Category: Cybercrime

Ledger Warns of Tampered Wallets

CryptoBilis Devices Linked to Losses

Ledger says at least one device sold through CryptoBilis, a Malaysia-based reseller serving Southeast Asia, contained an unauthorized hardware implant. The company says the reports of unexpected crypto losses it has investigated so far are linked to devices purchased from the retailer.

Customers Told to Stop Setup

Ledger began investigating on October 9 and asked CryptoBilis to stop selling and shipping its devices. It later advised customers who have not set up a device from the reseller not to do so. Those who have already used one should consider transferring their funds to a new wallet created with a fresh recovery phrase.

Researchers Find Hidden Components

Researchers have reportedly found modified Ledger Nano X devices offered through online marketplaces, sometimes at steep discounts. Analysis by cryptocurrency research group Tibane Labs identified two implant designs. Both included hidden electronic components and an eSIM-based connection that researchers say could transmit information from the device.

Authenticity Checks May Miss Implants

Ledger has not publicly confirmed the exact model or method involved in every reported case. The company says it is working with authorities and contacting affected users. It also warns that its authenticity check may not detect an added implant if the device’s original security chip remains intact.

Buy From Authorized Sellers

Ledger recommends buying devices only through authorized channels. It has not reported evidence that other resellers are involved, but the incident has raised concerns about risks in the hardware-wallet supply chain.

October 13, 2026
London Man Jailed for Role in $260,000 SIM-Swap Crypto Theft

A London court has jailed Ajay Shinjin for 30 months for his role in a cryptocurrency theft operation that took nearly $260,000 from victims.

The 25-year-old, who lived in Canary Wharf and also went by AJ Marley Cruz, admitted to fraud and handling criminal proceeds. City of London Police said he used money from the scheme to fund costly trips to Dubai and buy gold-plated dental grills.

The operation relied on “SIM swapping.” In November 2021, the group arranged for victims’ mobile numbers to be moved onto SIM cards they controlled. By receiving the victims’ text-message security codes, the criminals were able to get into cryptocurrency accounts and bank accounts.

BT noticed unusual changes to customer accounts and alerted investigators. Police used information from the telecom company to trace the activity to several devices fitted for eSIM use. Shinjin was linked to four of those devices.

Four people were identified as targets during the first week of November. In one case, around £40,000 in cryptocurrency was taken, with roughly £27,000 ending up in Shinjin’s account. Another victim lost about £17,000, which was also traced to his wallet.

Two further victims lost approximately £8,000 and £130,000 respectively. Police said Shinjin helped enable those thefts, although the funds were sent to other destinations.

Shinjin was first detained at his London home in 2021. He was arrested again at Heathrow in October 2023 after arriving from Dubai, when police had obtained more evidence. He chose not to respond to questions during interviews.

Detective Constable Simon Ardeman said the fraud was carefully planned and had caused serious financial damage. He warned that criminals are increasingly using SIM-swapping methods to access victims’ accounts.

City of London Police said the sentence demonstrates that people who exploit technology to steal money can be prosecuted.

October 9, 2026
AI Music Fraudster Gets 18 Month Prison Sentence for Fake Streams

A 54-year-old man who used AI-generated songs and automated bots to collect millions in music royalties has been sentenced to 18 months in prison. The case is believed to be the first criminal prosecution focused on streaming fraud.

Michael Smith admitted in March that he created thousands of songs using AI, then used bots to play them billions of times across music platforms. Prosecutors say the scheme brought in more than $8 million in royalties.

Before sentencing, Smith’s lawyers asked the judge to spare him prison, arguing that the financial impact on any one artist was minimal. But on Tuesday, Oct. 6, Manhattan federal judge John G. Koeltl sentenced Smith to 18 months behind bars, followed by two years of supervised release.

Prosecutors said Smith took advantage of emerging technology to carry out fraud on a massive scale. By using bots instead of real listeners and fabricated tracks instead of original music, they said, he diverted royalty payments from legitimate artists and songwriters.

Streaming fraud has troubled the music business for years, but AI has made it easier to produce fake tracks and run automated listening networks. While bots can be used to inflate plays for real artists, a more common scheme involves collecting royalties from fake or copied music—reducing the share available to genuine creators.

Smith was arrested in 2024. Prosecutors said he began by boosting plays of his own music in 2017, then expanded the operation by producing AI-generated songs. He pleaded guilty to conspiracy to commit wire fraud and agreed to forfeit more than $8 million.

The charge carries a maximum sentence of five years. Federal sentencing guidelines suggested 46 to 57 months, while probation officials recommended 24 months. Prosecutors sought at least 46 months, saying a lighter penalty could send the wrong message about the consequences of streaming fraud.

Smith’s lawyers maintained that the losses were spread across millions of artists and songwriters, making the impact on any individual creator extremely small. The judge ultimately imposed a shorter sentence than prosecutors requested.

The Recording Industry Association of America said the fraud harmed creators and misled fans. The Music Fights Fraud Alliance also welcomed the sentence, while warning that more cases and cooperation between the music industry, law enforcement and policymakers will be needed to deter future schemes.

October 7, 2026
Suspected ShinyHunters Member Detained in Jordan, U.S. Officials Say

U.S. officials say a man suspected of being affiliated with the cybercrime group ShinyHunters was detained in Jordan this week and is cooperating with investigators. Two U.S. officials and another source familiar with the case identified him as Saif al-Din Khader.

ShinyHunters, which has claimed responsibility for several major data breaches, also said it had accessed information about every FBI employee, though that claim has not been independently confirmed.

A U.S. source told CBS News it remains unclear how many other people may have been involved.

The FBI did not comment directly on Khader’s detention. In a statement, the bureau said it was actively investigating the incident and had worked with partners to arrest multiple suspects.

It added that it would continue pursuing those responsible. Reuters first reported the detention.

Last month, the group claimed in dark-web posts and messages to media organizations that it had taken between two and three terabytes of data related to FBI personnel.

ShinyHunters alleged it exploited a newly discovered vulnerability in Oracle PeopleSoft, a human-resources management system.

Another person suspected of ties to the group—a 24-year-old from Amsterdam—was arrested on Sept. 15, Dutch police and the FBI said previously.

His arrest came days before ShinyHunters announced it had breached the FBI’s jobs website, an incident first reported by 404 Media on Sept. 22.

Dutch authorities did not publicly name the suspect. However, sources familiar with the case told CBS News he was Pepijn van der Stap. In a statement to Reuters, ShinyHunters denied that Van der Stap was connected to the group and criticized Dutch police.

October 6, 2026

HTML Snippets Powered By : XYZScripts.com