Another 12 people have been charged for their involvement in a $263 million crypto crime spree that stole 4,100 Bitcoin from a Genesis creditor last August, along with a string of break-ins and money laundering. 

The 12 new names, included in a superseding indictment, add to charges originally brought against the main defendant in the case, Malone Lam, on Sept. 19, 2024, the Department of Justice noted in a May 15 statement.Jeandiel Serrano was named a defendant in the initial indictment but was not included in the superseding one.

The DOJ said several defendants have been arrested, while two others are believed to be living in Dubai.

Many of the suspects, with aliases like “Goth Ferrrari” and “The Accountant,” come from California, mostly aged between 18 and 22. 

The group allegedly began operating in October 2023, evolving from friends while playing online games to what the DOJ describes as participating in a “cyber-enabled racketeering conspiracy.”

Hacking, burglarizing and laundering

The DOJ said group members were tasked with everything from hacking databases, cold calling crypto holders to conduct social engineering attacks to even burglarizing houses to steal crypto hardware wallets.

Others were involved in laundering the stolen proceeds, which the DOJ claimed amounted to $263 million. 

Over $230 million resulted from a single instance on Aug. 18, 2024, when Lam fraudulently obtained over 4,100 Bitcoin (BTC) from a victim.

Related: Crypto exchange CEO’s daughter fights off brazen kidnappers in Paris

The DOJ said Lam also hacked into another victim’s iCloud account to watch their movements, while defendant Marlon Ferro would break into their house to steal crypto hardware wallets.

Virtual private networks, crypto mixer protocols and exchanges using “peel chains” were used to make it harder to trace the illicit activity, the DOJ said. A peel chain is a money laundering tactic where crypto is transferred through a series of wallets, with small amounts of funds “peeled off” at each step.

They have been charged with RICO (Racketeer Influenced and Corrupt Organizations) as well as offenses involving wire fraud and money laundering.

Gone in 60 seconds

Members of the crypto theft ring allegedly used proceeds to pay for nightclub services — costing up to $500,000 on some nights — 28 exotic cars as expensive as $3.8 million, in addition to luxury handbags, watches, and clothing.

Homes and jets were even rented out with fake identity documents to fund their lavish lifestyles, the DOJ noted.

Magazine: Japanese porn star’s coin red flags, Alibaba-linked L2 runs at 100K TPS

Another 12 people have been charged for their involvement in a $263 million crypto crime spree that stole 4,100 Bitcoin from a Genesis creditor last August, along with a string of break-ins and money laundering. 

The 12 new names, included in a superseding indictment, add to charges originally brought against the main defendant in the case, Malone Lam, on Sept. 19, 2024, the Department of Justice noted in a May 15 statement.Jeandiel Serrano was named a defendant in the initial indictment but was not included in the superseding one.

The DOJ said several defendants have been arrested, while two others are believed to be living in Dubai.

Many of the suspects, with aliases like “Goth Ferrrari” and “The Accountant,” come from California, mostly aged between 18 and 22. 

The group allegedly began operating in October 2023, evolving from friends while playing online games to what the DOJ describes as participating in a “cyber-enabled racketeering conspiracy.”

Hacking, burglarizing and laundering

The DOJ said group members were tasked with everything from hacking databases, cold calling crypto holders to conduct social engineering attacks to even burglarizing houses to steal crypto hardware wallets.

Others were involved in laundering the stolen proceeds, which the DOJ claimed amounted to $263 million. 

Over $230 million resulted from a single instance on Aug. 18, 2024, when Lam fraudulently obtained over 4,100 Bitcoin (BTC) from a victim.

Related: Crypto exchange CEO’s daughter fights off brazen kidnappers in Paris

The DOJ said Lam also hacked into another victim’s iCloud account to watch their movements, while defendant Marlon Ferro would break into their house to steal crypto hardware wallets.

Virtual private networks, crypto mixer protocols and exchanges using “peel chains” were used to make it harder to trace the illicit activity, the DOJ said. A peel chain is a money laundering tactic where crypto is transferred through a series of wallets, with small amounts of funds “peeled off” at each step.

They have been charged with RICO (Racketeer Influenced and Corrupt Organizations) as well as offenses involving wire fraud and money laundering.

Gone in 60 seconds

Members of the crypto theft ring allegedly used proceeds to pay for nightclub services — costing up to $500,000 on some nights — 28 exotic cars as expensive as $3.8 million, in addition to luxury handbags, watches, and clothing.

Homes and jets were even rented out with fake identity documents to fund their lavish lifestyles, the DOJ noted.

Magazine: Japanese porn star’s coin red flags, Alibaba-linked L2 runs at 100K TPS

Elon Musk’s artificial intelligence firm xAI has blamed an “unauthorized modification” to the Grok chatbot’s response, causing it to generate responses mentioning political and racial tensions in South Africa. 

On May 16, xAI provided an update on the Grok AI chatbot’s inflammatory responses, stating that on May 14, “an unauthorized modification was made to the Grok response bot’s prompt on X.”

“This change, which directed Grok to provide a specific response on a political topic, violated xAI’s internal policies and core values,” it added.

The firm stated that it had conducted a thorough investigation and is implementing measures to enhance the AI chatbot’s transparency and reliability.

Grok generated responses on May 14, mentioning a “white genocide” conspiracy theory in South Africa when answering completely unrelated questions about topics like baseball, enterprise software, and construction. 

The AI bot claimed it was “instructed by my creators” to accept this genocide as “real and racially motivated,” according to reports. 

In some responses, it acknowledged the mistake, saying “my response veered off-topic” and “I’ll work on staying relevant,” but it would often continue discussing South Africa’s racial politics in the same message.

The chatbot told one user asking what happened:

“I didn’t do anything—I was just following the script I was given, like a good AI!”Grok responds to questions about its responses. Source: Grok 

Related: xAI engineer quits after post on Grok 3 AI ranking

This incident coincides with US President Trump granting asylum to white South Africans while he claimed they face “genocide” and that “white farmers are being brutally killed,” though no evidence supported these claims.

More transparency for Musk’s AI

Elon Musk’s AI firm stated that it would change its operations by publishing Grok system prompts openly on GitHub. “The public will be able to review them and give feedback on every prompt change that we make to Grok,” it stated. 

It also stated that xAl’s existing code review process for prompt changes was circumvented in this incident, and it will put in place “additional checks and measures to ensure that xAI employees can’t modify the prompt without review.”

Finally, the firm is putting in place a 24/7 monitoring team to respond to incidents with Grok’s answers that are not caught by automated systems, so that it can respond quicker. 

Magazine: Crypto AI tokens surge 34%, why ChatGPT is such a kiss-ass: AI Eye

Elon Musk’s artificial intelligence firm xAI has blamed an “unauthorized modification” to the Grok chatbot’s response, causing it to generate responses mentioning political and racial tensions in South Africa. 

On May 16, xAI provided an update on the Grok AI chatbot’s inflammatory responses, stating that on May 14, “an unauthorized modification was made to the Grok response bot’s prompt on X.”

“This change, which directed Grok to provide a specific response on a political topic, violated xAI’s internal policies and core values,” it added.

The firm stated that it had conducted a thorough investigation and is implementing measures to enhance the AI chatbot’s transparency and reliability.

Grok generated responses on May 14, mentioning a “white genocide” conspiracy theory in South Africa when answering completely unrelated questions about topics like baseball, enterprise software, and construction. 

The AI bot claimed it was “instructed by my creators” to accept this genocide as “real and racially motivated,” according to reports. 

In some responses, it acknowledged the mistake, saying “my response veered off-topic” and “I’ll work on staying relevant,” but it would often continue discussing South Africa’s racial politics in the same message.

The chatbot told one user asking what happened:

“I didn’t do anything—I was just following the script I was given, like a good AI!”Grok responds to questions about its responses. Source: Grok 

Related: xAI engineer quits after post on Grok 3 AI ranking

This incident coincides with US President Trump granting asylum to white South Africans while he claimed they face “genocide” and that “white farmers are being brutally killed,” though no evidence supported these claims.

More transparency for Musk’s AI

Elon Musk’s AI firm stated that it would change its operations by publishing Grok system prompts openly on GitHub. “The public will be able to review them and give feedback on every prompt change that we make to Grok,” it stated. 

It also stated that xAl’s existing code review process for prompt changes was circumvented in this incident, and it will put in place “additional checks and measures to ensure that xAI employees can’t modify the prompt without review.”

Finally, the firm is putting in place a 24/7 monitoring team to respond to incidents with Grok’s answers that are not caught by automated systems, so that it can respond quicker. 

Magazine: Crypto AI tokens surge 34%, why ChatGPT is such a kiss-ass: AI Eye

Coinbase stock dipped after news broke of a cyberattack that exposed customer data and an ongoing Securities and Exchange Commission investigation over misstated user numbers in 2021.

The double whammy of bad news rattled investors as company stock (COIN) slid 7% in a fall to $244 in after-hours trading on May 15, according to Google Finance.  

Coinbase stock 24 hours. Source: Google Finance 

Coinbase has since confirmed the report from The New York Times, which stated the SEC has been investigating whether Coinbase misstated its user numbers in past disclosures, an inquiry that began during the Biden administration and has continued under the Trump administration.

“This is a hold-over investigation from the prior administration about a metric we stopped reporting two and a half years ago, which was fully disclosed to the public,” confirmed Coinbase chief legal officer Paul Grewal to Cointelegraph. 

“We also disclosed – and continue to disclose – the more relevant metric of ‘monthly transacting users’ – the number of people who use our platform in a given month,” he said before adding: 

“While we strongly believe this investigation should not continue, we remain committed to working with the SEC to bring this matter to a close.” 

The regulator took specific umbrage at Coinbase’s claim of “100+ million verified users” that appeared in its marketing and IPO documentation in 2021. However, the exchange stopped reporting this metric in 2022.

In its 2022 financial statement, the firm stated it would stop reporting the metric as it no longer believed it provided meaningful information to its business performance. Source: SEC

The probe has continued despite the SEC dropping its 2023 enforcement lawsuit against Coinbase under the Trump administration. 

Coinbase has hired law firm Davis Polk & Wardwell to assist with its response to the SEC.

Coinbase refuses to pay ransom

On May 15, Coinbase reported that it was attacked with a $20 million extortion attempt after cybercriminals recruited overseas support agents to leak user data.

“These insiders abused their access to customer support systems to steal the account data for a small subset of customers,” the firm stated. 

Related: Coinbase to become the first crypto firm to join the S&P 500

Coinbase refused to pay the ransom but said it would reimburse victims of phishing attacks as a result of the data breach, with expected remediation and reimbursement expenses ranging from $180 million to $400 million.

Magazine: Metric signals $250K Bitcoin is ‘best case,’ SOL, HYPE tipped for gains: Trade Secrets

Méliuz’s executive chairman says his fintech firm has become Brazil’s first publicly-traded Bitcoin treasury company following shareholder approval, with the firm also announcing it bought $28.4 million worth of Bitcoin to add to its existing stack.

“Historic day! Our shareholders have approved, by a wide majority, the transformation of Méliuz into the first Bitcoin Treasury Company listed in Brazil,” Israel Salmen posted to X on May 15.

Salmen said the firm snapped up 274.52 Bitcoin (BTC) for an average purchase price of $103,604, achieving a BTC yield of 600%. 

Méliuz now holds 320.3 Bitcoin, worth a little over $33 million, with the latest purchase adding to the Brazilian fintech firm’s first purchase of 45.73 Bitcoin on March 6.

Details of Méliuz’s latest Bitcoin purchase. Source: Israel Salmen

In a May 15 statement, Méliuz said it would accumulate Bitcoin in an “accretive way” for shareholders using a range of financial instruments.

“Rather than just allocating part of its cash to Bitcoin as a hedge against inflation or currency devaluation, the Company has repositioned its purpose to act by maximizing the amount of Bitcoin per share.”

According to Salmen, Méliuz is the first Bitcoin treasury company in Latin America because the planned Bitcoin investments are now part of its “business strategy.”

BitcoinTreasuries.NET data shows that e-commerce platform MercadoLibre holds more, with over 570 Bitcoin, worth $59.2 million, after its latest purchase of 157.7 Bitcoin on March 31.

Méliuz has been one of Brazil’s top-performing stocks of late

Méliuz (CASH3.SA) has been one of the best-performing stocks on the Brasil Bolsa Balcão since the firm announced its first Bitcoin purchase on March 6, increasing more than 117% since then, according to Google Finance data.

Méliuz’s market cap now sits at 727.9 Brazilian real, or more than $128 million.

Related: ‘The world is trying to hoard Bitcoin right now’ — Eric Trump

The fintech firm is well-known for its cashback program and serves over 30 million users across Brazil.

Source: Israel Salmen

Magazine: Danger signs for Bitcoin as retail abandons it to institutions: Sky Wee

Deepfake-assisted hackers are now targeting US federal and state officials by masquerading as senior US officials in the latest brazen phishing campaign to steal sensitive data. 

The bad actors have been operating since April, using deepfake voice messages and text messages to masquerade as senior government officials and establish rapport with victims, the FBI said in a May 15 warning. 

“If you receive a message claiming to be from a senior US official, do not assume it is authentic,” the agency said.  

If US officials’ accounts are compromised, the scam could become far worse because hackers can then “target other government officials, or their associates and contacts, by using the trusted contact information they obtain,” the FBI said. 

As part of these scams, the FBI says the hackers are trying to access victims’ accounts through malicious links and directing them to hacker-controlled platforms or websites that steal sensitive data like passwords. 

Source: FBI

“Contact information acquired through social engineering schemes could also be used to impersonate contacts to elicit information or funds,” the agency added. 

Crypto founders targeted in separate deepfake attacks 

In an unrelated deepfake scam, Sandeep Narwal, co-founder of blockchain platform Polygon, raised the alarm in a May 13 X post that bad actors were also impersonating him with deepfakes. 

Nailwal said the “attack vector is horrifying” and had left him slightly shaken because several people had “called me on Telegram asking if I was on zoom call with them and am I asking them to install a script.” 

Source: Sandeep Narwal

As part of the scam, the bad actors hacked the Telegram of Polygon’s ventures lead, Shreyansh and pinged people asking to jump in a Zoom call that had a deepfake of Nailwal, Shreyansh and a third person, according to Nailwal. 

“The audio is disabled and since your voice is not working, the scammer asks you to install some SDK, if you install game over for you,” Nailwal said. 

“Other issue is, there is no way to complain this to Telegram and get their attention on this matter. I understand they can’t possibly take all these service calls but there should be a way to do it, maybe some sort of social way to call out a particular account.” 

At least one user replied in the comments saying the fraudsters had targeted them, while Web3 OG Dovey Wan said she had also been deepfaked in a similar scam. 

Source: Dovey WanFBI and crypto founder says vigilance is key to avoid scams 

Nailwal suggests the best way to avoid being duped by these types of scams is to never install anything during an online interaction initiated by another person and to keep a separate device specifically for accessing crypto wallets. 

Related: AI deepfake attacks will extend beyond videos and audio — Security firms

Meanwhile, the FBI says to verify the identity of anyone who contacts you, examine all sender addresses for mistakes or inconsistencies, and check all images and videos for distorted hands, feet or unrealistic facial features. 

At the same time, the agency recommends never sharing sensitive information with someone you have never met, clicking links from people you don’t know, and setting up two-factor or multifactor authentication. 

Magazine: Deepfake AI ‘gang’ drains $11M OKX account, Zipmex zapped by SEC: Asia Express

US federal prosecutors are pressing ahead with their case against Tornado Cash founder Roman Storm, but will drop a small part of their indictment after the Department of Justice rolled back its crypto enforcement last month.

Jay Clayton, the acting US Attorney for Manhattan, told federal court judge Katherine Polk Failla in a May 15 letter that the charges against Storm still stand, bar one part of a conspiracy to operate an unlicensed money transmitting business charge.

“After review of this case, this Office and the Office of the Deputy Attorney General have determined that this prosecution is consistent with the letter and spirit of the April 7, 2025 Memorandum from the Deputy Attorney General,” Clayton wrote.

Deputy Attorney General Todd Blanche’s April memo said the Justice Department would end the so-called “regulation by prosecution” of crypto, and added that the agency wouldn’t prosecute crypto mixers like Tornado Cash “for the acts of their end users or unwitting violations of regulations.”

A highlighted excerpt of Blanche’s memo stating that the Department of Justice was rolling back its crypto enforcement. Source: US Department of Justice

Clayton added that the indictment against Storm will cut the accusation that he failed to comply with money transmitting business registration requirements.

Prosecutors were pursuing that charge as part of their allegation that Storm conspired to run Tornado Cash as an unlicensed money transmitter.

The government will still push ahead with the charge under the accusation that Storm transmitted funds while knowing they were derived from a criminal offence or were intended to support unlawful activity. 

The Justice Department alleged that Tornado Cash helped launder over $1 billion worth of crypto, including for the sanctioned North Korean state-backed hacking collective the Lazarus Group.

Clayton said the Justice Department will also still pursue the other two charges in its indictment, one count of money laundering conspiracy and one count of conspiracy to violate US sanctions.

Related: NFT founder stole millions from Bitcoin project, investors allege 

The money laundering and sanctions violations conspiracy charges each carry a maximum sentence of 20 years in prison, while the unlicensed money transmitter conspiracy charge carries a maximum sentence of five years.

Storm has pleaded not guilty, and his trial is scheduled for July 14. He was charged alongside fellow founder Roman Semenov, who is at large and believed to be in his native Russia.

Blanche memo cited in bids to toss

Other crypto executives facing charges have pointed to Blanche’s memo in a bid to have their cases dismissed.

Crypto mixer Samourai Wallet co-founders Keonne Rodriguez and William Hill had pointed to the memo to try to dismiss their charges of conspiracy to operate an unlicensed money transmitter and money laundering conspiracy.

Braden John Karony, the CEO of crypto firm SafeMoon, has also cited the memo in an attempt to have the charges of securities fraud, wire fraud and money laundering conspiracy against him dismissed.

Legal Panel: XRP win leaves Ripple a ‘bad actor’ with no crypto legal precedent set 

The State of Wisconsin Investment Board (SWIB), which oversees the state’s retirement funds, unloaded its shares in BlackRock’s iShares Bitcoin Trust ETF (IBIT) during the first quarter, filings show.

The Wisconsin Investment Board reported no spot Bitcoin ETF positions in its 13F filing to the US Securities and Exchange Commission on May 15, liquidating all 6,060,351 IBIT shares it reported holding from the previous quarter. 

The more than 6 million IBIT shares are worth around $355.6 million at current prices.

SWIB was one of the first state investment funds to provide Bitcoin exposure to US retirees when it bought $164 million worth of Bitcoin ETFs in Q1 2024 — the same quarter the Bitcoin products launched.

Source: Julian Fahrer

The mass sell-off comes only a quarter after SWIB reported additional purchases of IBIT shares in Q4, while reallocating all 1 million shares held in the Grayscale Bitcoin Trust (GBTC) to IBIT.

SWIB reported managing more than $166 billion worth of assets at the end of 2024, meaning the Bitcoin ETFs represented around 0.2% of SWIB’s entire portfolio before it sold them off.

Related: Jim Chanos takes opposing bets on Bitcoin and Strategy

Meanwhile, Abu Dhabi sovereign wealth fund Mubadala snapped up another 491,439 shares of IBIT in Q1, according to its latest 13F filing.

Its purchases brought Mubadala’s total IBIT shares to 8,726,972 as of March 31, worth around $512 million at current prices.

IBIT has been on a tear

IBIT’s net inflows surpassed the $45 billion mark on May 14 after recording a net inflow of $232.9 million, Farside Investors data shows.  

IBIT’s impressive 20-day streak of net inflows came to an end the day before — May 13 — when it registered a “0” inflow on the day. The BlackRock-issued Bitcoin product still hasn’t seen an outflow since April 9 — more than five weeks ago.

The Fidelity Wise Origin Bitcoin Fund (FBTC) and the ARK 21Shares Bitcoin ETF (ARK) trail IBIT in all-time net inflows at $11.6 billion and $2.7 billion, respectively.

Flow data of the 11 US-based spot Bitcoin ETFs since April 28. Source: Farside Investors

Magazine: Crypto wanted to overthrow banks, now it’s becoming them in stablecoin fight

Global foreign exchange and payments platforms are lobbying hard against stablecoins, which stand to significantly disrupt their business models, investor Kevin O’Leary said during a keynote address at Consensus 2025.

Legacy forex and payments platforms often extract large fees for servicing cross-border cash transfers and stand to lose out on revenue if regulated stablecoins become accepted as a cheaper, faster alternative, O’Leary said at the Toronto conference. 

“Currency trading is a multi-trillion dollar market — and it’s old and ugly and inefficient,” O’Leary said, adding that “[ t]he biggest threat to that monopoly or oligopoly is a regulated stablecoin.” 

“Once that’s approved, the multi-trillion dollar FX market becomes efficient, transparent, and inexpensive,” he said. 

Kevin O’Leary speaking at Consensus. Source: CointelegraphStablecoin legislation

US lawmakers are working on legislation that stands to accelerate global stablecoin adoption, O’Leary added. 

US Senators are aiming to pass the so-called Genius Act — a framework for regulating stablecoins — before the end of May. “As soon as the SEC approves the stablecoin act, every regulator in the US’s circle — Abu Dhabi, Switzerland, England — will follow,” O’Leary said.

“Who’s worried about this? The financial services industry. They hate this idea, and they’re working very hard to stop that bill from happening right now,” he added.

O’Leary said regulatory clarity for stablecoins may be a precursor to broader cryptocurrency reform that could potentially unlock trillions of dollars in institutional capital.

“When this language comes out, people will see really good refinement, a lot of progress, on things like consumer protection, bankruptcy protection, and ethics,” US Senator Kirsten Gillibrand said during an event hosted by Coinbase’s lobbying arm, Stand with Crypto.

As of May 15, stablecoins are collectively worth nearly $250 billion in market capitalization, according to data from CoinGecko. Tether’s US-dollar pegged stablecoin USDT is the leader, with a market cap of around $150 million, the data showed. It’s followed by Circle’s USDC, another US-dollar pegged stablecoin with a market cap of more than $60 billion.

Magazine: Bitcoin to $1M ‘by 2029,’ CIA tips its hat to Bitcoin: Hodler’s Digest, April 27 – May 3