Return of Stolen KiloEx Funds

Every week, Information Security Media Group rounds up cybersecurity incidents in digital assets. This week, stolen KiloEx funds returned, Braiscompany execs sentenced, a Bitget trading anomaly, Bybit case update, SEC’s new crypto-friendly chair, eXch shuttering, Oregon attorney general sued Coinbase, new Android malware and bug in XRP Ledger.

See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation

The hacker who exploited decentralized exchange KiloEx for $7.5 million returned the full amount just four days after the attack. Blockchain security firm PeckShieldAlert alerted of the return, shortly before KiloEx confirmed full recovery of the stolen assets. The exchange had offered a 10% “white hat” bounty of $750,000 for the return of at least 90% of the funds, a move that likely influenced the hacker’s decision. KiloEx has decided not to pursue legal action and will honor the bounty.

A Brazilian court sentenced three Braiscompany executives to a combined 171 years in prison for running one of the country’s largest crypto fraud schemes, reported Coindesk.

Joel Ferreira de Souza, identified as the ringleader, received 128 years for operating an unlicensed financial institution and laundering millions through shell companies and crypto wallets. Co-conspirators Gesana Rayane Silva and Victor Veronez were sentenced to 27 and 15 years, respectively. Authorities say the pyramid scheme defrauded 20,000 investors of R$1.11 billion, about $190 million. The court ordered R$36 million seized, but victim compensation remains uncertain. Two other defendants were acquitted due to insufficient evidence.

Bitget is compensating users affected by a trading anomaly involving VOXEL/USDT perpetual contracts after a sudden 200% surge in VOXEL’s price. The glitch led to automatic trade executions without typical counterparty matching, prompting Bitget to suspend trading, freeze accounts involved, and roll back affected transactions. The exchange said most recoveries are complete and user reimbursements are underway. Bitget is also investigating issues with fee deductions and profit/loss errors raised by users.

Bybit CEO Ben Zhou has said that nearly 28% of the $1.4 billion North Korea’s Lazarus Group stole from the company has become untraceable. The attackers siphoned 500,000 ETH in February by compromising a cold wallet, routing the funds through mixers like Wasabi, Railgun and Tornado Cash before using bridges and decentralized exchanges like Thorchain and SunSwap to obscure the trail. About 84% of the stolen ETH has been swapped for Bitcoin, dispersed across over 35,000 wallets. Just under 4% has been frozen and about 1% remains on Ethereum. Bybit’s Lazarus Bounty has so far validated 70 reports, with calls for more help decoding mixers.

Paul Atkins has been sworn in as the 34th chair of the U.S. Securities and Exchange Commission, following his nomination by President Donald Trump and Senate confirmation. A longtime proponent of digital assets, Atkins has publicly committed to making the development of a regulatory framework for crypto a top priority during his tenure. Atkins said he would focus on facilitating capital formation and maintaining fair, efficient markets, while signaling a break from the previous administration’s more aggressive digital assets enforcement. Atkins’ stance is welcomed by many in the crypto industry, who have long criticized what they viewed as arbitrary enforcement actions under former Chair Gary Gensler.

Privacy-centric crypto exchange eXch will shut down on May 1 following allegations that North Korea’s Lazarus Group used the platform to launder stolen funds. The eXch team cited an ongoing campaign targeting them for money laundering and terrorism, prompting a team vote to cease operations. Onchain analysts linked a surge in ETH volume on eXch to the $1.4 billion Bybit hack, though the platform previously denied laundering funds. In its final statement, eXch didn’t refute that illicit assets may have passed through but said that enabling criminal activity was never its intent.

Oregon Attorney General Dan Rayfield filed a securities enforcement lawsuit against Coinbase, reviving allegations previously dropped by the U.S. Securities and Exchange Commission. The state claims Coinbase facilitated the sale of unregistered crypto assets to Oregon residents, exposing them to fraud and pump-and-dump risks. The lawsuit echoes federal charges from 2023 related to Coinbase’s alleged unregistered operations and staking service, which the SEC abandoned in February. Coinbase Chief Legal Officer Paul Grewal criticized the lawsuit as “obstruction for the sake of obstruction,” arguing it undermines national regulatory progress and consumer clarity around crypto.

Cheap Android phones from Chinese manufacturers are shipping with preinstalled malware disguised as popular messaging apps like WhatsApp and Telegram, said researchers from Doctor Web. The Trojanized apps deploy cryptocurrency clippers, or malware that replaces copied wallet addresses with those of the attacker, targeting Ethereum and Tron transactions. The malware is embedded via LSPatch, an open-source tool that modifies app updates to fetch malicious APKs from attacker-controlled servers. Once installed, the malware swaps crypto wallet addresses in chat messages while mimicking legitimate app behavior. It also harvests sensitive data including messages, documents, images, and device info. Many of the infected devices are low-end clones mimicking major brands such as Samsung and Huawei, with names like S23 Ultra and Note 13 Pro. At least four are made by a brand called Showji. Attackers also spoof device specs to trick users into thinking they’re using high-performance hardware. Doctor Web found that the malware campaign is extensive, using over 60 command-and-control servers and 30 domains to distribute the malicious apps. One wallet linked to the operation has collected over $1 million, with other wallets holding hundreds of thousands more.

In a separate case, Threat Fabric researchers detailed how a stealthy Android malware campaign dubbed “Crocodilus” is targeting cryptocurrency wallet users through fake Telegram groups, phishing sites and rogue app downloads. The malware tricks victims into installing trojanized apps, which then exploit Android’s developer tool called Shizuku service to gain root access. Once installed, Crocodilus embeds a Linux-based backdoor, giving attackers full control of the device. It can extract seed phrases, capture 2FA codes, monitor screen activity and manipulate apps like MetaMask and Trust Wallet. Active since 2021, the campaign has compromised over 2,000 Android devices and is linked to at least $600,000 in crypto theft. The researchers tied the malware to more than 50 malicious domains impersonating Web3 projects.

A newly discovered vulnerability in the popular xrpl JavaScript library has triggered supply chain security concerns across the XRP Ledger ecosystem. The flaw, disclosed by Aikido Security researcher Charlie Eriksen, was found in recent versions of the library, which is widely used by developers to build applications on top of the XRP Ledger. Eriksen said the compromised versions introduced a backdoor that could allow attackers to steal private keys and gain unauthorized access to user wallets. With over 140,000 weekly downloads, the malicious code posed a potentially “catastrophic” risk, although the impact appears limited to projects that updated during a short window before the vulnerability was patched.