Cryptohack Roundup: Season’s Greetings With SantaStealer

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, SantaStealer resurfaced as an infostealer, police took down a crypto platform accused of money laundering, Terra founder Do Kwon sentenced, Bitcoin Rodney faced fraud and money laundering charges. The United Kingdom may regulate crypto by 2027 and Binance warned of fake listing agents.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

Security researchers at Rapid7 identified SantaStealer, a newly advertised malware-as-a-service information stealer promoted on Telegram and hacker forums.

Marketed as in-memory malware designed to evade file-based detection, SantaStealer is a rebranding of the earlier BluelineStealer malware. Subscriptions are $175 per month for a basic tier and $300 for premium access.

After analyzing multiple samples and gaining access to the affiliate web panel, researchers found that the malware does not live up to its claims of stealth or advanced evasion. Researchers say the leaked samples are easy to analyze and reveal weak operational security.

SantaStealer includes 14 modular components that steal browser data, credentials, cryptocurrency wallets, messaging app data, documents and screenshots. It archives stolen data in memory and exfiltrates it to a hardcoded command-and-control server. Its distribution method is unclear, but Rapid7 said that phishing, pirated software and social engineering are likely vectors.

Federal prosecutors announced the seizure of crypto platform E-Note after investigators linked it to money laundering by transnational cybercriminal organizations.

The FBI said more than $70 million of illicit proceeds – the takings from ransomware extortion and account takeovers – have flowed through the E-Note payment service and money mule network.

Along with E-Note takedown, prosecutors unsealed an indictment against its alleged owner, Russian national Mykhalio Petrovich Chudnovets, 39. He faces one count of conspiracy to commit money laundering and a demand to forfeit all of his criminal takings. Prosecutor say he began offering money laundering services to cybercriminals in 2010.

An international police operation involving U.S., German and Finnish police resulted in the seizure of servers hosting e-note.com, e-note.ws and jabb.mn, as well as mobile applications and data about Chudnovets’ operation. “U.S. law enforcement separately obtained earlier copies of Chudnovets’ servers, including customer databases and transaction records,” the Department of Justice said.

A U.S. federal judge sentenced Terraform Labs founder Do Kwon to 15 years in prison for his role in the 2022 collapse of the TerraUSD stablecoin and its sister token Luna, an event that erased roughly $40 billion from the crypto market. The sentence, handed down in the Manhattan federal court, exceeded the 12-year term sought by prosecutors and far surpassed the five years requested by Kwon’s defense.

U.S. District for the Southern District of New York Judge Paul Engelmayer said Kwon knowingly misled investors about the stability and risks of the tokens. Prosecutors argued that Kwon lied about TerraUSD’s algorithmic design, which relied on a flawed mechanism tied to Luna to maintain its peg. When TerraUSD unraveled, it triggered a broader contagion across the crypto sector.

Kwon pleaded guilty in August to wire fraud and conspiracy to defraud, reducing his potential sentence from a maximum of 135 years to 25. His case followed an international pursuit that ended with his extradition to the U.S. in late 2024.

Federal prosecutors expanded charges against Rodney Burton, a 56-year-old crypto promoter known as “Bitcoin Rodney,” for his alleged role in the $1.8 billion HyperFund cryptocurrency scheme. A superseding indictment unsealed in Maryland charges Burton with conspiracy to commit wire fraud, multiple wire fraud counts, money laundering and operating an unlicensed money transmitting business. If convicted on all counts, he faces decades in federal prison.

Prosecutors allege that Burton and others promoted HyperFund, also called HyperVerse, as a legitimate crypto investment platform from 2020 to 2024, promising daily returns of up to 1% based on nonexistent cryptomining operations. Authorities say the scheme blocked withdrawals beginning in 2021 and that Burton spent investor funds on luxury properties, cars and a yacht.

Burton was arrested in January 2024 while attempting to leave the United States and has since remained in custody. He claims he believed the business was legitimate and blames co-founder Sam Lee, who remains at large.

The British government reportedly plans to bring cryptocurrencies under full financial regulation by 2027, placing them on a similar footing to traditional products such as stocks and shares. The HM Treasury is drafting legislation that will require crypto firms, including exchanges and digital wallet providers, to meet regulatory standards overseen by the Financial Conduct Authority, The Guardian reported.

Ministers say the move will close gaps in consumer protection, improve transparency, strengthen the government’s ability to detect suspicious activity, enforce sanctions and hold companies accountable. Chancellor of the Exchequer Rachel Reeves framed the reforms as essential to securing the U.K.’s role as a global financial hub, while giving firms regulatory clarity and consumers stronger safeguards.

The proposals come amid rising concern over crypto-related investment scams, which U.K. banking data shows surged sharply over the past year. High-profile cases, including the seizure of billions of pounds’ worth of bitcoin linked to fraud, have underscored the risks. The government is also considering banning political donations made in cryptocurrency due to traceability concerns.

Binance has published an update clarifying how crypto projects can seek listings across its Web3 token discovery portal Alpha, futures and spot markets. Third-party “listing agents” claiming influence over the process are engaging in fraud, it said.

The exchange said projects must apply only through Binance’s official channels, adding that it does not authorize external brokers or intermediaries.

According to Binance, individuals and firms have repeatedly misrepresented themselves as Binance-connected facilitators, often charging fees or soliciting payments from token teams. In response, the company published its formal listing framework, urged projects to report suspicious approaches and said it has blacklisted several parties following an internal audit.

Binance put seven entities and individuals on its blacklist and said it may pursue legal action. The exchange is also offering rewards of up to $5 million for verifiable evidence of listing-related misconduct.

With reporting by Information Security Media Group’s David Perera in Northern Virginia.