Cryptohack Roundup: Trump’s Crypto Wealth

Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, Trump’s crypto wealth, Mango Markets hacker sentenced for CSAM, Solana’s zero-day fix, French police rescued a crypto millionaire’s father from kidnappers, stolen bitcoin frozen, U.S. FTC sued IML and Kraken spotted a North Korean job applicant.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

U.S. President Donald Trump has significantly increased his family’s wealth through crypto ventures, with digital assets now accounting for nearly 40% of his estimated $7.3 billion net worth, said watchdog group State Democracy Defenders Action. A major portion stems from meme coins like $Trump and $Melania and a controlling stake in World Liberty Financial, which is a Trump-affiliated crypto exchange launched in October. Abu Dhabi-based MGX this week announced a $2 billion investment in the exchange’s stablecoin USD1.

The Trump family holds 60% of World Liberty and owns 22.5 billion $WLF tokens, earning 75% of future token revenues. Despite past criticism of digital currencies, President Trump now promotes the United States as the future “crypto capital,” loosening regulations and pardoning former BitMEX executives.

Avraham “Avi” Eisenberg, the man behind the $110 million exploit of decentralized finance platform Mango Markets, was sentenced to just over four years in prison last week – but not for the crypto scheme. The sentence stems from a separate conviction for possessing child sexual abuse material. Prosecutors discovered over 1,200 explicit images and videos on his devices during a search following his arrest. Eisenberg previously pleaded guilty to one count related to obtaining the material between 2017 and 2022.

Eisenberg in April last year was convicted of commodities fraud, wire fraud and market manipulation for exploiting Mango Markets in October 2022. He artificially inflated the price of Mango tokens by taking a large position, then borrowed other tokens based on inflated collateral, draining the platform (see: Jury Dishes Out Guilty Verdict in Mango Markets Fraud Case).

A zero-day vulnerability in certain tokens on the Solana blockchain was patched after the Solana Foundation privately coordinated with validators to deploy a fix. The vulnerability was addressed within two days with two separate fixes rolled out by the network’s validators. The vulnerability impacted the ZK ElGamal Proof program, which handles zero-knowledge proofs for confidential token transfers under Solana’s Token-2022 standard. The flaw could have enabled an attacker to mint unlimited tokens or steal from user accounts using forged proofs.

The Solana Foundation opted not to publicize the vulnerability until the patch was live. The Foundation said no funds were at risk and there were no known exploits.

French police rescued a kidnapping victim after a dramatic raid, foiling an extortion plot apparently tied to cryptocurrency wealth, reported Le Monde. The abducted man, said to be the father of a crypto entrepreneur, was held for ransom between 5 million and 7 million euros. French prosecutors said the attackers mutilated the victim, severing a finger, mirroring tactics seen in recent crypto-targeted assaults, including the violent 2023 attack on Ledger co-founder David Balland.

The abduction took place in Paris, when four masked men forced the victim into a delivery van in broad daylight. Authorities later arrested all five suspects, including a getaway driver, all in their 20s. Police confirmed that no ransom was paid prior to the man’s rescue.

The victim’s wife told investigators that her husband and son, owners of a Malta-based crypto marketing firm, previously received threats related to their crypto dealings. Earlier this year, a Canadian man was reportedly tortured and forced into hiding after assailants believed he held millions in crypto based on his online presence, though his actual holdings were far lower.

Onchain investigator ZachXBT said Friday that about $7 million of the $330 million in Bitcoin allegedly stolen from a longtime holder earlier this week has been frozen with the help of Binance’s security team and other forensic experts. The theft, which involved 3,520 BTC, marks one of the largest single heists in crypto history. ZachXBT first flagged the suspicious transfer, stating that stolen funds were quickly laundered through at least six exchanges and converted into the privacy coin Monero, causing its price to briefly spike. According to ZachXBT, the victim – described as an “elderly” U.S.-based “OG Bitcoiner” – fell prey to a social engineering attack, likely involving phishing tactics. The investigator later identified two suspects: a Somalian national known as “Nina/Mo,” who allegedly runs a scam call center in the United Kingdom, and an accomplice called “W0rk.” Both have since deleted their social media accounts.

The U.S. Federal Trade Commission and the state of Nevada filed a complaint against a firm accused of defrauding consumers out of more than $1 billion through deceptive investment training schemes tied to crypto, foreign currency exchange and stock trading.

The company, operating under various names including IYOVIA, IM Mastery Academy, iMarketsLive and IM Academy – collectively “IML”- allegedly lured consumers, especially young adults, with exaggerated earnings claims. According to the complaint, IML promised that salespeople could earn up to $750,000 per month, despite internal data showing most earned little to nothing. IML’s business model was built around multi-level marketing, requiring participants to recruit others to promote the firm’s training courses, which covered cryptocurrency, binary options and forex trading. The FTC said the firm aggressively targeted college students via social media. The scheme since 2018 has taken in approximately $1.2 billion from consumers, the government says.

U.S.-based cryptocurrency exchange Kraken recently uncovered an attempt by a North Korean hacker to infiltrate its engineering team. Instead of rejecting the applicant outright, Kraken said it subjected the candidate to multiple rounds of security and technical vetting to better understand the tactics employed by such threat actors. Kraken’s team used two-factor authentication tests and real-time location verification, including ID checks and local knowledge questions, to trip up the applicant. The hacker eventually faltered under scrutiny, revealing inconsistencies that exposed them as an imposter. Kraken later discovered the individual had assumed multiple identities to apply for jobs across the crypto sector, with some identities tied to sanctioned foreign agents.