Alleged Fraud Kingpin Deported to China

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, an alleged fraud kingpin deported to China, Bitfinex hacker gained early release, Unleash Protocol’s $3.9M hack, TRM tied crypto thefts to the LastPass breach, Trust Wallet’s link to the Sha1-Hulud attack, Flow’s NFT loan fallout, Ledger’s data exposure and Kontigo reimbursements.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

A businessman accused by U.S. authorities of running a massive crypto fraud network has reportedly been detained in Cambodia and deported to China, months after U.S. prosecutors moved to seize billions of dollars in bitcoin allegedly linked to his operations. Cambodian officials said that Chen Zhi, founder and chairman of the Prince Group conglomerate, was arrested and transferred to China at Beijing’s request following a joint investigation. Authorities did not say whether Chen will face charges in China (see: Cambodian Conglomerate a ‘Pig Butchering’ Outfit, Says US).

U.S. prosecutors allege Chen oversaw forced-labor scam compounds in Cambodia that generated billions of dollars through cryptocurrency investment and romance scams. In October, the U.S. Department of Justice filed its largest-ever forfeiture action, seeking to seize roughly $15 billion in bitcoin and additional assets tied to the alleged scheme. The case has taken on geopolitical dimensions, with Chinese officials disputing aspects of the U.S. seizure and claiming links to an earlier bitcoin theft (see: China Accuses US of $13B Theft).

TRM Lab’s Ari Redbord wrote on LinkedIn that Chi’s transfer to China “marks a major inflection point in one of the most significant transnational financial crime cases ever pursued by U.S. authorities.” Should China prosecute Chen, “from a U.S. perspective, justice would be incomplete: assets seized and networks disrupted, but no defendant standing trial in a U.S. courtroom.”

Ilya Lichtenstein, the Russian-U.S. national who hacked crypto exchange Bitfinex and stole nearly 120,000 bitcoin, was released from prison early under the First Step Act, a bipartisan prison-reform law signed by U.S. President Donald Trump. Lichtenstein, 38, pleaded guilty to a money laundering conspiracy charge and admitted to the 2016 Bitfinex hack. A federal court sentenced him in November 2024 to five years in prison, with credit for time served following his 2022 arrest.

Lichtenstein said on social media he is now on home confinement. Lichtenstein’s wife Heather Morgan, who also pleaded guilty to helping launder the stolen funds, confirmed his release.

TRM Labs global head of policy Ari Redbord clarified that the move to home confinement does not reflect a pardon or commutation by Trump. Redbord said the First Step Act, passed by Congress in 2018, allows the Bureau of Prisons to award earned time credits and transfer inmates into prerelease custody. The sentence itself remains in effect and supervision continues, only the place of confinement has changed.

Morgan, who also pleaded guilty to laundering the stolen funds, was sentenced to 18 months and has also been released early under the same law.

Unleash Protocol, a decentralized platform that tokenizes intellectual property for use in decentralized finance, suffered a loss of about $3.9 million following an unauthorized smart contract upgrade. The company said an externally owned address gained signing authority to act as an administrator within Unleash’s multisig governance system. Using that access, the attacker modified a contract without approval, enabling asset withdrawals outside established governance processes.

The exploit allowed the removal of multiple assets, with blockchain security firm PeckShield Alert, estimating the total losses at roughly $3.9 million. After the withdrawals, the attacker bridged the funds through third-party infrastructure and ultimately deposited funds into Tornado Cash to obscure transaction trails.

Unleash Protocol has paused operations, engaged external security experts and begun investigating the incident.

Blockchain intelligence firm TRM Labs says a wave of cryptocurrency thefts in 2025 can be traced back to the 2022 LastPass breach, with attackers draining wallets months or years after encrypted password vaults were stolen. LastPass disclosed that attackers compromised a developer environment and later accessed encrypted customer vault backups. Some vaults contained cryptocurrency private keys and seed phrases along with passwords.

Although the vaults were encrypted, TRM says weak or reused master passwords allowed attackers to crack them offline over time. Rather than immediate theft, wallets were drained in delayed waves, indicating the attackers already possessed the private keys.

TRM traced the stolen funds as attackers converted assets to bitcoin, laundered them through Wasabi Wallet’s CoinJoin feature and cashed out via Russian-linked exchanges. TRM estimates more than $35 million was stolen across multiple waves.

Trust Wallet says the theft of roughly $8.5 million from more than 2,500 wallets likely links to the industry-wide Shai-Hulud supply chain attack that surfaced in November. The incident stemmed from a compromise of Trust Wallet’s Chrome browser extension. Attackers exposed developer GitHub secrets, gaining access to the extension’s source code and a Chrome Web Store API key. With full access, they uploaded a Trojanized version of the extension without Trust Wallet’s internal approval process.

The attackers embedded malicious JavaScript into version 2.68.0, which harvested sensitive wallet data and enabled unauthorized transactions. They also registered lookalike domains to host the malicious infrastructure referenced by the extension. Trust Wallet revoked release APIs, took down the malicious domains and began reimbursing affected users.

The aftermath of a Dec. 27 exploit on the Flow blockchain continues to disrupt the ecosystem, with non-fungible token-backed lending among the hardest-hit sectors. Although the Flow Foundation said user balances were not affected, its decision to pause the Cadence execution environment until Dec. 29 prevented users from transacting, including repaying loans that matured during the outage.

Flow-based NFT lending platform Flowty said 11 loans matured during the pause. One loan repaid automatically, eight defaulted and two failed to settle due to exploit-related account restrictions. Even after the network resumed, ongoing issues including limited token swapping have left borrowers unable to acquire assets needed for repayment.

To prevent further forced defaults, Flowty paused all loan settlements on Dec. 30. Loans maturing during this period remain outstanding without default or interest accrual. Flowty has also disabled new loan listings until broader network functionality stabilizes.

Ledger warned customers of a new data exposure involving personal information after a security incident at Global-e, a third-party e-commerce and logistics provider used for international orders. According to an email shared on social media by blockchain investigator ZackXBT, the incident involved unauthorized access to order data that included customer names and contact details, though the total number of affected users has not been disclosed.

Ledger told The Block that it was notified of the incident and said the exposed data related to purchases made on Ledger.com, where Global-e acts as the merchant of record. The company said that its own systems were not breached and that its hardware wallets, software and self-custodial architecture were secure. Ledger also said no payment information or cryptocurrency-related secrets, including recovery phrases, were compromised.

Latin America-focused stablecoin banking startup Kontigo said it contained a security breach over the weekend and fully reimbursed affected users, returning $340,905 in stablecoins to 1,005 customers by Jan. 6. The company disclosed the incident on Jan. 5, with co-founder and CEO Jesus A. Castillo saying his own account was compromised. Castillo said Kontigo took responsibility for the breach, asserting that the company has identified the attackers and they would face consequences.

The incident comes amid an aggressive growth push for the startup. In late December, Kontigo announced a $20 million seed round led by FoundersX Ventures and outlined plans to expand rapidly across emerging markets. The company, founded less than a year ago and backed by Y Combinator, says it has reached $30 million in annualized revenue, processed over $1 billion in payment volume and grown to more than 1 million active users with a small team.