Crypto Roundup: $37M Scam Suspect Extradited Amid Wallet and Exchange Incidents
Summary
ISMG's weekly roundup covers a $37M crypto-scam suspect's extradition, thefts involving outdated BTCPay servers and a reported Trezor tampering risk, a Mercado Bitcoin incident involving $46.3M, and Polymarket's $3.9M refunds after malicious website code.
Key points
- Zhen Zhao was extradited to the U.S. over an alleged cryptocurrency investment scam that prosecutors say defrauded 174 Americans of nearly $37 million; he faces up to 20 years if convicted.
- BTCPay Server said attackers exploited a weakness affecting versions 2.4.1 and earlier to steal bitcoin and litecoin; it urged users to update to version 2.4.7.
- Trezor said it considers credible a report of possible tampering in a Trezor Safe 5 bought through CryptoBilis, but had not physically examined that device; the suspected implant could capture and transmit recovery-phrase information.
- Mercado Bitcoin confirmed a security incident involving suspicious transfers; Arkham estimated the digital assets at $46.3 million. The exchange suspended deposits and withdrawals and said customer assets and personal information were unaffected.
- Polymarket said malicious code on its website stole cryptocurrency and sold users' trading positions; it allocated $3.9 million in refunds and compensation after the attack affected wallets and trading.
- Two Texas brothers were sentenced to about 15 years each for an $8 million cryptocurrency robbery in which they forced a victim to transfer funds.
- A former crypto executive reportedly lost about $14,000 after thieves stole his unlocked phone and accessed financial accounts; he recovered some access and advised theft victims to secure phones remotely and contact financial institutions.
Article Details
- Event Type
- A roundup of cryptocurrency-related security incidents, including an alleged investment scam, theft from outdated BTCPay Server wallets, suspected hardware-wallet tampering, a cryptocurrency exchange security incident, malicious code on Polymarket’s website, and account theft following a phone robbery.
- Impact
- Reported losses included nearly $37 million in the alleged investment scam, $8 million in cryptocurrency stolen during a robbery, approximately $46.3 million in digital assets involved in Mercado Bitcoin’s incident, and about $3.9 million in Polymarket refunds. Hackers also stole bitcoin and litecoin from users of outdated BTCPay Server software. Trezor warned customers of possible recovery-phrase exposure from a tampered device; it had not physically examined that device, and its examination of four other devices found no evidence of tampering. Mercado Bitcoin said customer assets and personal information were not affected.
People
Magnus AhmadFormer cryptocurrency executive who reported losing cryptocurrency and other funds after thieves stole his unlocked phone and accessed his accounts.Nicolas DorierBTCPay Server founder who said the attacks did not target publicly accessible servers.Paolo ArdoinoTether CEO who said Tether had frozen more than $4.5 million in USDT connected to the Mercado Bitcoin incident.
Threat Actors
Vendors
CryptoBilisTrezor has urged customers who bought hardware wallets from reseller CryptoBilis since March 2026 to move their funds immediately following reports of a possible spying device inside a Trezor Safe 5 wallet.DebugBearThe hackers replaced a website performance monitoring script supplied by DebugBear with malicious code. Researchers at Hudson Rock found that the code exploited existing login sessions to request transactions throughTetherProsecutors allege that the stolen funds were transferred to a Bahamas-based bank account, converted into tether or USDT, a cryptocurrency designed to maintain a stable value, and sent to wallets controlled in Cambodia.TrezorThis week, a Chinese national was extradited over a $37 million scam, hackers drained BTCPay wallets, Trezor warned of device tampering, Texas brothers were jailed for an $8 million robbery, Mercado Bitcoin
Products
BTCPay ServerHackers stole bitcoin and litecoin from BTCPay Server users running outdated software, prompting an urgent warning to update to version 2.4.7, the company said.LedgerThe Czech company removed CryptoBilis from its authorized reseller network earlier this month after reports of tampered Ledger wallets.Mercado Bitcoinwallets, Trezor warned of device tampering, Texas brothers were jailed for an $8 million robbery, Mercado Bitcoin reported a $46.3 million breach, Polymarket announced $3.9 million in refunds and a London phonePolymarketTexas brothers were jailed for an $8 million robbery, Mercado Bitcoin reported a $46.3 million breach, Polymarket announced $3.9 million in refunds and a London phone theft cost a former crypto executive $14,000.Trezor Safe 5Trezor has urged customers who bought hardware wallets from reseller CryptoBilis since March 2026 to move their funds immediately following reports of a possible spying device inside a Trezor Safe 5 wallet.
Countries
BahamasProsecutors allege that the stolen funds were transferred to a Bahamas-based bank account, converted into tether or USDT, a cryptocurrency designed to maintain a stable value, and sent to wallets controlled in Cambodia.CambodiaZhen Zhao, 44, allegedly worked with accomplices in the United States and Cambodia to lure victims into fraudulent investments through social media, dating platforms, text messages and phone calls.NetherlandsA Chinese national appeared in a Los Angeles federal court after being extradited from the Netherlands over his involvement in a cryptocurrency investment scam that defrauded 174 Americans of nearly $37 million.United StatesZhen Zhao, 44, allegedly worked with accomplices in the United States and Cambodia to lure victims into fraudulent investments through social media, dating platforms, text messages and phone calls.