CRYPTO ROAST

☠️ The $50 NPM “heist of the century” 🟠 Hackers pulled off what could’ve been the biggest supply-chain attack in years: they compromised an NPM dev whose packages are downloaded 2 billion times per week. That’s basically a skeleton key to the entire internet. 🟠 With access like that, they could’ve siphoned millions, wrecked projects, or straight-up bricked the ecosystem. The world was their oyster. 🟠 Instead… they walked away with $50. In ETH and random memecoins. That’s not even enough for gas fees on a bad day. 🟠 Security researchers are laughing, but also sounding alarms — malicious code was slipped into widely used JavaScript libs. Just because the payout was pathetic doesn’t mean the risk is gone. Infected projects could still be out there. 😦 This wasn’t a $50 hack. It was a $50 proof-of-concept. And the next crew might not be so dumb. 📱 Token Report (X) — your daily pulse on crypto and global markets

⚡️ UPD: WLFI = new age mafia 🟠Polygon DevRel Bruno Skvorc says World Liberty Financial straight-up stole his money. His wallet was flagged “high risk” and the team refused to unlock his tokens. Reason? Old Tornado Cash transactions and distant links to sanctioned platforms. 🟠His words: “TLDR: they stole my money. And since it’s the US President’s family, I can’t do anything. This is the new age mafia.” That’s not just FUD — that’s firsthand. 🟠Skvorc isn’t a random anon — he worked on Ethereum 2.0 and founded RMRK. And he’s not alone: according to him, 5 more investors got hit with 100% token lockups. 🟠Bonus: Justin Sun also revealed his WLFI allocation was frozen after onchain trackers spotted a $9M transfer. His wallet was instantly blacklisted. 🟠Reality check: WLFI calls it “compliance,” but it looks more like a control tool — deciding who gets tokens and who gets rug-pulled. 🔥 WLFI is starting to look less like a project and more like a crypto cartel. Today it’s Tornado Cash, tomorrow it’s you — if it benefits the Trumps. 📱 Token Report (X) — your daily pulse on crypto and global markets

😈 Ethereum smart contracts as a delivery service for malware 🟠ReversingLabs uncovered a creative attack: hackers hid malicious code inside Ethereum smart contracts and pushed it into developer projects through npm. 🟠It started with the package colortoolsv2 (published July 7) and its clone mimelib2. Both looked like harmless “utilities,” but inside were just a couple of files and an obfuscated payload. Once launched, the package pulled a second-stage malware from a C2 server. 🟠The twist: instead of regular URLs, attackers used smart contracts as hosting for command-and-control. At first glance, they looked like ordinary contracts on the blockchain — but in reality, they were entry points for malware delivery. 🟠This was part of a larger campaign: dozens of fake GitHub repos with names like solana-trading-bot-v2 or ethereum-mev-bot-v2. Polished commits, thousands of stars, fake “contributors” — but under the hood, the sole purpose was to slip in a malicious npm dependency. ✨ Takeaway: supply chain attacks just hit a new level. Blockchain isn’t just for DeFi and scams anymore — it’s now doubling as a headache factory for security teams. Developers should remember: even the most “popular” repo might be a trap. ➡️CRYPTO ROAST

🤘 Lazarus finally takes an L 🟠North Korea’s Lazarus Group — the same crew behind billion-dollar heists like Ronin and Bybit — just got clowned by a DeFi DAO vote. Yes, not the CIA, not Interpol… a governance proposal. 🟠They phished investor Kuan Sun via a fake Zoom client and drained $13.5M. Normally that’s lights out. But Venus Protocol hit the panic button, paused the platform, and forced-liquidated the hacker’s wallet. The funds were snatched back in less than 12 hours. 🟠Imagine spending years building the most notorious crypto hacking empire… only to get wrecked by a bunch of DeFi nerds with a snapshot vote and Discord pings. 🟠The victim now calls it “a battle we actually won.” Translation: Lazarus got ratio’d on-chain. 👁 Even state-backed hackers aren’t safe from DeFi mobs when the chain turns against them. ➡️CRYPTO ROAST

⚡️UPD: Bags are getting lighter 🟠Over 80% of holders already cashed out — only whale #2 and #5 still pretending to “HODL for the vision.” 🟠Top dog moonmanifest.eth decided to cling to his 1B tokens. Sure, his fantasy balance dropped hard, but at $0.2318 it’s still worth ~$230M. That’s some expensive hopium. 🟠Meanwhile convexcuck.eth (TOP6) rage-dumped $3.8M worth of WLFI through Whales Market — which is quickly becoming the official pawn shop of WLFI. 📉 The sell-off circus continues. Whales act stoic, retailers panic, and everyone’s waiting for the first big splash of liquidity to hit the drain. ➡️CRYPTO ROAST

💵 Trump Family’s $5B WLFI Circus 🟠The Trump clan is back in the spotlight — and not for politics. Reports show they hold 60% of World Liberty Financial shares and rake in 75% of WLFI sales revenue. By offloading tokens to their pet exchange Alt5 Sigma (which raised $750M), the family has already pocketed an estimated $500M out of thin air. 🟠In just 24 hours, WLFI pumped Trump’s net worth by a jaw-dropping $5B — all off a presale coin that started at $0.015 and now trades near $0.25. For comparison: the Trump kids’ WLFI bags are now valued higher than the family’s entire real estate portfolio. 🟠To make matters worse, hackers are exploiting the EIP-7702 loophole to drain presale wallets. Victims sign a “harmless” approval, but instead hand over control of their WLFI balances. 🟠Translation: retail is getting fleeced from both ends. On one side, the Trumps bagging billions; on the other, hackers farming the hopefuls. ❓ Big question: when will the Trump fam finally hit the “sell” button and pull liquidity? Because when they do, you’ll hear the dump from space. ➡️CRYPTO ROAST

😈 My wife’s dad is an idiot: AI crypto scam edition 🟠A Reddit user shared how his father-in-law fell for an “AI crypto” investment promising over $100K in quick profits with almost no capital. 🟠Despite clear warnings — including an article from his wife and mother-in-law — the man refused to believe it’s a scam. Instead, he doubled down: took out a $50K loan and planned to put $25K straight into the scheme. 🟠The site he showed them looked blatantly fake, but now he’s giving his family lectures on financial freedom while his “profits” exist only on a dashboard. 🟠Community advice: tell him to try withdrawing even $10K. Spoiler — he won’t be able to. That’s when reality hits hardest. 🤡 The man thinks he’s achieving financial freedom. In reality, he’s only buying freedom from his own money. ➡️CRYPTO ROAST

➕ Indian court jails 14 for life in Bitcoin extortion 🟠Big ruling out of India: a special anti-corruption court has sentenced 14 people to life imprisonment — including ex-BJP legislator Nalin Kotadiya and 11 police officers. 🟠The case goes back to 2018: businessman Shailesh Bhatt, who had recovered part of his losses from the BitConnect collapse in BTC (752 Bitcoin), was kidnapped and beaten. Under pressure, he was forced to admit where the coins were stored. The gang extorted 34 BTC and $3.6M in cash — all with the direct involvement of police. 🟠Leading the abduction was inspector Anant Patel, backed by senior officers, while Kotadiya allegedly masterminded the plan. Instead of protecting citizens, law enforcement was running the heist. 🟠After Bhatt escalated the case to the Union Home Ministry, investigators arrested 15 people and presented 173 witnesses at trial. On Friday, the court handed down life sentences to all. Gold ornaments seized from ex-SP Patel will now be handed over to India’s Mint. #️⃣ Takeaway: crypto has been fueling some of the darkest scams — but this verdict shows even politicians and cops can’t dodge accountability forever. ➡️CRYPTO ROAST

🎸 UPD on $YZY: the numbers and the players 🟠Bubblemaps revealed that $12M in profits from the $YZY hype went to Hayden Davis — the infamous creator of LIBRA. Back then, LIBRA was shilled by Argentina’s president, only to collapse and wipe out hundreds of millions. Davis even bragged he “controlled the president through his sister.” Investigations in the US and Argentina are still ongoing. 🟠Same playbook again: millions for insiders, losses for the crowd. 🟠To make it worse, hackers hijacked Kanye West’s Instagram and used it to promote a fake token — fueling the funnel around $YZY and dragging in even more victims. 📉 Final damage report: 51,862 wallets lost $1–$1K 5,269 lost $1K–$10K 1,025 lost $10K–$100K 108 lost $100K–$1M 3 lost $1M+ 🟠On the flip side — just 11 wallets walked away with $1M+ each. 🎤 $YZY wasn’t a market launch. It was a redistribution funnel where tens of thousands of traders burned deposits to enrich a tiny circle of insiders. ➡️CRYPTO ROAST

😈 XPL: Pump, Dump & Justin Sun Suspicions 🟠Hyperliquid turned into a circus today: XPL (Plasma Network’s pre-market token) spiked 200% to $1.80 and crashed back to $0.61 within minutes. Biggest winner? A whale who bagged $16M in profits in just one minute, while shorts got wiped in a brutal liquidation cascade. 🟠Hours before the move, the same wallet scooped up $25M worth of XPL at $0.20, then stacked limit orders and closed longs right at the peak. In total, two whale wallets pulled in $27.5M, draining Hyperliquid’s liquidity pool. 🟠The kicker: on-chain traces point to a wallet long suspected to belong to Justin Sun. The trades happened during early Beijing hours, and the playbook matches his usual style — aggressive longs, fast exits, and liquidity traps. 🟠As of now, the whale still holds a partial long with about $1M in unrealized profit, and already withdrew $5M USDC on Arbitrum. Meanwhile, Hyperliquid’s XPL liquidity tanked by 70%, leaving traders bleeding. 🔽 Pre-market tokens are whale playgrounds. While retail dreams of “the next Plasma,” whales turn the board into their personal ATM. If this wallet is really Sun’s, it’s just another reminder that fighting whales usually ends the same way. ➡️CRYPTO ROAST

🅰️Retired cop loses $1.2M in Thai crypto scam 🟠Michael Reinecke, a former Queensland police officer with 30 years on the force, thought he’d seen it all. But in Thailand, he fell for a crypto scam that drained his entire life savings — nearly $1.2M. 🟠The scheme was classic “pig butchering”: a German “entrepreneur” named Alex built trust with Reinecke over social media for more than a year. Promises of 5–10% monthly returns, slick dashboards, and in-person meetings made it all look legit. 🟠Once the money was transferred, the excuses started: “the platform crashed,” “phone stolen,” “funds hacked.” Then Alex ghosted completely. 🟠Reinecke filed a police report in Udon Thani with his wife and lawyer, but the damage was done. The couple had planned to build a home and open a small café — now those dreams are gone. 🟠This isn’t an isolated case. In H1 2025 alone, $3.1B has been lost to scams and hacks, up 88% from last year. Retirees and expats are prime targets — scammers exploit trust, loneliness, and the lure of “safe, high returns.” 👮‍♀️ If even a seasoned cop can get trapped, no one is immune. In crypto, skepticism is your best defense — and a hardware wallet is your best friend. ➡️CRYPTO ROAST

😈Vanilla Drainer: $5M stolen in 3 weeks 🟠Just when it looked like drainer scams were slowing down, a new player — Vanilla Drainer — has popped up, helping fraudsters steal $5.27M in under a month. 🟠The model is simple: Vanilla sells the tools, scammers run the phishing sites, and profits get split. In the biggest known case on Aug 5, a victim lost $3.09M, with Vanilla’s operators pocketing a $463K fee (~17%) just for providing the kit. 🟠What makes Vanilla stand out is its ability to bypass Blockaid, a fraud-detection system that had previously crippled many drainer services. Now the wave is rising again: phishing scams alone stole $7.09M in July, a 153% jump from June. 🟠To stay under the radar, Vanilla constantly rotates domains and deploys fresh malicious contracts. Investigators say this agility makes it one of the most evasive drainer services out there. 🟠Wallets linked to Vanilla currently hold over $2.2M, mostly in ETH and DAI — a stablecoin that can’t be frozen, unlike USDT or USDC. 💭 The drainer market is a hydra. Inferno, Angel, now Vanilla — services may “shut down,” but the tools, networks, and operators just adapt, rebrand, and keep cashing in. Vanilla is proof that this corner of crypto crime isn’t dying — it’s evolving. ➡️CRYPTO ROAST

💵Thomson Reuters heiress loses $80M following psychic advice 🟠Billionaire heiress Taylor Thomson, from the family behind media giant Thomson Reuters, handed over her crypto portfolio to her best friend Ashley Richardson — a move influenced by a celebrity psychic and other spiritual “advisers.” 🟠At the peak of the 2021 bull run, Richardson was managing over $140M in crypto across multiple wallets. But when the market crashed in 2022, the portfolio collapsed. Consulting firm Guidepost Solutions estimates the losses exceeded $80M, with Richardson executing more than 450,000 trades — all without a written contract, only oral agreements. 🟠One of the biggest pitfalls was a $40M bet on Persistence (XPRT). The token once traded at $16.59 but now sits at $0.037 — a brutal –99% drawdown. Thomson claims Richardson secretly arranged a “finder’s fee” for pushing her into the deal. 🟠In 2023, Thomson filed a lawsuit against Richardson and Persistence, seeking $25M for alleged misrepresentation and hidden kickbacks. While the case with the project was settled, the legal battle with her ex-friend continues. Richardson fired back with a $10M countersuit for defamation, claiming she only acted on Thomson’s instructions. ✨ Takeaway: even billionaires fall prey to magical thinking. Whether it’s psychics, “insider” Telegram signals, or so-called market gurus — in crypto, trusting vibes instead of due diligence can cost a fortune. ➡️CRYPTO ROAST

🅰️ From Tether to gold bars — $50M scam unraveled in Thailand 🟠Thai police just arrested a 33-year-old South Korean man at Bangkok airport, accused of being the crypto-to-gold laundromat for a massive call center scam. 🟠The scheme promised “30–50% returns” to victims. Early payouts built confidence, but once deposits scaled up, withdrawals were blocked under fake “requirements.” 🟠Between Jan–Mar 2024, Han allegedly ran wallets that processed $47.3M USDT into gold — each round converting 10kg+ bars worth $1M a pop. 🟠The gold was bought overseas and funneled straight back to the syndicate. 10 arrests are already tied to the operation, including launderers and mule account holders. 🟠Han denies some charges, but police seized his phone packed with crypto accounts linked to the ring. 🟠This case nails a bigger truth: money laundering isn’t just on-chain. Criminals don’t care if it’s Tornado Cash, fake “investment” platforms, or gold shipments — the cycle is always the same: trust bait → deposits → lock withdrawals → off-chain exit. ⭐️ Moral? Every scam eventually cashes out somewhere tangible. In this one, the blockchain didn’t end with a mixer — it ended with gold bars. ➡️CRYPTO ROAST

⚡️ UPD: Andrew Tate decided to fight Kanye on-chain — and lost 🟠A wallet tied to Tate opened a 3x short on \$YZY at \$0.85 via Hyperliquid. Result? –\$16K on that trade and nearly –\$700K in cumulative perp losses. His win rate is just 36%. 🟠Meanwhile, the top 13 wallets on YZY already dumped \$24.5M in profit while price tanked 74% from peak. Classic memecoin exit liquidity play. 🟠Funny twist: most Tate-backed memecoins (from DADDY to ROOST) nuked –99% after launch, riddled with insider allocations. Now he’s the one on the losing side of the grift. 🤡 Lesson here? Even self-proclaimed “Top G” can’t outplay Solana shitcoinomics. Kanye’s circus isn’t about trading skill — it’s about timing the madness. 📱 Token Report (X) — your daily pulse on crypto and global markets

🤘 Kanye just pulled another classic — turning pure hype into billions. 🟠Late at night, Ye dropped his YZY contract on X. Within 40 minutes, the market cap shot to \$3B. Exchanges weren’t even done indexing, and early degens had already printed a 3x. 🟠On paper, it all looks slick: Ye Pay, YZY Card, fintech dreams. The contract even has Jupiter Lock, proper vesting, and sniper-bot protection. Feels “legit.” 🟠But here’s the punchline: 87% of tokens sit in a single wallet. That’s not “if rug,” that’s “when rug.” This isn’t DeFi — it’s performance art. 🟠Kanye’s always lived on the edge — first with music, then politics, and now shitcoins. The twist? Crypto might be the only arena where his madness actually works. 🎭 Moral of the story: this circus only has two roles — clowns and spectators. If you ape into YZY, better decide which one you are. 📱 Token Report (X) — your daily pulse on crypto and global markets

☠️ Fake CAPTCHA Scam Is Stealing Your Crypto 🟠Forget about phishing emails and malicious links. Hackers are now using fake CAPTCHAs to trick you into downloading the Lumma Stealer virus. 🟠The scheme is simple: a CAPTCHA appears, followed by a "network error" message that tells you to copy and paste a command. And just like that, your computer is infected. 🟠A DNSFilter study showed that 17% of people who encountered this scam followed the instructions and tried to install the malware. 🟠What's worse, hackers have learned to launder stolen funds in just three minutes, leaving victims with virtually no chance of getting their assets back. 🔥 Next time you're asked to copy and paste a command, remember: that's not how you prove you're human. That's how you prove you just got scammed. 📱 Token Report (X) — your daily pulse on crypto and global markets

🅰️UPD: AI-Powered Miners Are Coming For Dogecoin 🟠The crypto community is in shock: the AI-project Qubic successfully executed a 51% attack on the Monero network. 🟠Now, Qubic, having gained control of Monero’s hashrate, has chosen a new target. And according to a community vote, the winner is... Dogecoin. 🟠Dogecoin, which has a market cap of over $35 billion, received over 300 votes—more than all the other projects combined. 🟠After the attack on Monero, the Kraken exchange temporarily paused XMR deposits, citing a “potential risk to network integrity.” 😃 This situation shows that even major PoW blockchains can be vulnerable. It seems AI is getting smarter, but are the blockchains ready for it? ➡️CRYPTO ROAST

⭐️ Crypto Influencer Sentenced to a Year for Cryptojacking Scam 🟠Charles O. Parks III, known as “CP3O,” got a one-year prison sentence after mining $1 million worth of Ether using someone else's computing power. 🟠What did he do? He pretended to be a businessman building a “training company” to get access to two cloud service providers. Once in, he quietly mined crypto while racking up $3.5 million in bills. 🟠And while the providers were expecting him to teach students, this so-called "innovator" was busy mining on their dime. When they started asking questions about the suspicious data usage, he just dodged their inquiries. 🟠He didn't stop there. He laundered the stolen crypto to fund a luxury lifestyle, buying a Mercedes-Benz, jewelry, and other high-end items. 🤝 In the end, the court ordered him to pay back $500,000 and forfeit the Mercedes. Turns out his "genius" was just plain old fraud. So much for that "MultiMillionaire Mentality." ➡️CRYPTO ROAST

⚡️ The $51M Radiant Capital Hacker Just Doubled His Profit 🟠Almost a year after draining $51M from Radiant Capital, the hacker just proved he’s not only a skilled exploiter but also a patient market player. 🟠On October 16, 2024, he compromised Radiant’s multisig by extracting private keys from 3 out of 11 signers. That gave him the power to upgrade contracts on Arbitrum and BNB Chain, redirecting assets straight into his wallets. The stolen funds were quickly converted into ETH. 🟠Instead of cashing out immediately, he let the ETH sit. Ten months later, he’s doubled his take — already selling a chunk for $44M. 🟠The takeaway? He’s both a hacker and, unfortunately, a disciplined investor. But let’s be clear — what he did was theft, and nothing changes the fact that this was a $51M crime. 👉 In crypto, time can turn even stolen coins into a fortune — and that’s a brutal reminder of why security lapses cost way more than they seem on day one. ➡️CRYPTO ROAST