Crypto Security Roundup: Binance Laundering, Bitcoin Core Flaws and Gnosis Pay Breach
Summary
A crypto-security roundup covers Elliptic's account of laundering linked to the Binance breach, a Gnosis Pay data breach, U.S. action against MEXC, three Bitcoin Core flaws, Keplr wallet fund recovery and cryptocurrency theft cases.
Key points
- Elliptic reported that attackers behind the Binance breach routed stolen cryptocurrency through disposable memecoins. The FBI attributed the breach to North Korea's TraderTraitor group; Binance had replenished virtually all stolen customer assets, and Elliptic estimated $2.85 billion was frozen.
- Gnosis Pay said attackers accessed an older card-support system on Nov. 3, exposing customer information. The company contained the breach, replaced credentials and made 3D Secure mandatory until retiring the affected system.
- The U.S. Treasury cut MEXC Global off from the U.S. financial system over allegations that it facilitated $16 billion in transactions linked to Iran, North Korea and Russia. MEXC said operations and customer assets were secure.
- Bitcoin Core disclosed three flaws that could disrupt mining, delay block processing or weaken protections for nodes using specific Tor settings. Fixes were released in versions 30.0 and 29.2.
- Web3Auth moved about $5.6 million from vulnerable Keplr wallets to recovery addresses after a breach exposed some users' private keys. The amount attackers may have stolen was not disclosed.
- A Scottish court sentenced three people for plotting a cryptocurrency theft using a plan to coerce victims into installing AnyDesk; the attempt failed when the victims refused entry.
- Former FBI agent Patrick Steven Yaroch pleaded guilty to stealing about $2.47 million in cryptocurrency from wallets connected to FBI investigations. He must pay at least $2.4 million in compensation under his plea agreement.
Article Details
- Event Type
- Roundup of cryptocurrency-related security incidents, vulnerability disclosures, enforcement actions, and cybercrime cases.
- Impact
- Elliptic reported that Binance attackers used newly created memecoins and complex transactions to launder stolen cryptocurrency; Binance said it had replenished virtually all affected customer assets and was gradually restoring withdrawals. Gnosis Pay disclosed customer information after unauthorized access to an older card-support system, but said it contained the breach, customer funds were safe, and its separate business platform was unaffected. U.S. authorities cut MEXC Global off from the American financial system over alleged illicit transactions. Bitcoin Core disclosed three vulnerabilities that could disrupt mining and transaction processing or weaken network protections; fixes were released in versions 30.0 and 29.2. Other reports included a failed cryptocurrency theft plot in Scotland, protective transfers of about $5.6 million from vulnerable Keplr wallets, and a former FBI agent’s guilty plea to stealing cryptocurrency from wallets linked to investigations.
CVE
CVE-2025-62859Vendor / Product unavailableA second flaw, CVE-2025-62859, allowed malicious network participants to delay block processing by up to 10 minutes under certain conditions. Attackers could potentially repeat the disruption, said Bitcoin Core'sCVE-2025-62860Vendor / Product unavailableThe third vulnerability, CVE-2025-62860, affected nodes using specific Tor network settings, potentially removing protections against service disruptions and weakening privacy safeguards. Bitcoin Core said thousands ofCVE-2025-62861Vendor / Product unavailableThe most serious vulnerability, CVE-2025-62861, affected software versions 28.0 through 28.2 and 29.0 through 29.1. It could leave the mempool, where pending bitcoin transactions wait for confirmation, in an
People
Josh LeeKeplr co-founder who estimated that about 20% of accounts created through Google or Apple sign-ins were vulnerable.Scott BessentU.S. Treasury Secretary who said the action against MEXC Global aimed to prevent Iran from using cryptocurrency to bypass U.S. economic restrictions.Vugar UsiMEXC Global CEO who addressed the withdrawal activity and the company’s response to FinCEN’s concerns.
Threat Actors
Iain DoyleSentenced for involvement as an accomplice in Robert Barr’s attempted cryptocurrency theft; the plan involved using AnyDesk to access victims’ computer.Jade SleetThe FBI attributed the Binance attack to this hacking group, which the article describes as North Korean. The attribution is reported as the FBI’s assessment.Patrick Steven YarochFormer FBI agent who pleaded guilty to accessing FBI databases to obtain cryptocurrency wallet credentials and making unauthorized transfers from wallets linked to investigations.Robert BarrSentenced for organizing an attempted cryptocurrency theft in which accomplices were to use AnyDesk to gain remote access to victims’ computer and transfer their cryptocurrency.Sean FavierSentenced for involvement as an accomplice in Robert Barr’s attempted cryptocurrency theft; the plan involved using AnyDesk to access victims’ computer.
Vendors
BinanceEvery week, ISMG rounds up cybersecurity incidents in digital assets. This week, Binance hackers laundered stolen funds through memecoins, U.S. authorities cut off MEXC Global, Bitcoin Core disclosed three securityGnosis PayGnosis Pay Data Breach Exposes Customer InformationMEXC Globalassets. This week, Binance hackers laundered stolen funds through memecoins, U.S. authorities cut off MEXC Global, Bitcoin Core disclosed three security flaws, a Scottish prisoner sentenced for plotting a $2.7 millionWeb3AuthCore disclosed three security flaws, a Scottish prisoner sentenced for plotting a $2.7 million theft, Web3Auth protected $5.6 million from vulnerable Keplr wallets and a former FBI agent admitted stealing $2.47
Products
AnyDeskBarr planned to have his accomplices enter a couple's home and force them to install AnyDesk, software that allows someone to control a computer remotely. He intended to use the connection to transfer cryptocurrencyBitcoin Coreweek, Binance hackers laundered stolen funds through memecoins, U.S. authorities cut off MEXC Global, Bitcoin Core disclosed three security flaws, a Scottish prisoner sentenced for plotting a $2.7 million theft,Keplrprisoner sentenced for plotting a $2.7 million theft, Web3Auth protected $5.6 million from vulnerable Keplr wallets and a former FBI agent admitted stealing $2.47 million in cryptocurrency.
Countries
IranThe U.S. Department of the Treasury cut off cryptocurrency exchange MEXC Global from the American financial system over allegations that it facilitated $16 billion in transactions linked to Iran, North Korea and Russia.North KoreaThe FBI has attributed the Binance attack to North Korea's TraderTraitor hacking group. Binance's incident report described a months-long operation involving a fake job interview, malicious developer software andRussiaThe U.S. Department of the Treasury cut off cryptocurrency exchange MEXC Global from the American financial system over allegations that it facilitated $16 billion in transactions linked to Iran, North Korea and Russia.United Statesincidents in digital assets. This week, Binance hackers laundered stolen funds through memecoins, U.S. authorities cut off MEXC Global, Bitcoin Core disclosed three security flaws, a Scottish prisoner