A scammer reportedly drained $27,000 in life savings from a man in Arizona by pretending to be his bank representative.

An Arizona resident who wants to only be identified as Dave tells the website Moneywise.com that he received a normal-looking fraud alert from Bank of America, which questioned whether he had authorized a $399 purchase at the electronics store Best Buy.

Dave responded, saying “no,” and then reportedly received a follow-up text from the scammer with a number to call. Someone claiming to be a Bank of America (BofA) representative then told Dave over the phone that his account had been compromised and that he was being targeted by a rogue BofA employee.

The con artist told Dave to withdraw his whole bank account to protect it, and then the scammer instructed him to “secure” the cash using Apple Wallet.

Dave was then walked through creating a scannable card on his phone that was linked to the scammer’s account. The Arizona man then deposited the cash in a bank drive-through, unwittingly transferring the money to a scammer.

“This is my life savings, and I don’t have any assurances, but they sounded so real.”

Peoria Police Department Detective Michael Finney worked with Dave and froze the linked accounts, managing to recover roughly 90% of his funds in five months.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

An ATM scheme has reportedly drained tens of thousands of dollars from elderly customers of the biggest banks in the United States.

New York City police are warning senior citizens to be on the lookout for a trio of scammers at ATMs after a crime spree that occurred between May and June, reports The New York Post.

Authorities warn that the group – made up of two men and a woman – act as good Samaritans by offering to help the elderly use the ATM or strike up a conversation with them as a distraction to try and steal their bank cards.

Police say that on May 14th, the trio stole $20,000 from the bank account of a 90-year-old woman and drained $3,000 from the account of an 83-year-old woman in two separate incidents that occurred just one hour apart.

On June 2nd, one of the thieves started up a conversation with a 71-year-old man while withdrawing cash at a Chase Bank ATM. While the victim was distracted, the scammer stole the man’s bank card and linked up with another man at a different Chase Bank ATM location, where they tried to take out $5,500.

The 71-year-old says the scammers charged $6,000 to his account in just one hour.

The thieves struck again on June 19th when they targeted an 86-year-old woman and stole about $24,000 from her account.

According to the police, the trio is responsible for stealing at least $70,000 from elderly victims.

Authorities say that a total of nine incidents of thieves using the same scheme against seniors at Chase Bank, Bank of America, Capital One and Citibank locations in New York were reported between May 8th and June 26th.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Projects tied to Pepe meme creator Matt Furie and the NFT studio ChainSaw lost roughly $1 million to contract takeover exploits last week, according to on-chain investigator ZachXBT.

On June 27, ZachXBT reported transaction records showing that the attacker seized control of the “Replicandy” contract at 4:25 a.m. UTC on June 18 by transferring ownership to the externally owned address 0x9Fca. 

Two hours later, the new owner withdrew mint proceeds and, at 5:11 a.m. the next day, reopened the mint, issued fresh NFTs, and dumped them into open bids, pushing the floor price to zero.

On June 23, the same address took over three additional ChainSaw contracts: Peplicator, Hedz, and Zogz. The bad actor then repeated the mint-and-dump cycle. 

ZachXBT estimated the combined theft at more than $310,000 and linked the funds to three collector addresses: 0xf6a9, 0x7e58, and 0x58f4. He traced a 2.05 ETH payment from 0x9Fca to an exchange deposit that converted to 5,007.91 USDT and was then moved to MEXC. 

He subsequently mapped many smaller monthly deposits from unrelated projects into the same exchange wallet.

Two GitHub accounts, “devmad119” and “sujitb2114,” list wallets that intersect the stolen fund trail. 

Both accounts share indicators that ZachXBT associated with North Korean IT workers, including Korean language system settings, Astral VPN sessions, and Asia-Russia time zones, despite résumés that claim US residency.

Favrr exploit follows the same payroll path

A second incident surfaced on June 25, when the freelance services token project Favrr lost more than $680,000 following its listing on a DEX. On-chain analysis linked the exploit to the consolidation wallet 0x477, which received recurring payments from Favrr payroll addresses 0x1708 and 0x6412. 

Gate.io deposit address 0xab7 received part of the stolen Favrr tokens, and was previously funded by the suspected developer behind “sujitb2114”.

Favrr announced that it would refund all initial decentralized offering participants, cancel its MEXC listing, and initiate a thorough audit of its codebase. The project added that it will publish a new launch timeline “in the coming weeks” and advised users to avoid trading impostor tokens in the interim.

ZachXBT reported that Favrr’s chief technology officer, listed as Alex Hong, deleted his LinkedIn profile after the exploit. Attempts to verify his work history with previous employers were unsuccessful.

The investigator plans to release aggregate data on payroll flows to wallets tied to the same North Korean cluster, contending that basic due diligence checks would have flagged the hires.

The stolen funds from the ChainSaw collections remain idle, while most Favrr proceeds have already passed through Gate.io and several nested services. 

ZachXBT said he has not reached the teams because their direct message channels are closed, and official Telegram or Discord rooms do not provide contact options.

The incidents bring renewed attention to the risks of “shadow hiring” in crypto projects that outsource development through gig-work platforms. 

Investigators continue to follow the on-chain trails, and affected communities await formal statements from Furie, ChainSaw, and Favrr.

Mentioned in this article

Journalist

Hassan Shittu

Journalist

Hassan Shittu

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in…

Share

Last updated: 

June 19, 2025

A recent data breach has exposed over 16 billion login credentials from online platforms, including Apple, Google, Facebook, Telegram, and GitHub.

The Cybernews research team, which uncovered the leak, described it as one of the largest credential dumps ever recorded, with serious implications for online users, crypto security, and digital asset management.

16B Login Records Leaked in Alarming Wave of Fresh Malware-Based Breaches

According to researchers, the breach is not a single incident but a combination of datasets collected from infostealer malware, credential stuffing attacks, and previously unreported leaks.

Some of these datasets contained up to 3.5 billion entries on their own, with the average dataset holding around 550 million records. The researchers have been tracking the data since early 2024, uncovering at least 30 exposed sets, many of them never publicly disclosed before.

“This is not just a leak—it’s a blueprint for mass exploitation,” the Cybernews team stated.

“With over 16 billion login records exposed, cybercriminals now have unprecedented access to personal credentials that can be used for account takeover, identity theft, and highly targeted phishing,” they added.

The structure and recency of the data make the breach especially dangerous. Unlike older, recycled leaks, much of this data was harvested recently by modern info-stealing malware, posing an urgent crypto security threat to users.

The data typically includes login details organized by URL, along with associated usernames, passwords, cookies, and even tokens.

Some datasets point to specific services, such as Telegram, which was linked to a 60 million record dump.

Another, allegedly tied to the Russian Federation, held more than 455 million records. A number of entries also appear related to cloud services, government portals, and business accounts.

Most of the data was found in unsecured Elasticsearch databases and object storage instances. Though these were exposed for only a short period, it was long enough for researchers to copy the contents.

The origin of the datasets remains unclear, but experts believe that at least some were compiled by criminal actors.

Massive Credential Leaks cRaise Alarm for Crypto Users Amid Dark Web Sales

At this scale, credential leaks are a direct threat to crypto security. Attackers can deploy phishing scams, ransomware, business email compromise tactics, and unauthorized access to crypto wallets and trading platforms.

Users without multi-factor authentication (MFA) are especially vulnerable.

“The inclusion of both old and recent infostealer logs—often with tokens, cookies, and metadata—makes this data particularly dangerous for organizations lacking multi-factor authentication or credential hygiene practices,” researchers added.

While the full number of people affected is impossible to determine due to overlapping records, the scale means even a small success rate could translate into millions of compromised accounts.

Crypto users, in particular, are advised to act quickly. Since wallet services and exchanges often rely on credentials linked to mainstream email providers or cloud services, any breach could lead directly to asset theft.

Cybernews stressed the importance of basic cyber hygiene. Users should change passwords immediately, turn on MFA wherever possible, and scan their devices for malware.

“There’s little impact users can have on the existence of these leaks,” the research team noted, “but staying proactive with your own security remains the best defense.”

At the time of reporting, no single actor has claimed responsibility for the leaked databases.

But with new datasets emerging every few weeks, researchers say this reflects a growing trend of sophisticated infostealer operations that threaten the entire crypto security ecosystem.

For now, the leak stands as a stark reminder of how exposed digital life can be and how quickly stolen credentials can turn into real-world consequences.

This reminder can be corroborated with the recent incident of threat actors on the dark web allegedly selling personal data from users of major crypto exchanges Gemini and Binance, according to a March 27 report by cyber threat tracker Dark Web Informer.

A threat actor known as “AKM69” is claiming to offer 100,000 Gemini records, including names, emails, phone numbers, and location data, mostly from the U.S., U.K., and Singapore.

Another seller, “kiki88888,” listed 132,000 alleged Binance user records, though the source appears to be infostealer malware, not an exchange breach.

Though there’s no confirmed breach of the exchanges themselves, the incident shows the evolving threat to crypto security, with stolen credentials often repurposed for phishing, fraud, and wallet recovery scams.

HodlX Guest Post  Submit Your Post

Zero days without incidents in the DeFi space. This time the vulnerability was discovered in a widely used ‘elliptic library.’

What makes matters worse – its exploitation could lead to hackers taking control of users’ private keys and draining wallets.

All through a simple fraudulent message signed by a user. Is this a critical issue?

The first thing to consider is the fact that libraries like elliptic provide developers with ready-made code components.

This means that instead of writing the code from scratch and checking it as they go, developers just borrow the elements they need.

While it’s considered to be a safer practice, since the libraries are continuously used and tested, this also increases the risks if one vulnerability gets through.

Elliptic library is used extensively across the JavaScript ecosystem. It powers cryptographic functions in many well-known blockchain projects, web applications and security systems.

According to NPM statistics, the package containing the error is downloaded approximately 12–13 million times weekly, with over 3,000 projects directly listing it as a dependency.

This broad usage implies that the vulnerability potentially affects a vast number of applications – especially cryptocurrency wallets, blockchain nodes and electronic signature systems – as well as any service relying on ECDSA signatures through elliptic, especially when handling externally provided input.

This vulnerability allows remote attackers to fully compromise sensitive data without proper authorization.

That’s why the issue received an extremely high severity rating – approximately nine out of 10 on the CVSS scale.

It’s important to point out that exploiting this vulnerability requires a very specific sequence of actions and the victim must sign arbitrary data provided by the attacker.

That means that some projects may remain safe, for example, if an application only signs predetermined internal messages.

Still, many users don’t pay as much attention when signing messages via crypto wallets as they do when signing a transaction.

Whenever a Web 3.0 site asks users to sign terms of service, users often neglect to read them.

Similarly, users might quickly sign a message for an airdrop without fully understanding the implications.

Technical details

The problem comes from not handling errors properly during the creation of ECDSA (Elliptic Curve Digital Signature Algorithm) signatures.

ECDSA is commonly used to confirm that messages, like blockchain transactions, are genuine.

To create a signature, you need a secret key – only the owner knows it – and a unique random number called a ‘nonce.’

If the same nonce is used more than once for different messages, someone could figure out the secret key using math.

Normally, attackers can’t figure out the private key from one or two signatures because each one uses a unique random number (nonce).

But the elliptic library has a flaw – if it gets an odd type of input (like a special string instead of the expected format), it could create two signatures with the same nonce for different messages.

This mistake could reveal the private key, which should never happen in proper ECDSA use.

To exploit this vulnerability, an attacker needs two things.

• A valid message and its signature from the user – for instance, from any previous interactions
• The user to sign a second message explicitly created to exploit the vulnerability

With these two signatures, the attacker can compute the user’s private key, gaining full access to funds and actions associated with it. Detailed information is available in the GitHub Security Advisory.

Exploitation scenarios

Attackers may exploit this vulnerability through various methods, including the following.

• Phishing attacks that direct users to fake websites and request message signatures
• Malicious DApps (decentralized applications) disguised as harmless services, such as signing terms of use or participating in airdrops
• Social engineering convincing users to sign seemingly harmless messages
• Compromising servers’ private keys that sign messages from users

A particularly concerning aspect is users’ generally lax attitude toward signing messages compared to transactions.

Crypto projects frequently ask users to sign terms of service or airdrop participation messages, potentially making exploitation easier.

So, think about it – would you sign a message to claim free tokens? What if that signature could cost you your entire crypto balance?

Recommendations

Users must promptly update all applications and wallets that utilize the elliptic library for signatures to the latest secure version.

Exercise caution when signing messages, particularly from unfamiliar or suspicious sources.

Developers of wallets and applications should verify their elliptic library version.

If any users could be affected by the vulnerable version, developers must inform them about the urgent need for updating.

Gleb Zykov is the co-founder and CTO of HashEx Blockchain Security. He has more than 14 years of experience in the IT industry and over eight years in internet security, as well as a strong technical background in blockchain technology (Bitcoin, Ethereum and EVM-based blockchains).

Check Latest Headlines on HodlX

Follow Us on Twitter Facebook Telegram

Check out the Latest Industry Announcements  

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any loses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: DALLE3

Hackers are reportedly draining bank accounts and stealing smartphone users’ credentials using a new and highly effective technique.

Cybersecurity researchers say criminals are now sending text messages that appear to be from banks and delivery services – with malicious PDF files attached, reports Samsung Magazine.

The PDFs either contain links that exploit security flaws and install malware or links that send users directly to fake bank websites, enticing people users to enter their login details.

Victims across the US, Germany, and the UK have already suffered financial losses after opening the fraudulent PDFs.

Researchers say people tend to trust PDFs more than links, and the method increases the chances of users falling for the scam.

Although SMS phishing and email-based PDF attacks have existed for years, the tactic of sending malicious PDFs directly via SMS texts is a new twist.

To stay safe, security experts recommend both Apple and Android users avoid opening PDFs from unknown senders, verify messages with official sources, keep smartphones updated and use antivirus software to prevent malware infections.

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Follow us on X, Facebook and Telegram

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney