Verdict in Tornado Cash Founder’s Case

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Tornado Cash co-founder convicted, Samourai Wallet founders’ guilty plea, Coinbase’s loss from insider data theft, a U.S. appeals court overturned an OpenSea executive’s NFT fraud conviction, AI-written NPM malware stole crypto, Credix exploit, Changpeng Zhao sought dismissal of FTX claim, July hacks and a crypto ATM warning from FinCEN.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

A U.S. federal jury convicted Tornado Cash Co-Founder Roman Storm of conspiring to operate an unlicensed money transmitting business that knowingly moved over $1 billion in criminal proceeds. The Manhattan jury convicted Storm following a four-week trial but deadlocked on more serious charges of money laundering and sanctions violations.

“The speed, efficiency, and functionality of stablecoins and other digital assets offer great promise, but that promise cannot be an excuse for criminality,” said U.S. Attorney Jay Clayton.

Prosecutors showed that Storm helped design, fund and promote Tornado Cash, which offers users untraceable crypto transactions. Despite being aware that the platform was used for laundering illicit funds, including proceeds from the Ronin hack tied to North Korea’s Lazarus Group, Storm continued to operate the service and profited from it. He and his co-founders cashed out over $12 million. The 36-year-old faces a maximum sentence of five years in prison.

The verdict drew criticism from crypto advocates, including the DeFi Education Fund, Blockchain Association and Coin Center, who argue the conviction sets a troubling precedent for open-source software developers. Critics contend Storm shouldn’t be held liable for how third parties used the Tornado Cash protocol.

Co-founders of the Samourai Wallet cryptocurrency mixing service Keonne Rodriguez and William Lonergan Hill pleaded guilty to conspiring to operate an unlicensed money transmitting business that facilitated over $200 million in criminal transactions.

Rodriguez, the CEO, and Hill, the CTO, admitted their service helped launder proceeds from darkweb markets, cyber intrusions, phishing scams and decentralized finance fraud. Designed using obfuscation tools such as Whirlpool and Ricochet, Samourai enabled users to disguise the origins of Bitcoin transactions.

The platform processed more than 80,000 bitcoin, valued at over $2 billion, generating at least $6 million in fees. Prosecutors said the founders actively encouraged criminal use, referring to the service as “money laundering for bitcoin” and promoting it to darkweb users. They urged hackers involved in a major social media breach to use Samourai to wash stolen funds. Both men face up to five years in prison and have agreed to forfeit over $237 million as part of their plea deal.

Coinbase disclosed a $307 million loss tied to a data breach involving offshore customer service agents bribed by cybercriminals to steal customer data for use in social engineering attacks, shows a second quarter earnings report.

The firm in May estimated losses could reach $400 million. This report marks the first concrete figure. Coinbase also saw a 26% drop in total revenue and a 39% decline in transaction revenue compared to the first quarter, with crypto spot volumes falling over 30%. Net income surged to $1.43 billion, up from $66 million last quarter and $36 million a year ago, driven in part by broader business diversification.

A U.S. federal appeals court overturned the fraud and money laundering convictions of former OpenSea Product Head Nathanial Chastain, previously sentenced in a landmark non-fungible tokens insider trading case.

A three judge panel on Court of Appeals for the Second Circuit ruled that the jury received flawed instructions, specifically that it could convict Chastain for misusing intangible business information not clearly defined as property. Chastain was accused of buying NFTs before they were featured on OpenSea’s homepage and reselling them for profits of up to five times the purchase price. He was convicted in May 2023 and sentenced to three months in prison. The court found that without a clear link to property rights, the jury might not have reached the same verdict. Chastain also alleged that OpenSea Co-Founder Devin Finzer had engaged in similar trading behavior, but the court barred that testimony as irrelevant and prejudicial.

The panel vacated the conviction and sent the case back to district court for further proceedings.

Security firm Safety uncovered a cryptocurrency-stealing malware campaign disguised as an NPM package titled NPM Registry Cache Manager.

The malicious code, tracked as “Kodane,” targets Windows, macOS and Linux systems, draining users’ crypto wallets and sending the funds to a Solana address. The malware masquerades as a utility for license validation and registry optimization.

Researchers believe the malware and its polished documentation was largely AI-generated, likely using Anthropic’s Claude model. Telltale signs include excessive use of emojis, unnaturally detailed comments, markdown styling quirks and repeated use of words like “enhanced.” Someone uploaded Kodane on July 28 but it was flagged within two days. By then, it had been downloaded over 1,500 times. Despite its Japanese name, the uploader’s time zone activity suggests origins in Russia or Central Asia. Nineteen variants were pushed out in just two days before removal from the registry.

Decentralized credit platform Credix suffered a $4.5 million exploit after a hacker gained control of an administrator wallet and used privileged permissions to mint unbacked tokens and drain liquidity pools. Security firms PeckShield and CertiK traced the breach to a Solana-based address with bridge-level authority, which allowed the attacker to mint fake Sonic USDC, borrow against it and bridge the assets to Ethereum.

The stolen funds were dispersed across fresh wallets, with no movement yet to exchanges. Credix acknowledged the breach, disabled its website to prevent further deposits and asked users to withdraw directly from smart contracts. The team promised full reimbursement within 24 to 48 hours but did not clarify the recovery mechanism. Based in Belgium, Credix operates as an onchain credit marketplace focused on emerging markets and has raised $73.7 million across four funding rounds.

Changpeng Zhao, co-founder and former CEO of Binance, has reportedly asked a U.S. bankruptcy court to dismiss a $1.76 billion claim brought by the FTX bankruptcy estate, arguing that he is not subject to U.S. jurisdiction and that the lawsuit improperly seeks to apply U.S. law to overseas transactions.

Zhao said he resides in the United Arab Emirates and said that the disputed crypto transfers stemming from a July 2021 equity buyback deal were cross-border in nature and fall outside the reach of American bankruptcy statutes. The lawsuit, filed in November 2024, alleges Zhao and Binance executives received improper payments when divesting their stakes in FTX. Zhao joins two other former Binance executives who filed similar motions to dismiss in July.

FTX’s lawsuit claims Binance previously held about 20% of FTX’s global operations and 18.4% of its U.S. arm. Zhao countered that Binance and FTX were briefly business partners and that any stake was returned in the form of crypto assets. He denied responsibility for Sam Bankman-Fried’s misconduct, calling the accusations “nonsensical.”

The crypto industry faced an uptick in hacking incidents in July, with attackers stealing approximately $142 million across 17 major breaches, said blockchain security firm PeckShield. This marks a 27% increase from June’s $111.6 million in losses.

The largest attack targeted Indian exchange CoinDCX, which lost $44.2 million after hackers tricked an employee into downloading malware through a fake part-time job offer. Bengaluru police said the malware compromised a company laptop, giving criminals access to crypto assets.

Decentralized trading platform GMX suffered a $42 million exploit but later recovered most of the stolen funds, including 10,000 ETH and 10.5 million Frax. Other significant breaches included BigONE at $28 million, WOO X at $12 million and Future Protocol at $4.2 million.

The U.S. Treasury’s Financial Crimes Enforcement Network warned that drug traffickers and scammers are increasingly using cryptocurrency ATMs, also known as convertible virtual currency kiosks, to launder illicit funds.

A FinCEN alert urged financial institutions to heighten scrutiny and report suspicious transactions involving these kiosks, which have become tools for laundering drug proceeds and running scams, particularly those targeting elderly victims. Intelligence from the DEA revealed that transnational cartels, including the Jalisco New Generation, are exploiting crypto ATMs to move drug money.

FinCEN Director Andrea Gacki said there was a need to protect the digital asset ecosystem and called on financial institutions as key allies in the effort. The agency also criticized widespread non-compliance among kiosk operators, many of whom lack basic anti-money laundering controls or fail to verify user identities.