Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

OPERATION BLACKOUT: Another massive blow to global scam empires targeting Americans. Under President Trump’s leadership, this FBI and our partners delivered: ✅ 28 arrests in Ghana and Nigeria ✅ 350+ devices seized ✅ 3.7 MILLION scam-linked accounts, pages and groups taken down ✅ $11 MILLION+ in potentially freezable funds identified ✅ 120+ trafficked workers identified To the criminals stealing Americans’ hard-earned money: Your borders won’t protect you. Your compounds won’t hide you. -DKP🇺🇸

Napster Corp. taught the music industry what happens when real listeners take songs without paying. This week the U.S. Department of Justice sentenced a man for the reverse: listeners who never existed, collecting real money🎵 The charge is what DOJ calls its first-ever “super intelligence assisted” streaming fraud. Super intelligence... I guess regular AI got a promotion while the rest of us weren’t looking. Michael Smith got 18 months and forfeited about $8.09 million. According to U.S. Attorney's Office for the Southern District of New York, he ran thousands of bot accounts from 2017 to 2024, at times as many as 10,000 at once, opened with fake emails and fraudulently obtained debit cards. They streamed hundreds of thousands of AI-generated songs billions of times. In April 2023, his bots played his catalog 80.9 million times on YouTube Music family plans, while Taylor Swift’s entire catalog got 9.3 million. I never knew this aspect of it, streaming royalties actually come out of a shared pool, so every fake play took money from an artist whose song was actually heard. He also knew how to stay hidden. In his own email he said he needed “a TON of songs fast” to get around the platforms’ anti-fraud policies, and he spread the streams across thousands of tracks so no single song looked unusual. Plain version (i.e. cop version): he made the crime small everywhere anyone was looking. Whatever name the technology gets, that pattern is one we work every day. Fraud gets cut into pieces small enough that each organization sees nothing worth escalating, and it only shows when someone lays the pieces side by side. The intelligence (even if it's "super") exists. The coordination doesn’t. justice.gov/usao-sdny/pr/nor…

🚨Oh boy, here we go again! Estimates say about $93 million has been drained from more than 300 wallets, and the common details so far say it's the reseller of where the hardware came from. Ledger has confirmed that one affected customer’s device, bought through CryptoBilis (a reseller covering Indonesia, Malaysia and the Philippines), contained an unauthorized hardware implant. Ledger says its own systems and direct sales were not compromised. It has not said the implant caused the losses. 💽Mark Karpelès, the former Mt. Gox CEO, published a teardown of a Nano X he received from Malaysia. Flawless shrink wrap. Inside, where the screen padding should sit, a second board with an LTE module, an eSIM and a microcontroller. His analysis says it reads the display during setup and sends the seed phrase out over cellular, and that Ledger’s authenticity check would still pass because the secure chip is untouched. Those are his findings, and his unit has not been tied to CryptoBilis. Two things stand out to me as an investigator. The money moved fast, as it always does. Most of the loss was USDT on Tron (shocker, right? 🙄), and Tether froze about $10 million across 20 wallets once the drain addresses went public. The rest started shifting into assets with no issuer to call. Like we always say, how quickly someone reports to the issuer decides what is recoverable. The seller changed hands too. Its former founders say CryptoBilis was sold in March and that an NDA kept them from saying so. Corporate records that surfaced this week list a new sole shareholder with a registered address in... China. Nobody has shown the new owner did anything wrong, and an ownership change on its own proves nothing. Still, “authorized reseller” tells you who a seller was when it was approved, and very little about who runs it today. If a victim walks into your office holding one of these devices: ✅ Do not set it up. Ledger advises this for anything bought from CryptoBilis in the last 90 days ✅ Preserve the device and packaging as evidence ✅ If it was already funded, move assets to a new device bought direct, with a new seed phrase ✅ Get the USDT addresses to Tether quickly Losses like this surface in many places at once, with each victim reporting to a different local office and the same collection addresses sitting in every file. Deconflict exists so investigators can see they are chasing the same wallets before the funds move. 🚔 Free for law enforcement, and it always will be. 👉 If you have worked a hardware wallet theft, what did your first 24 hours look like? Source: highboy.blog/supply-chain-at…

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses. Reach out to Ledger customer support through official channels with any questions: support.ledger.com/

🚨JUST IN: U.S. Treasury Secretary Scott Bessent says the Trump administration could SEIZE $1 BILLION in Iran-linked cryptocurrency THIS WEEK. “We're probably gonna seize a billion dollars of crypto this week. And, you know, we know where it is and we are isolating them.” The move is part of Washington's “absolute isolation campaign” against Iran, targeting its oil exports, transportation routes, and financial assets.

Two recent cases show how attacks on banks have evolved with AI. In South Korea, at least nine banks were targeted in cyberattacks that CrowdStrike linked to a suspected attacker using AI tools. Hackers used an AI penetration-testing tool named ARTEX alongside LLMs to break in and extract data automatically. In Italy, fraudsters reportedly used a WhatsApp message and an AI-cloned voice to impersonate senior leaders and steal €95 million from a private bank. Some of the unrecovered funds were later moved through foreign accounts and converted into cryptocurrency. One is a cyberattack. The other is an impersonation fraud. Even though the attacks looked completely different, both left the affected banks with the exact same loopholes: the information needed to catch the threat was spread across various teams and systems. The FBI recorded over 22,000 AI-related complaints in 2025 alone, accounting for nearly $893 million in reported losses. As AI makes attacks faster and far more convincing, banks are left sifting through a maze of disconnected signals. Every system sees its own small piece of the puzzle but none of them can answer the single question that actually matters when money is moving: is there verified intelligence here that helps us make a fast, confident decision? Right now, finding out if law enforcement or another institution is tracking that same subject usually means relying on manual outreach, delayed subpoenas, or guesswork. We built Signal to fix that. Instead of adding another platform to manage, Signal operates alongside the tools your compliance, fraud, and risk teams already use every day. When an alert fires or a counterparty is reviewed, Signal automatically checks if verified law enforcement intelligence exists on that specific identifier or wallet. It brings critical context straight to your analysts, helping you: Identify high-risk overlaps early Reduce alert fatigue Make confident, defensible decisions AI gives threat actors speed and scale, but they still rely on information silos to get away with it. By bringing verified intelligence directly into your existing stack, Signal gives your team the complete picture before the money ever leaves the vault. See how Signal adds verified law enforcement intelligence to your existing workflow: lnkd.in/dBgGWaPn Source: reuters.com/world/suspect-be…

Deconflict Academy is live. Our founder spent 22 years in law enforcement, including time with the U.S. Secret Service. He saw firsthand how often investigators were asked to take on emerging forms of crime without enough time, training, or budget to prepare. Cryptocurrency investigations are a good example. The cases are not waiting for an agency’s next training cycle. Investigators may encounter a crypto wallet in a fraud case, a scam victim’s transaction history, or an exchange record in a financial-crime investigation, often before they have had formal training on what they are looking at or where to begin. Sending someone away for a multi-day course is not always possible. Training budgets are limited. Caseloads do not slow down. And not every agency has access to a dedicated digital-assets investigator. We built Deconflict Academy around that reality. ✅ Free for law enforcement. Investigators can access courses without asking their agency to fund another training program. ✅ Built for the work. The courses are designed to give investigators practical foundations they can apply in cases, not just high-level theory. ✅ Self-paced. Learn when time permits, whether that means completing a module between cases or working through an entire course over time. ✅ Certificate of completion. Investigators receive a certificate after finishing the course. ✅ Written by people who understand the mission. The content is developed by law-enforcement veterans with experience across agencies including DHS and DOJ. This is not about turning every investigator into a cryptographer. It is about giving more people a practical starting point: how to recognize the issue, ask better questions, preserve the right information, and know when to bring in additional resources. Training should not depend solely on an agency’s budget, location, or ability to send someone away for a week. Deconflict Academy is one part of our effort to make useful intelligence, tools, and training more accessible to the people working financial-crime cases every day. The Academy is free for law enforcement.

They built entire scam cities overseas to steal Americans’ life savings. So we went to the source. Operation Blackout: ✓ Roughly $17 BILLION seized ✓ Hundreds arrested ✓ Thousands of trafficked workers freed ✓ 10,000+ Americans warned before losing their money ✓ $660 MILLION in estimated losses prevented And when these networks move—from Southeast Asia to the Middle East to Africa—we move with them. There is no safe haven for criminals targeting Americans. -DKP 🇺🇸

Today, we’re launching Deconflict 2.0: a new brand identity, a new logo, and five new products. This launch is about helping law enforcement investigators and financial institutions do their work with better information, practical tools, and less friction. Here’s what’s new: Deconflict Academy gives law enforcement investigators free access to courses they can take at their own pace, with a certificate of completion. The courses were written by law enforcement veterans with experience at agencies including DHS and DOJ. AI-Powered Threat Intelligence gives compliance teams a dedicated environment to search for relevant intelligence and bring more context into their reviews. Investigative Agent helps users examine a crypto wallet and organize the available context around it, giving investigators a clearer place to start. OSINT Agent helps develop public-source leads from an identifier and brings the findings into a report for investigators to assess. E-Signature helps law enforcement investigators, Assistant U.S. Attorneys, and prosecutors send and sign legal requests, making the process easier to manage and document. We built these products for people who need to find relevant information, understand what it means, and take the next step. Deconflict 2.0 brings more of that work together. Thank you to the investigators and compliance professionals who helped shape this launch, and to the team at @zypsy for helping bring our new brand identity to life. deconflict.com

This morning @FBI and our partners the Dutch National Police are announcing the arrest of one of the alleged leaders of ShinyHunters - a global cybercrime and threat actor group linked to cyberattacks in the United States, the Netherlands, and around the world. In coordination with FBI investigators the Dutch High-Tech Crime Unit arrested the suspect under Dutch law. As we speak FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation based on this arrest. Thank you to our Dutch National Police partners for their continued work with us in this case and the industry partners who shared information with us. The investigation continues. -DKP🇺🇸

He spent 10 years in the US Secret Service protecting the President. Then he switched to chasing financial criminals. One case: a guy lost $7M to a fake crypto platform. The money went through China, Russia and Ukraine and none of it came back. Mudassar Malik (CEO @deconflict_) is now building what he wished existed when he worked in law enforcement. 2:47 10 years inside the Secret Service 4:09 The Secret Service has a second job nobody talks about 13:13 What getting shot at actually feels like 14:17 The case that made him leave law enforcement 18:26 By the time law enforcement shows up, the money is gone 21:43 How someone lost $7M in six weeks 24:47 When the trail leads back to North Korea 27:21 The smartest criminal he ever caught 31:01 The one mistake that can drain your cold wallet 35:14 Why scammers don’t just get normal jobs 45:37 Crypto regulation, AI, and what law enforcement isn’t ready for

🚨 Bidget's hot wallets were drained. Over $350M was stolen, possibly the largest hack of the year. Security in crypto has always been hard. AI is making vulnerability research and exploits cheaper, which widens the asymmetry in favor of attackers. Closing that gap means reworking security paradigms and architectures, not just patching the last incident.

确认 1.初步评估涉及金额约3.516亿美金 2.平台有三层钱包体系，确认当前全部冷钱包未受影响 3.用户资金安全。本次损失金额完全在Bitget用户保护基金覆盖范围之内，保护基金当前规模逾4.64亿美元 已采取的措施： 1.事件发生后数分钟内启动应急响应小组 2.异常转账地址已标记并上报 3.出于资金安全考虑，提币功能暂时关闭，待安全核查完成后有序恢复 4.已通知执法机构及链上安全机构介入调查 我将以小时级别持续同步事件最新进展，请关注本渠道及官方各平台。正在准备会开启一个直播，直面大家有的任何问题。

🚨 Mexican authorities just found the FOURTH hidden crypto mining farm near the same hydroelectric dam in Puebla since early last year. The latest site, in Tlaola, held about 300 GPUs, 80 medium-voltage terminals and eight Starlink satellite antennas (yup, those same ones you see at pig butchering compounds 🐷) inside a ramshackle building off a gravel road. Neighbors say the whirring carried a full kilometer. CNN reported that Police pointed to that noise and to a power draw far beyond what the nearby communities use. Authorities are looking at whether it tapped power from infrastructure linked to the dam, and whether the coins were used to launder illicit money. No arrests or operators have been announced. A security analyst told Reuters the setup would take a well-financed group, such as one of Mexico's most powerful cartels. That is his assessment, and nothing public confirms it yet. Why mining matters to laundering cases: coins from a mining pool arrive with no sender and no exchange deposit behind them, so they can pass as ordinary income. Stolen power makes them close to free. The other side of cartel money keeps showing up in U.S. Department of Justice filings. Nothing public ties these cases to Tlaola: 2024, Operation Fortune Runner: 24 charged in a scheme that moved $50M+ in Sinaloa-linked proceeds with Chinese underground banking, including crypto purchases 2025: a Chinese money laundering network pleaded guilty to laundering $92M+ in drug proceeds through U.S. shell company accounts May 2026: two Chinese nationals charged with laundering cocaine and fentanyl proceeds for Sinaloa and CJNG using mirror transfers, encrypted apps and trade-based schemes A mountain farm and a cross-border broker leave evidence in different agencies' files. It adds up only when someone can line those files up. 🚔 Deconflict exists for that. Agencies find where their cases overlap without opening their files to anyone. Free for law enforcement, always.

My next podcast guest spent 10 years as a Special Agent for the US Secret Service. He protected the President and his family, investigated white collar crime, got shot at multiple times, and left 7 months ago to build a company fighting financial fraud. Mudassar Malik (Founder of @deconflict_) and I talk about why law enforcement is always 3-4 months behind the scam, the smartest criminal he ever caught, and what 22 years of chasing bad guys taught him about how they actually think. Trailer out now, full episode coming soon!

2/▪️@deconflict_ Head of Law Enforcement & Investigations Robert Whitaker keynote speaker at MRC San Diego (👉lnkd.in/p/dFHA63j2) ▪️@deconflict_ Head of Growth Dominic Schaffer on panel at CBC Summit USA (👉lnkd.in/p/d4ZrkJGR)

A 22-year-old crypto scam ringleader is pleading guilty in a staggering $245 million crypto theft case that prosecutors say stretched around the world. Authorities say Malone Lam and his co-conspirators targeted victims' crypto wallets using social engineering and hacked information, while some members of the operation even resorted to breaking into homes. Prosecutors say the stolen fortune helped fund private jets, luxury cars, high-end watches, designer handbags and multimillion-dollar rental homes. Lam pleads guilty to participating in a RICO conspiracy and is due back in federal court in December. | @DanaPerino @AmericaNewsroom

This week, the DOJ announced the seizure of more than $560,000 in cryptocurrency intended for Hamas’ Al Qassam Brigades, alongside domains and servers used to raise funds and recruit supporters. The alleged model behind this is worth studying. Supporters were directed from an encrypted group chat to a fundraising website, where they received rotating crypto donation addresses. The infrastructure did more than collect funds. It distributed payment instructions, communicated with prospective donors, supported recruitment activity, and allowed the network to replace compromised addresses. From an investigative perspective, the relevant object is not one wallet. It is the relationship graph connecting: • Wallet addresses, transaction flows, and potential address reuse • Domains, servers, hosting infrastructure, and web content • Encrypted communication groups and referral pathways • Donor-facing identities and contact points • Virtual-asset service providers involved in collection, conversion, or cash-out • Related entities and previously observed infrastructure The DOJ said investigators used multiple human sources to identify, trace, and seize the cryptocurrency. The FBI’s control of the domains and servers also enabled it to intercept donations and obtain information about thousands of people who contacted Hamas online. That combination points towards a need to broaden our investigative sight. A blockchain alert can identify exposure to a suspicious address. It cannot, on its own, establish intent, control, attribution, or a service provider’s role. Those conclusions require corroboration across transaction data, technical infrastructure, and human-source information. The disruption was not only about taking cryptocurrency. It targeted the network’s ability to publish new payment instructions, reach donors, and rebuild trust after an address was compromised. For financial-crime teams, the lesson is clear: follow the funds, but also follow the instructions, infrastructure, and entities that make the funds move. That is how an isolated wallet alert becomes a network map, and a network map can support timely disruption. justice.gov/usao-dc/pr/justi…

🚨 3,283 banks. $21.8 trillion in assets. One shared blockchain, and nobody has picked the technology yet. On August 25, thirty-nine state bankers associations announced the BankChain Alliance, an industry-owned permissioned network targeting a 2027 launch. Tokenized deposits, bank-issued stablecoins, programmable payments, automated settlement. The goal is keeping deposits inside the regulated banking system instead of watching them walk out to outside issuers. The part that matters to investigators isn’t the launch date. It’s that the architecture still hasn’t been written. The Alliance finished the first phase of its RFP and is evaluating vendors now. Coverage says compliance carried more weight in that process than anything else. That’s good. It’s also not the same thing as investigative access. Compliance means a bank can satisfy its regulator. Investigative access means a detective can get a straight answer about a tokenized deposit in a useful timeframe, in a format that holds up in a hearing, and can find out whether four other agencies are already sitting on the same subject. Those are different requirements. Ask only for the first and you don’t get the second for free. What needs to be locked in while the stack is still open: ✅ Node governance — who sees what, and who can actually be served with legal process   ✅ Immutable logging of compliance events, not just the transactions   ✅ One standard records request format so 3,283 banks don’t invent 3,283 different exports   ✅ Clear freeze and seizure pathways for assets held on the network   ✅ Interoperability mapped at design time — every bridge out is a seam, and criminals find seams first There’s one more gap that never shows up in a technical RFP. When a community bank’s BSA team files on a subject, they usually have no idea that subject is already the target of an active case somewhere else. And the agent running that case has no idea a bank just flagged it. The intelligence exists on both sides. The coordination doesn’t. That’s the gap Deconflict was built to close. Agencies deconflict their cases with each other, and verified law enforcement intelligence reaches the compliance teams who can actually act on it. 🚔 Free for law enforcement. Always will be. 👉 If your unit works with bank partners, what are you asking them for right now — while the design decisions are still reversible? Learn more deconflict.com