FCA Outlines UK Crypto Rules

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, the U.K. FCA mapped a path to full crypto regulation by 2027. iComTech promoter sentenced in Ponzi case, the U.S. Securities and Exchange Commission sought long-term public company bans for former FTX and Alameda executives, a trader lost $50M in USDT in an address poisoning scam and a Brooklyn man indicted over $16M Coinbase phishing scam.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The U.K. Financial Conduct Authority launched three major consultations outlining how it plans to regulate crypto asset activities and markets. The consultations follow HM Treasury’s announcements that crypto assets, including qualifying crypto assets and stablecoins, will soon face oversight comparable to traditional financial services.

Under the FCA’s initial proposals, crypto trading platforms, intermediaries, staking providers and decentralized finance-related firms will be subject to conduct, disclosure and prudential rules designed to protect consumers. The regulator also proposed a standalone market abuse regime, stricter admissions, disclosure requirements and prudential standards to reduce risks from weak financial reserves and disorderly firm failures.

Legal experts describe the move as a “watershed” moment, signaling a shift from limited anti-money laundering oversight to a full financial regulatory regime. The FCA is seeking industry feedback by Feb. 12 next year, ahead of implementation in 2027.

A senior promoter of the collapsed crypto scam iComTech has been sentenced to nearly six years in prison for his role in defrauding investors across the United States. Magdaleno Mendoza, 56, received a 71-month sentence after pleading guilty to conspiracy to commit wire fraud and illegal reentry into the U.S.

Prosecutors said Mendoza played a central role in recruiting victims, particularly within Spanish-speaking and working-class communities, by promoting iComTech as a legitimate cryptomining and trading business. In reality, authorities say the company operated as a Ponzi scheme, using funds from new investors to pay earlier participants and finance promoters’ lifestyles, without conducting any real mining or trading.

Mendoza’s sentencing follows prison terms for other iComTech leaders, including founder David Carmona and former CEO Marco Ruiz Ochoa. In addition to prison, Mendoza was ordered to pay nearly $790,000 in restitution, forfeit $1.5 million and surrender a California home purchased with illicit proceeds.

The U.S. Securities and Exchange Commission has moved to bar former Alameda Research CEO Caroline Ellison and former FTX executives Gary Wang and Nishad Singh from serving as officers or directors of public companies for several years. In a litigation release, the SEC said it had proposed final consent judgments in the Southern District of New York, which the three defendants accepted without admitting or denying the agency’s allegations, subject to court approval.

Under the proposed settlements, Ellison agreed to a 10-year officer-and-director bar, while Wang and Singh agreed to eight-year bans. All three also consented to permanent injunctions against violating federal antifraud laws, along with five-year conduct-based injunctions.

The action stems from the 2022 collapse of FTX and its affiliated trading firm Alameda Research. The SEC previously accused the trio of helping deceive investors and enabling the misuse of customer funds. All three also faced criminal charges, while former FTX CEO Sam Bankman-Fried received a nearly 25-year prison sentence (see: Cryptohack Roundup: Sam Bankman-Fried Gets 25-Year Sentence).

A crypto trader lost nearly $50 million in USDT after falling victim to an address poisoning attack, a common but often overlooked scam, said security firms. Onchain analytics firm Lookonchain reported that the victim mistakenly sent 49,999,950 USDT to a scammer-controlled wallet while attempting to transfer funds from Binance to a personal address.

The attacker exploited a routine safety step. After the victim sent a small test transaction, an automated script generated a spoofed address closely resembling the intended destination. By matching the first and last characters of the real address and inserting small transactions into the victim’s history, the attacker increased the chances the victim would copy the fake address for the larger transfer.

Blockchain data shows the error occurred within 30 minutes. The attacker rapidly swapped the USDT to DAI, converted it to ether and routed most of the funds through Tornado Cash to obscure the trail. The victim has since filed a criminal complaint and offered a $1 million bounty for fund recovery.

U.S. federal prosecutors in Brooklyn indicted a 23-year-old man on 31 criminal counts for allegedly running a large-scale phishing operation that stole about $16 million in cryptocurrency from roughly 100 Coinbase users. Ronald Spektor, of Sheepshead Bay, was arraigned on charges including first-degree grand larceny and money laundering for a scheme authorities say operated between April 2023 and December 2024.

Prosecutors said Spektor posed as a Coinbase employee and contacted victims with warnings that their accounts had been compromised. He allegedly persuaded users to transfer their crypto to “secure” wallets that he secretly controlled, then laundered the funds through mixers, swapping services and online gambling platforms. Prosecutors say Spektor boasted about the thefts in a Telegram channel and admitted losing millions gambling.

Investigators have recovered about $105,000 in cash and $400,000 in crypto so far. Coinbase and independent blockchain investigators assisted the probe. Spektor has pleaded not guilty.