero trust” stance toward incoming communications after a phishing method abused Google Forms notifications. He said attackers can use official-domain emails, oversized text fields, and Google Sites-hosted pages to make fake security alerts look legitimate. Lopp listed five channels he would no longer trust for inbound messages: email, phone calls, SMS, messengers, and other external notifications.

Binance Research said data current as of May 13, 2026 shows more than US$75B in illicit crypto remains trapped on-chain, even though such activity stays below 1% of total transaction volume. The report argues tighter KYT/KYC checks, stablecoin freezes and seizures have narrowed exit routes, while mixer capacity is capped at about $10M per day, implying a multi-decade backlog if mixers were the only outlet.