Ariomex Leak Flags Iran Sanction Risks

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, Iran exchange leak, $580 million frozen in scam crackdown, $61 million scam funds seized, feds filed to seize $327,000 in a dating scam case, Russian exploit broker sanctioned, South Korean police exposed recovery phrase, South Korea bitcoin theft arrests, Axiom data misuse and a Uniswap lawsuit ended.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

A leaked database from Iranian cryptocurrency exchange Ariomex shows the platform may have played a role in sanctions evasion and large-scale crypto transfers linked to actors connected to Iran, said cybersecurity firm Resecurity.

Researchers examined records from 2022 to 2025 containing user data, transaction histories and more than 14,000 support chats. The dataset included about 11,826 user records, roughly 7,700 of which originated from Iran. Investigators found that around 70% of transactions involved stablecoins or tokens on the TRON network, primarily Tether or USDT, with smaller shares involving bitcoin and ether.

Most transactions were relatively small, suggesting many users purchased stablecoins to protect savings from the devaluation of the Iranian currency. Researchers also identified numerous requests to transfer or exchange unusually large sums, often between $50,000 and $100,000 daily – amounts that far exceed typical income levels in Iran and may indicate sanctions evasion or money laundering.

Analysis uncovered multiple users attempting to move millions of dollars through the platform. In one case, a user sought to deposit $3 million with assistance from an Iranian embassy. Other users discussed exchanging between $1 million and $5 million. Some accounts also appeared to lack complete identity information despite conducting large transactions.

Resecurity also identified 27 possible matches between exchange users and individuals sanctioned by the United States, though limited identifying data prevented definitive confirmation. The researchers said that platforms like Ariomex could function as shadow financial channels enabling sanctioned actors to move funds through cryptocurrency.

U.S. authorities have seized or frozen more than $580 million in cryptocurrency tied to transnational criminal organizations operating large-scale online fraud scams, said the U.S. Attorney’s Office for the District of Columbia. The action follows a three-month enforcement effort by the Scam Center Strike Force, a multiagency effort formed in November to coordinate action against offshore romance scams.

The task force includes the Department of Justice’s Criminal Division, the FBI, the Secret Service and IRS Criminal Investigation. Officials said the seized assets are linked to scams run by Chinese organized crime groups operating in compounds in Myanmar, Cambodia and Laos.

Fraudsters contact victims through social media or text messages, build trust and direct them to fake crypto investment platforms that display fabricated profits. Many workers inside the scam compounds are trafficking victims forced to carry out the fraud. Prosecutors plan to pursue forfeiture and return recovered funds to victims where possible (see: Breach Roundup: Cambodia Scam Center Crackdown).

U.S. federal prosecutors seized more than $61 million in USDT linked to a large-scale cryptocurrency romance fraud. The U.S. Attorney’s Office for the Eastern District of North Carolina said investigators traced the funds to crypto wallets used to launder money stolen from victims of the scam.

Agents from Homeland Security Investigations tracked victim payments through a network of blockchain addresses and identified wallets still holding significant balances eligible for seizure and forfeiture. Prosecutors said scammers built trust with victims through fake romantic relationships before promoting fraudulent crypto investment opportunities on bogus trading platforms that displayed fabricated profits.

When victims attempted to withdraw funds, scammers blocked them or demanded additional “taxes” or “fees.” The criminals then moved the stolen assets through multiple wallet layers to hide their origin.

U.S. federal prosecutors filed a civil forfeiture action to seize about $327,829 in Tether linked to an alleged online romance scam targeting a Massachusetts resident. The U.S. Attorney’s Office in Boston said the case began in 2024 after investigators uncovered what they described as a crypto-related investment fraud.

The prosecutors said the victim met a person using the name Linda Brown on a dating app and communicated with them for several weeks. Brown later introduced a supposed cryptocurrency investment opportunity and persuaded the victim to transfer funds. The authorities said the suspect directed the money to wallets controlled by Brown or associates.

When the victim attempted to withdraw the investment, they discovered the scheme was fraudulent. Investigators traced the stolen funds through multiple cryptocurrency wallets before they were converted into Tether and used in money-laundering transactions. Prosecutors are now seeking to forfeit the funds through the courts as part of the ongoing case.

The U.S. Department of the Treasury sanctioned Russian company Operation Zero and its founder Sergey Sergeyevich Zelenyuk after authorities linked the firm to the theft of U.S. trade secrets. Treasury’s Office of Foreign Assets Control said Operation Zero buys and sells software exploits.

The sanctions follow a Department of Justice investigation in which Australian national Peter Williams admitted stealing proprietary software from his U.S. defense contractor employer and passing it to Operation Zero in exchange for millions of dollars in cryptocurrency. Williams pleaded guilty to two counts of trade secret theft.

OFAC also sanctioned five individuals connected to the company, including Zelenyuk’s assistant Marina Evgenyevna Vasanovich. Treasury officials said the move marks the first use of authorities under the Protecting American Intellectual Property Act, a 2023 law that allows the U.S. government to sanction foreign entities that steal or benefit from stolen American trade secrets.

South Korea’s National Tax Service accidentally exposed the recovery phrase of a seized cryptocurrency wallet in a public press release photo, after which digital assets theoretically worth about $4.8 million were moved from the wallet, reported local media.

The agency published images while announcing asset seizures from 124 tax delinquents. One photo showed a Ledger cold wallet alongside a sheet displaying the wallet’s mnemonic recovery phrase, which appeared fully visible. Anyone with the phrase can restore and control the wallet.

Blockchain data later showed that about 4 million Pre-Retogeum or PRTG tokens were transferred to another address shortly after the image was released. The party moving the funds first deposited a small amount of ETH to cover transaction fees before sending the tokens in three transactions.

South Korean police have reportedly arrested two individuals accused of stealing 22 bitcoin from law enforcement custody, assets originally seized during a 2021 investigation (see: Seoul Police Lose Track of 22 Seized Bitcoin).

The Gyeonggi Northern Provincial Police Agency told local media the suspects allegedly accessed a cold wallet stored at Gangnam Police Station and transferred the funds, valued at about $1.5 million at current prices.

Authorities had confiscated the bitcoin while investigating the A Coin Foundation, which reported the disappearance of 700 million units of its token. Local media reports said police improperly stored the seized crypto on a cold wallet supplied by the foundation rather than on a government-managed device. Investigators believe individuals linked to the foundation used the wallet’s mnemonic recovery phrase to access and move the funds.

Officials said the investigation is ongoing and did not confirm whether the bitcoin has been recovered. The detective who led the original case is already serving a prison sentence after a court convicted him in 2024 of accepting bribes from foundation officials.

Blockchain investigator ZachXBT has alleged that employees at crypto trading platform Axiom misused internal tools to access and track private user wallet data, following speculation about potential insider trading at the firm.

A senior business development employee known as “Broox” allegedly used customer support tools to view wallet addresses linked to specific users and track traders through referral codes, wallet addresses or user IDs. The employee shared screenshots from internal dashboards and helped compile lists of wallets belonging to prominent crypto influencers. Some individuals confirmed the accuracy of wallet data shown in the leaked images.

The investigation also claims the employee discussed using privileged data to profit from trades. Axiom reportedly told ZackXBT that it removed employee access to the tools after learning of the allegations and launched an internal review.

A U.S. federal judge dismissed claims in a putative class action lawsuit against Uniswap Labs and its founder Hayden Adams, ending litigation that sought to hold the decentralized exchange developer liable for scam tokens traded on its protocol.

Judge Katherine Polk Failla of the U.S. District Court for the Southern District of New York ruled that plaintiffs cannot hold the company responsible for fraudulent activity by third-party token issuers. Investors had alleged losses from rug pulls and pump-and-dump schemes, and argued that the platform enabled the fraud by connecting buyers and sellers.

The court rejected that argument, finding that providing a platform or writing smart contract code does not amount to substantial assistance in fraud. The lawsuit, first filed in 2022, previously included federal securities claims that courts dismissed in 2023. The latest ruling dismisses the remaining state-law claims with prejudice, closing the case.