Avoid your next
big mistake

XDC Network is an enterprise-grade, EVM-compatible Layer-1 blockchain co-founded in 2017 by Atul Khekade and Ritesh Kakkad through XinFin, focused on trade finance, payments, and RWA tokenization. The mainnet has been operational since 2019 with 801M+ transactions processed and 178K+ smart contracts deployed. XDC 2.0 upgrade (Q4 2024) introduced Byzantine fault tolerance security. ISO 20022-aligned for institutional interoperability. Co-founders operate a $125M XVC Tech investment fund. No major security incidents or regulatory actions found. Limited independent media coverage and relatively low public scrutiny for its market cap.

On April 3, 2026, the frontend domain hypurr.fi of HypurrFi — a DeFi lending protocol on Hyperliquid EVM — was hijacked via a social engineering attack targeting the domain registrar Openprovider. No user funds were confirmed drained and the protocol's smart contracts remained intact throughout; the team migrated frontend operations to hypurrfi.com and subsequently recovered control of the original domain. The incident is part of a documented six-week cluster of DeFi registrar-level frontend attacks in March–April 2026 targeting Neutrl, HypurrFi, and CoW Swap.

Arbitrum is an Ethereum Layer-2 optimistic rollup developed by Offchain Labs, co-founded in 2018 by Princeton academics Steven Goldfeder, Ed Felten (former U.S. Deputy Chief Technology Officer), and Harry Kalodner. It is the largest Layer-2 by total value locked and has achieved L2BEAT Stage 1 decentralization through its BoLD permissionless validation protocol launched in early 2025. The protocol has faced significant governance controversies since its March 2023 ARB token launch, including the AIP-1 pre-ratification scandal, a Gaming Catalyst Program funding dispute, vote-buying incidents, and a high-profile April 2026 Security Council emergency freeze of $71M in ETH linked to North Korean hackers that reignited centralization debates.

RaveDAO is a Web3 entertainment protocol that markets itself as a community bridging electronic dance music culture with blockchain-based ticketing, governance, and event access. Its native token, RAVE, launched on Binance Alpha in December 2025 and experienced a ~10,800% price surge in April 2026 before collapsing approximately 95% within 48 hours amid substantial on-chain evidence of insider supply control and an alleged coordinated 'bait and liquidate' short-squeeze scheme. Binance, Bitget, and Gate.io opened formal investigations; on-chain investigator ZachXBT publicly accused the project's affiliated insiders of engineering the rally and named RAVE as part of a broader pattern of Bitget-enabled market-maker fraud.

Epicentral Labs is an early-stage decentralized autonomous organization (DAO) and LLC incorporated in the US and Canada, building a decentralized options trading platform called OPX on the Solana blockchain. The project is led by a pseudonymous founder known as TheLazySol and governed by holders of its native LABS token, which carries a micro-cap market capitalization of approximately $177,000-$185,000 as of mid-2026. No fraud allegations, regulatory actions, or known exploits have been identified; primary risks relate to the project's pre-mainnet status, lack of a public smart contract audit, small community size, and significant token concentration concerns.

Gamma Strategies is a non-custodial, automated concentrated liquidity management protocol operating across multiple EVM chains, allowing users to deposit assets into managed vaults (Hypervisors) that actively rebalance Uniswap V3 and similar DEX positions. On January 4, 2024, the protocol suffered a price manipulation exploit across four vaults resulting in approximately $3.4–6.2 million in losses, caused by misconfigured price change thresholds in deposit proxy settings. The protocol paused deposits, engaged OpenZeppelin for a remediation audit, and committed to a long-term user compensation plan funded by protocol revenue, though full recovery of lost funds was not guaranteed at launch of that plan.

On November 22, 2023, the HECO Chain cross-chain bridge and the HTX exchange (formerly Huobi), both linked to entrepreneur Justin Sun, were simultaneously exploited in what security researchers attributed to a private key compromise. The HECO bridge lost approximately $87 million in various tokens; additional HTX hot wallet losses brought confirmed totals to roughly $113 million. Blockchain analytics firm Elliptic subsequently attributed the attack to North Korea's Lazarus Group, which began laundering funds through Tornado Cash in March 2024.

Yelo, known online as @yelotree, is a crypto key opinion leader (KOL) and former professional Fortnite esports player with approximately 180,000 Twitter followers who also operated a luxury car rental business in Miami. As of May 2026, Yelo faces federal criminal charges alleging he laundered funds stolen from cryptocurrency holders through that rental business, with a potential sentence of up to 30 years. Separately, Yelo participated in undisclosed paid promotion of the Sharpei memecoin on Solana in October 2024, which subsequently suffered a documented rug pull that erased 96% of its market value.

Goliath Ventures Inc. was an Orlando, Florida-based cryptocurrency investment firm that, according to U.S. federal prosecutors, operated a Ponzi scheme from January 2023 through January 2026, raising at least $328 million from more than 2,000 investors through false promises of guaranteed monthly returns via cryptocurrency liquidity pools. Its founder and CEO, Christopher Alexander Delgado, was arrested on February 24, 2026 on federal wire fraud and money laundering charges; the company subsequently filed for Chapter 11 bankruptcy and is the subject of multiple civil class-action lawsuits against Delgado, its banking institutions, and its outside law firm.

AKT is the native utility token of Akash Network, a decentralized cloud computing marketplace built on the Cosmos SDK and founded in 2015 by Greg Osuri and Adam Bozanich under Overclock Labs. The project operates as a legitimate, open-source DePIN (Decentralized Physical Infrastructure Network) with public governance, audited code, and institutional partnerships including an indirect connection to NVIDIA through the Brev.dev acquisition. No regulatory actions, fraud allegations, or major exploits have been identified, though a responsibly disclosed critical vulnerability was patched in May 2024 and a spam attack disrupted the network briefly in March 2025.

Granary Finance was a decentralized, non-custodial lending and borrowing protocol forked from Aave V2, built by Byte Masons and an anonymous developer known as Fantom Menace, launching on Fantom in March 2022 before expanding to eight chains. The protocol raised over $5 million USDC via a community liquidity generation event in March 2023 and introduced the GRAIN governance token, but its TVL collapsed from a peak of approximately $60 million to under $200,000. By early 2025, the team announced the full withdrawal and discontinuation of Granary Finance across all chains, with GRAIN and OATH token holders migrated to the successor platform Cod3x (CDX). No regulatory actions, rug-pull allegations, or direct hacks of Granary contracts were documented; key risks include near-total value decline, deeply pseudonymous founding team, and protocol end-of-life.

CATFI is a Solana-based memecoin launched in early 2025 via the Pump.fun launchpad. South Korean prosecutors charged five individuals, including a ringleader known online as 'Eth Father' (surname Park), with orchestrating a rug pull that inflated the token's price approximately 1,001-fold within 26 hours before draining liquidity and abandoning the project. This case represents South Korea's first criminal prosecution of a decentralized-exchange rug pull under the Virtual Asset User Protection Act.

Inertia Protocol (INRT) is a modular liquid restaking token (LRT) and lending protocol built on the Initia blockchain, launched to mainnet in April 2025. The protocol suffered a confirmed exploit in May 2025 in which approximately $152,000 was drained from five lending markets via a known ERC4626 share-price inflation attack; the protocol states its Insurance Fund restored affected user balances. Team composition, smart contract audit history, and investor backing are not publicly disclosed.

Polygon (formerly Matic Network) is a Layer 2 scaling solution for Ethereum, originally founded in 2017 by Jaynti Kanani, Sandeep Nailwal, and Anurag Arjun. The project rebranded from Matic Network to Polygon in February 2021 and has grown into one of the most widely used Ethereum scaling platforms, though it has faced regulatory scrutiny from the SEC, allegations of token misallocation by on-chain analytics firm ChainArgos, and a significant undisclosed security vulnerability patched in 2021. The network's native token migrated from MATIC to POL in September 2024 as part of a broader Polygon 2.0 roadmap.

Ionic Money is a decentralized money market protocol operating on Mode Network (an OP Superchain L2), rebranded from Midas Capital after two exploits on that predecessor protocol in 2023. In February 2025, Ionic Money suffered a social engineering attack in which attackers impersonating the Lombard Finance team convinced the protocol to list a counterfeit LBTC token as collateral, resulting in approximately $8.6–8.8 million in losses. The protocol and its affiliated ecosystem protocols on Mode Network absorbed significant bad debt, with no confirmed user compensation as of mid-2025.

Kannagi Finance was a decentralized yield aggregator launched on zkSync Era in June 2023. On July 29, 2023, its anonymous team executed an exit scam, draining approximately $2.13 million in user deposits and deleting all online presence. The incident is considered the first major rug pull on the zkSync Era network, with at least $1.1 million subsequently routed through the Tornado Cash mixer.

Uniblock is a Canadian Web3 infrastructure company founded in 2022 that provides a unified, multi-chain API aggregation platform for blockchain developers, connecting over 300 blockchains and 55 data providers through a single interface with patented auto-routing technology. The company is venture-backed with C$7.5 million in total funding from institutional investors including SBI Ven Capital, AllianceDAO, NGC Ventures, Alchemy, and MoonPay. No regulatory actions, fraud allegations, or significant security incidents have been identified; risk factors are principally commercial and operational rather than conduct-related.

LCX Exchange (Liechtenstein Cryptoassets Exchange) is a regulated crypto trading platform incorporated in Liechtenstein and registered with the country's Financial Market Authority (FMA). On January 8, 2022, the exchange suffered a hot wallet compromise resulting in the theft of approximately $6.8–7.94 million in various cryptocurrencies; LCX subsequently covered all user losses from company funds and cooperated with multi-jurisdictional law enforcement, ultimately freezing approximately 60% of stolen assets. As of 2024–2025, LCX remains operational, holds multiple licenses under the Liechtenstein Blockchain Act (TVTG), and has filed a pre-application for a pan-European MiCA license.

Lodestar Finance is an Arbitrum-based decentralized money market protocol that enables lending, borrowing, and leveraged trading against crypto collateral. On December 10, 2022, the protocol suffered a flash loan exploit in which an attacker manipulated the price oracle for the plvGLP collateral token, draining approximately $6.9 million from depositors. The protocol subsequently relaunched in April 2023 with a V2 update, partially compensating victims with recovered GLP assets and esLODE tokens, though the attacker was never identified and no confirmed negotiated return of funds occurred.

Odin.fun is a Bitcoin-native memecoin launchpad built on the Runes protocol, using the Internet Computer (ICP) blockchain as a settlement layer for fast, low-cost trading. The platform launched in early 2025 and attracted backing from the Taproot Wizards Ordinals project, but has suffered at least two confirmed security exploits — a $178,000 authentication vulnerability in April 2025 and a $7 million liquidity manipulation attack in August 2025 — with the latter draining user funds that the team has acknowledged it cannot fully repay from its own treasury.

Orion Protocol is a decentralized liquidity aggregator that connects centralized and decentralized exchanges into a single non-custodial trading interface, launched in 2020 with its native ORN token. On February 2, 2023, the protocol suffered a reentrancy exploit that drained approximately $3 million across its Ethereum and Binance Smart Chain deployments through a malicious fake-token attack against an unaudited exchange contract. The protocol subsequently rebranded to Lumia in late 2024, migrating all ORN tokens to LUMIA at a 1:1 ratio.

Exponent Finance is a Solana-based yield tokenization protocol launched in late 2024 that enables users to separate yield-bearing assets into tradable Principal Tokens (PT) and Yield Tokens (YT), analogous to Pendle Finance on Ethereum. The protocol has attracted $7.1 million in venture funding from institutional backers including Multicoin Capital, Solana Ventures, and RockawayX, and processed over $2 billion in yield volume across 35,000+ users. Key risk considerations include a small but growing team, a SAFE-plus-token-warrant capital structure suggesting a future token launch, TVL that experienced a sharp 60%+ drawdown tied to incentive expiry, and an audit history that is active but still maturing.

Fuse Wallet is a Solana-based smart wallet developed by Squads Labs, the team behind Squads Protocol, Solana's leading multisig and smart account infrastructure. Launched in public TestFlight in June 2024 and on the Apple App Store in December 2025, Fuse replaces traditional seed phrases with a multi-factor authentication model built on Squads Protocol's audited smart account standard. Squads Labs has raised approximately $40.9 million across multiple funding rounds from institutional investors including Electric Capital, Coinbase Ventures, and Multicoin Capital, and no known regulatory actions, hacks, or fraud allegations have been identified against the product.

Penpie is a yield optimizer and vote-escrowed liquidity layer built on top of Pendle Finance, developed by the Magpie XYZ team. On September 3, 2024, the protocol was exploited for approximately $27 million through a reentrancy vulnerability in its batch reward harvesting function, compounded by a permissionlessly registered fake Pendle market. The attacker laundered substantially all stolen funds through Tornado Cash within days, rejecting a negotiated bounty offer from the Penpie team.

Pike Finance is a natively cross-chain lending protocol built on Wormhole's messaging layer and Circle's Cross-Chain Transfer Protocol (CCTP), which launched its beta mainnet in early 2024. Within days of launch, the protocol suffered two separate exploits on April 26 and April 30, 2024, draining approximately $299K and $1.68M respectively for a combined loss of roughly $1.98M. The first exploit stemmed from an improperly validated CCTP integration; the second arose from a storage layout corruption introduced during the emergency patch, allowing attackers to reinitialize and take over spoke contracts.

Rathnakishore Giri, also known as 'Ravi' Giri, is a 31-year-old Ohio investment manager convicted of wire fraud for orchestrating a Bitcoin-derivatives Ponzi scheme that raised over $10 million from at least 150 investors between 2019 and 2022. Operating through two entities — NBD Eidetic Capital, LLC and SR Private Equity, LLC — he falsely promised guaranteed, risk-free returns while using new investor funds to repay earlier ones and diverting proceeds to fund a lavish personal lifestyle. On May 18, 2026, he was sentenced to nine years in federal prison after an aggravating factor emerged: following his October 2024 guilty plea, and while on pretrial release, he continued soliciting new cryptocurrency investors, causing additional harm and prompting an amended plea agreement.

Superfortune AI is an AI-powered InfoFi platform on BNB Chain, incubated by Manta Labs, that combines Chinese metaphysical traditions with crypto market analytics. Its native token GUA launched on November 27, 2025. On May 27, 2026, approximately 14.98 million GUA tokens intended for an airdrop distribution were redirected to a lookalike attacker-controlled address, resulting in losses of approximately $15.18 million and a roughly 76% token price crash within 24 hours. The root cause remains disputed: the team attributed the incident to a compromised signer private key, while the absence of prior on-chain interaction between the attacker and project wallets has raised unresolved questions about the multisig workflow.

Ramzinex (legal name: Mubadala Ramzinex; also registered as Ramzineh Electronic Commerce Innovation Company) is an Iranian cryptocurrency exchange founded in 2018 and headquartered in Tehran. On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Ramzinex under Executive Order 13902, citing facilitation of transactions linked to the Islamic Revolutionary Guard Corps (IRGC), a government-backed Iranian financial institution, and sanctions evasion. The designation was part of the Trump administration's broader 'Economic Fury' campaign, which simultaneously sanctioned three other major Iranian exchanges: Nobitex, Wallex, and Bitpin.

Bitpin (legal name: Nooyan Bitpin, also known as Sana Ayman Mubadala) is an Iranian cryptocurrency exchange founded in 2020 and headquartered in the Anzali Free Zone, Gilan, Iran. On June 2, 2026, the U.S. Treasury's Office of Foreign Assets Control (OFAC) designated Bitpin on the Specially Designated Nationals (SDN) list under Executive Orders 13224 and 13902, citing IRGC-linked transactions, sanctions evasion, and investors with alleged ties to circumventing U.S. restrictions. Bitpin accounted for approximately 10% of Iranian digital asset inflows in 2025 and processed an estimated USD 821 million in volume that year, making it Iran's third-largest exchange by that metric among the four simultaneously designated platforms.

DxSale is a decentralized token launchpad and liquidity-locking platform launched in August 2020, originally on Ethereum and later expanded to BNB Chain and other EVM networks. On May 28, 2026, a hidden backdoor in legacy BNB Chain liquidity locker contracts was exploited to drain approximately $7.3 million from more than 1,400 LP positions locked as far back as 2021. On-chain analysis identified a 269-day pre-exploit ownership transfer chain passing through approximately 80 wallets, with indicators strongly suggesting insider involvement by a current or former team member.

TesseraDAO is a BNB Chain project whose governance token TSR was the subject of a severe exploit on June 1, 2026, in which an attacker minted 99 million unauthorized TSR tokens and dumped them for approximately $2.5 million USDT, causing a 99% price collapse within hours. Stolen proceeds were bridged to Ethereum and laundered via Tornado Cash, with 1,285.5 ETH confirmed passed through the mixer. Security analysts noted that minting privileges were controlled exclusively by deployer-related addresses, raising questions about whether the incident constituted an external hack or an insider compromise.

Render Network (RENDER) is a decentralized GPU rendering network for AI and 3D graphics founded by Jules Urbach (OTOY CEO, 70+ patents). $30M raised in December 2021 from Multicoin Capital, Solana Foundation, and Alameda Research. Migrated from Ethereum to Solana in November 2023. No protocol-level exploits recorded. Key concerns include Alameda Research co-investment, OTOY's 5% perpetual fee and dual governance role, ~50% treasury/escrow token concentration, and 86% decline from ATH. OctaneX featured in Apple M4 keynote.

DRiP Haus (drip.haus) is a Solana-based digital collectibles distribution platform that uses compressed NFT technology to enable creators to deliver free or low-cost weekly drops to subscribers. Founded in late 2022 by Vibhu Norby, a named serial entrepreneur with a verifiable track record, the company raised $11.5 million across two funding rounds before being acquired by Jupiter, Solana's leading DeFi aggregator, in an all-cash deal announced April 2, 2025. No regulatory actions, fraud allegations, or significant security incidents have been identified; the primary risk factors are platform-level policy changes that reduced accessibility for collectors and the uncertainties inherent in post-acquisition integration.

Shunda Park was a large-scale cryptocurrency investment fraud compound operated in Min Let Pan, Myanmar (Burma), active from at least January 2025 until its seizure by the Karen National Liberation Army (KNU/KNLA) in November 2025. The compound ran pig-butchering scams targeting victims across 30 or more countries, using trafficked workers held under threat of violence. In April 2026, the U.S. Department of Justice charged two Chinese nationals — Huang Xingshan and Jiang Wen Jie — with wire fraud conspiracy for managing the compound, as part of a coordinated international enforcement action that resulted in 276 arrests, the dismantling of nine scam centers, and the restraint of over $701 million in cryptocurrency.

Nathan Fuller, a resident of Cypress, Texas, operated Privvy Investments LLC and its assumed business name Gateway Digital Investments as a fraudulent cryptocurrency investment scheme from at least October 2022 through mid-2024. Fuller raised approximately $12.3 million from roughly 150 investors by falsely claiming proprietary AI-powered trading bots would execute high-frequency crypto arbitrage and generate guaranteed returns of 40-100% within 21-45 days. The SEC filed a civil complaint against Fuller on May 28, 2026 in the U.S. District Court for the Southern District of Texas (Litigation Release No. 26558); Fuller had previously admitted in a September 2025 bankruptcy proceeding that Privvy Investments was a Ponzi scheme.

Adam Iza, also known as Ahmed Faiq and self-styled 'The Godfather,' is a 25-year-old California cryptocurrency entrepreneur who operated the trading platform Zort and pleaded guilty to multiple federal felonies across two jurisdictions. He admitted to a $37 million fraud against Meta Platforms, wire fraud, tax evasion, conspiracy to violate civil rights through an LASD deputy bribery scheme, and—in a separate Connecticut federal case—conspiracy to interfere with commerce by robbery in connection with a plot to kidnap a couple whose son had stolen $245 million in Bitcoin. Federal prosecutors are seeking a minimum of 14 years; sentencing in the Connecticut case is scheduled for August 12, 2026.

edgeX is a decentralized perpetual futures exchange incubated by Amber Group and launched on mainnet in August 2024, with its native EDGE token generating at Token Generation Event on March 31, 2026. On June 2, 2026, the EDGE token crashed approximately 77% in under 60 seconds, erasing over $220 million in market value; edgeX attributed the event to an unidentified external party, while on-chain investigator ZachXBT alleged that a small group of insiders controlled the majority of the 1 billion token supply through a thin-float structure. A self-commissioned investigation found no team misconduct, a conclusion ZachXBT publicly derided as self-serving, and the project subsequently faced scrutiny for declining to disclose market-maker agreements or insider token allocations.

Bitcoin (BTC) is the world's first decentralized cryptocurrency, introduced in a 2008 whitepaper by the pseudonymous Satoshi Nakamoto and launched in January 2009. As of May 2026, it is the largest cryptocurrency by market capitalization (~$1.6T), classified as a digital commodity by U.S. regulators, and backed by institutional infrastructure including 11 SEC-approved spot ETFs. Bitcoin's established protocol and regulatory clarity distinguish it from most crypto assets, though it carries material risks including market volatility, mining centralization, illicit-use association, and exchange counterparty exposure.

QuadrigaCX was Canada's largest cryptocurrency exchange, founded in 2013 by Gerald Cotten and Michael Patryn. Following CEO Gerald Cotten's reported death in India in December 2018, approximately C$215 million owed to over 76,000 customers became inaccessible. The Ontario Securities Commission concluded in June 2020 that Cotten had operated the exchange as a Ponzi scheme for years, committing fraud through fictitious trading accounts and misappropriating roughly C$169 million in customer funds.

Raft Protocol was an Ethereum-based over-collateralized stablecoin protocol that allowed users to mint R, a USD-pegged stablecoin, against liquid staking derivative (LSD) collateral such as stETH and cbETH. On November 10, 2023, an attacker exploited a precision rounding error in the protocol's share-token minting contract using a flash loan, minting approximately $6.7 million in unbacked R stablecoins and draining roughly $3.3 million worth of ETH from the protocol. In a notable twist, the attacker lost money on the exploit — a coding error in their own attack script sent 1,570 ETH (~$3.25 million) to a burn address, leaving them with a net loss of approximately 4 ETH after gas and flash loan costs.

Optimism is an Ethereum Layer 2 optimistic rollup network operated by OP Labs PBC, with ecosystem governance stewarded by the Optimism Foundation. Launched on mainnet in January 2021, it issues the OP governance token and anchors the Superchain — a shared framework that powers Base, Zora, Mode, and more than two dozen other OP Stack-based chains. The network has a credible technical pedigree and documented decentralization progress, but retains meaningful centralization in its sequencer and upgrade-key infrastructure, and has experienced several notable security incidents.

Clockwork was a Solana-based smart-contract automation protocol that allowed developers to schedule transactions and build event-driven on-chain programs without relying on centralized cloud infrastructure. Founded in 2021 as Cronos and rebranded in 2022, the project raised $4 million in seed funding from Multicoin Capital, Asymmetric, and Solana Ventures before its founder announced an orderly shutdown effective October 31, 2023, citing limited commercial upside. No fraud, security exploits, or regulatory actions have been identified; the shutdown is assessed as a voluntary wind-down of a legitimate infrastructure project.

Cega (cega.fi) was a decentralized exotic options and structured products protocol that operated from June 2022 through late 2024 on Solana, Ethereum, and Arbitrum. Founded by Arisa Toyosaki, a named former derivatives trader, and backed by Dragonfly Capital, Pantera Capital, and Coinbase Ventures, the protocol processed over $500 million in cumulative transaction volume without a reported user fund loss. In November 2024 Cega was acquired by an undisclosed party and wound down its public-facing product suite, urging remaining depositors to withdraw.

Raydium is an automated market maker (AMM) and decentralized exchange built on the Solana blockchain, launched in February 2021 and widely regarded as Solana's primary liquidity hub. On December 16, 2022, the protocol suffered a major security incident in which an attacker compromised an admin private key — suspected to be via a trojan on a team virtual machine — and drained approximately $4.4 million from eight constant product liquidity pools. Raydium responded with a patched program, a community-approved compensation plan funded by team-held RAY tokens, and has since migrated authority to a Squads multisig with hardware wallet and timelock protections.

Resolv Labs is a UAE-based DeFi startup that operates the Resolv Protocol, issuing the USR delta-neutral stablecoin backed by ETH collateral hedged with perpetual futures short positions. On March 22, 2026, an attacker compromised the protocol's off-chain signing infrastructure via stolen contractor credentials, minting approximately 80 million unbacked USR tokens and extracting roughly $25 million in ETH, causing USR to depeg by up to 97% within minutes. The protocol acknowledged effective insolvency in the immediate aftermath and has since initiated a tiered compensation plan while rebuilding infrastructure security.

Firedancer is an independent, high-performance Solana validator client developed by Jump Crypto (Jump Trading Group), written from scratch in C primarily by a team led by Chief Science Officer Dr. Kevin Bowers and founding engineer Ritchie Patel. Released under the Apache 2.0 open-source license, it aims to increase Solana's throughput toward one million transactions per second while improving network resilience through client diversity. As of May 2026, the client is live on Solana mainnet with roughly 20% of validators running it, though full rollout remains cautious pending completion of comprehensive third-party security audits. The project carries a notable backer-risk signal: Jump Crypto's parent subsidiary Tai Mo Shan settled SEC charges for $123 million in December 2024 over TerraUSD manipulation, and a separate CFTC investigation was reported in 2024 with no publicly disclosed outcome as of this writing.

Bitrefill is a Stockholm-based cryptocurrency e-commerce platform founded in 2014 that allows users to purchase digital gift cards, eSIMs, and mobile top-ups using Bitcoin and other cryptocurrencies across more than 100 countries. On March 1, 2026, Bitrefill suffered a significant cyberattack attributed to the North Korea-linked Lazarus Group (Bluenoroff subunit), in which attackers compromised an employee laptop, escalated access via legacy credentials, drained hot wallets, and exposed approximately 18,500 customer purchase records. Bitrefill stated it would cover all financial losses from operational capital and characterized this as the platform's first major security incident in over a decade of operation.

Lulo (lulo.fi), formerly known as Flexlend, is a Solana-based DeFi lending aggregator that automatically routes stablecoin deposits to the highest-yielding protocols on the network, including Kamino, Drift, Marginfi, Morpho, Maple, and Pendle. Founded in 2022 and formally launched in early 2024, the protocol has grown to over $86 million in TVL and surpassed $100 million in cumulative deposits, supported by five independent security audits and backing from Circle Ventures and Solana Ventures. The platform's primary risk profile is composability-layer exposure: deposits are routed across multiple third-party protocols, meaning a failure at any underlying venue could affect user funds, although Lulo's 'Protected' tier includes automated on-chain coverage for such events.

Roger Ver (born 1979, San Jose, California) is an entrepreneur and early Bitcoin investor nicknamed 'Bitcoin Jesus' for his prominent role evangelizing cryptocurrency beginning in 2011. He later became CEO and Executive Chairman of Bitcoin.com and a principal promoter of Bitcoin Cash (BCH) following the 2017 hard fork. In April 2024 he was arrested in Spain on a U.S. Department of Justice indictment charging mail fraud, tax evasion, and filing false tax returns related to approximately $48 million in allegedly concealed capital gains; in October 2025 he resolved the charges without prison time by entering a deferred prosecution agreement and paying $49.9 million.

Seneca Protocol is an omnichain CDP (collateralized debt position) protocol deployed on Ethereum mainnet and Arbitrum that allowed users to borrow a stablecoin (senUSD) against yield-bearing collateral assets. On February 28, 2024, a critical arbitrary external-call vulnerability in the protocol's Chamber contract was exploited, resulting in approximately $6.4 million in user funds being drained. Roughly 80% of stolen funds were returned after an on-chain negotiation, but a net loss of approximately $1.28 million remained, and evidence surfaced that the vulnerability had been reported to the team prior to launch.

Alephium is a Swiss-founded Proof-of-Work Layer-1 blockchain launched November 8, 2021, featuring sharded smart contracts and the Proof-of-Less-Work consensus mechanism. On May 29-30, 2026, its TokenBridge was exploited for approximately $815,000 in approximately seven minutes via an off-chain backend vulnerability that allowed forged guardian messages to authorize unauthorized transfers and the minting of 13.76 million unbacked wrapped ALPH tokens. The team took the bridge offline, burned the unauthorized tokens, and committed to full user compensation.

Unicoin, Inc. is a New York City-based cryptocurrency company that launched the Unicoin token in February 2022, promoting it as an asset-backed, dividend-paying digital asset tied to the Unicorn Hunters investment television series. On May 20, 2025, the U.S. Securities and Exchange Commission filed a civil fraud complaint against the company and three senior executives in the Southern District of New York, alleging they defrauded more than 5,000 investors through false claims that the token was backed by billions of dollars of real estate and pre-IPO equity interests when those assets were worth a fraction of the stated values. The case remains pending as of mid-2026, with Unicoin having filed a motion to dismiss in August 2025.

Aave V3 is the third major iteration of the Aave decentralized lending protocol, one of the largest in DeFi with over $14 billion in total value locked across 21 chains as of May 2026. The protocol's core smart contracts have not been directly exploited; however, in April 2026, a $292 million bridge exploit targeting integrated asset KelpDAO's rsETH generated significant bad debt on Aave V3 markets, an event flagged by on-chain investigator ZachXBT. The protocol demonstrated institutional resilience by coordinating a cross-industry recovery fund (DeFi United) that ultimately raised over $327 million, with full rsETH operations restored by May 25, 2026.

BCAP is the world's first tokenized venture capital fund interest, issued in April 2017 as a Regulation D security token. It represents a non-voting economic interest in Blockchain Capital's Fund III. The firm manages $2B+ AUM with portfolio companies including Coinbase, Kraken, and Circle. Key risks include a $6.3M SIM-swap attack on co-founder Bart Stephens, Brock Pierce founding controversy, Epstein/Coinbase periphery connections, and effectively zero secondary market liquidity despite the token wrapper. No SEC enforcement actions exist.

THORChain is a decentralized cross-chain liquidity protocol built on the Cosmos SDK that enables native asset swaps across major blockchains without wrapped tokens. The protocol has suffered at least six significant security incidents since 2021, including a May 15, 2026 exploit in which a malicious validator node exploited a GG20 threshold signature scheme vulnerability to drain approximately $10.7–10.8 million across nine chains. THORChain has also faced documented use by the North Korean Lazarus Group as a primary money laundering channel, a $200 million insolvency crisis in early 2025 requiring a debt-to-equity restructuring, and ongoing questions about its permissionless design and unwillingness to block illicit flows.

Canton Network (CC) is an enterprise-grade Layer-1 blockchain developed by Digital Asset Holdings, designed for tokenizing real-world assets with configurable privacy features and institutional-grade compliance. Ranked approximately #18 by market cap at roughly $5.9 billion as of May 2026, the network has attracted major institutional validators including DTCC, Goldman Sachs, Visa, and Euroclear, and its parent company Digital Asset is pursuing a reported $300 million fundraise at a $2 billion valuation led by a16z crypto. The network faces documented criticism from crypto-native observers over centralization trade-offs, data mutability departing from traditional blockchain immutability norms, and concentrated influence held by co-founder DRW Trading Group.

Uniswap is a decentralized exchange (DEX) protocol built on Ethereum, founded in November 2018 by Hayden Adams and operated commercially by Uniswap Labs. It is the largest DEX by trading volume globally, using an automated market maker (AMM) model. The protocol has faced significant regulatory scrutiny — including an SEC Wells notice in April 2024 (closed without action in February 2025), a CFTC settlement resulting in a $175,000 penalty in September 2024, and a multi-year scam-token class action dismissed with prejudice in March 2026 — while remaining operationally active and technologically mature through its v4 release.

SIR.trading (Synthetics Implemented Right) is an Ethereum-based DeFi protocol launched on February 20, 2025, offering leveraged trading without liquidation risk or volatility decay. On March 30, 2025, an attacker exploited a transient storage vulnerability in the protocol's Vault contract to drain the entire $355,000 TVL — one of the first documented real-world exploits targeting Ethereum's EIP-1153 transient storage feature introduced in the Dencun upgrade. The protocol subsequently relaunched after completing additional security audits, but no stolen funds were recovered.

On April 9, 2023, SushiSwap's RouteProcessor2 contract — deployed just one day earlier across 14 blockchain networks — was exploited due to a failure to validate user-supplied pool addresses, allowing an attacker to redirect token transfers from wallets that had approved the contract. Approximately $3.3 million (roughly 1,800 WETH) was drained, with a single high-profile victim (@0xsifu) accounting for the majority of losses. Whitehat security teams front-ran further exploitation and recovered over $750,000, while SushiSwap committed to making all affected users whole through a two-tier compensation process.

Quant Network (QNT) is a UK-incorporated enterprise blockchain interoperability platform built on proprietary Overledger technology. Founded by Gilbert Verdian, the company has verified partnerships with major UK banks (Barclays, HSBC, Lloyds, NatWest) through the UK Regulated Liability Network, and completed Project Rosalind with the Bank of England and BIS. No SEC enforcement actions exist. Key concerns include closed-source code limiting auditability, centralized governance, a pay-to-play developer licensing model, and some partnership announcements with limited verifiable follow-through.

Aerodrome Finance is a decentralized exchange (DEX) and automated market maker (AMM) launched on August 28, 2023 on Coinbase's Base Layer-2 network. It operates a ve(3,3) tokenomics model inherited from Velodrome Finance and has grown to become the dominant DEX on Base by total value locked and trading volume. The protocol has no history of smart contract exploits but suffered a significant DNS hijacking attack in November 2025 that resulted in approximately $700,000 to $1 million in user losses.

Dialect (dialect.to) is a Solana-focused smart messaging and infrastructure company best known for co-developing the Blinks (Blockchain Links) and Actions standard with the Solana Foundation, launched in June 2024. Founded in 2021 by Chris Osborn, a named founder with a verifiable academic and professional background, the company raised a $4.1M seed round in March 2022 led by Multicoin Capital and Jump Crypto. No regulatory actions, fraud allegations, or confirmed security incidents specific to Dialect have been documented; the principal risk surface is the Blinks protocol itself, which introduces phishing and malicious-endpoint attack vectors that Dialect attempts to mitigate through a public registry of verified actions.

Helius (helius.dev) is a Toronto-founded, Solana-focused developer infrastructure company offering RPC nodes, enhanced APIs, webhooks, data streaming, and validator services. Founded in June 2022 by former Coinbase and AWS engineers, the company has raised $34.85 million across three rounds led by Founders Fund, Haun Ventures, and Foundation Capital, and operates as a key infrastructure layer for the Solana ecosystem. No regulatory actions or security breaches have been identified against Helius; the main risk signals are minor service reliability incidents and unresolved workplace conduct allegations against its CEO.

The DAO was a decentralized autonomous organization launched on Ethereum in April 2016 that raised approximately $150 million in ETH — the largest crowdfund in history at the time. On June 17, 2016, an unknown attacker exploited a reentrancy vulnerability in its smart contract code, draining approximately 3.6 million ETH (roughly $60–70 million at the time). The incident led to a contentious Ethereum hard fork on July 20, 2016, splitting the chain into Ethereum (ETH) and Ethereum Classic (ETC), and triggered the SEC's 2017 finding that DAO tokens were unregistered securities.

Treasure DAO is an Arbitrum-based NFT gaming and metaverse ecosystem centered around the MAGIC token, founded in 2021 by John Patten and Karel Vuong. In March 2022, its NFT marketplace suffered a critical smart contract exploit in which attackers purchased approximately $1.4 million worth of NFTs at zero cost by passing a zero-quantity parameter to the buyItem() function, bypassing all payment validation. The project has since undergone significant restructuring, including the shutdown of its proprietary zkSync-based Treasure Chain in May 2025, mass layoffs, and a strategic pivot toward AI agent infrastructure.

Chainlink is a decentralized blockchain oracle network founded in 2017 by Sergey Nazarov and Steve Ellis, with Cornell University professor Ari Juels co-authoring the whitepaper. The protocol provides smart contracts with tamper-resistant access to off-chain data and computation, holding an estimated 69–70% share of the oracle market and enabling over $26 trillion in cumulative transaction value as of 2025. No regulatory actions have been filed against Chainlink or its parent entity, Chainlink Labs; the primary documented concerns center on token-supply centralization and a 2020 campaign by an anonymous entity publishing unverified fraud allegations that were subsequently discredited.

Voltage Finance (formerly FuseFi) is a decentralized finance protocol operating on the Fuse Network, offering token swapping, lending, liquidity farming, and cross-chain bridging via an automated market maker. The protocol has been the subject of two confirmed security exploits: a March 2022 reentrancy attack that drained approximately $4.67 million from its lending pools via a third-party partner (Ola Finance), and a March 2025 insider-related exploit of its Simple Staking pools resulting in approximately $322,000 in losses. No funds were recovered in either incident as of the time of this investigation.

Zoth Protocol is an Ethereum-based real-world asset (RWA) re-staking and tokenization platform founded in 2023 by Pritam Dutta and Koushik Bhargav. In March 2025 the protocol suffered two separate security incidents within three weeks: an initial $285,000 logic-flaw exploit on March 1 and a far more damaging $8.4 million deployer-key compromise on March 21 that enabled a malicious proxy contract upgrade. The protocol has since launched a user compensation program, engaged Crystal Blockchain BV for fund recovery, and announced a security overhaul backed by a $15 million strategic token commitment from Bolts Capital.

NEAR Protocol is a layer-1 proof-of-stake blockchain founded in 2017 by Illia Polosukhin and Alexander Skidanov, featuring a sharded architecture (Nightshade) and human-readable account names, with mainnet launching in April 2020. The project has raised over $540 million from notable investors including Andreessen Horowitz and Tiger Global, and has maintained an active development roadmap pivoting toward AI agent infrastructure. No direct fraud or regulatory enforcement actions have been identified against the protocol itself, though ecosystem-level exploits, centralization concerns, and investor overlap with collapsed entities such as FTX Ventures and Three Arrows Capital have been noted.

Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.

Marlon Ferro, 20, of Santa Ana, California, known online as 'GothFerrari,' was sentenced on May 6, 2026 to 78 months in federal prison for his role as a physical burglar in a multi-state cryptocurrency theft enterprise that stole over $263 million between October 2023 and March 2025. Ferro pleaded guilty on October 17, 2025 to one count of conspiracy to participate in a racketeer influenced and corrupt organization (RICO) and was ordered to pay $2.5 million in restitution and serve three years of supervised release.

Litecoin (LTC) is one of the oldest proof-of-work cryptocurrencies, created in October 2011 by former Google engineer Charlie Lee as a Bitcoin fork with faster block times and the Scrypt hashing algorithm. The protocol itself has a long operating history and has been formally classified as a digital commodity by U.S. regulators as of 2026. ZachXBT flagged Litecoin in connection with a January 2026 social engineering theft in which a single victim lost approximately $282 million in BTC and LTC — the largest individual crypto theft of that year — though the attack targeted a holder rather than representing any flaw in the Litecoin protocol or its development team.

Spark Protocol is a decentralized lending and capital allocation platform incubated within the MakerDAO (now Sky) ecosystem, built by the core contributor team Phoenix Labs. Launched on Ethereum in May 2023, it operates SparkLend (a money market), Spark Savings (sUSDS yield vault), and a cross-chain Spark Liquidity Layer, reaching over $8 billion in combined TVL by mid-2025. The protocol issued its SPK governance token via airdrop in June 2025 and has faced community criticism over geographic access restrictions, VPN blocking, centralization concerns inherited from Sky's governance structure, and post-airdrop token price volatility.

CATFI (CatFi) is a Solana-based memecoin launched in February 2025 on Pump.fun that became the subject of South Korea's first-ever criminal prosecution of a DEX-based rug pull. A group led by an individual identified by surname Park, operating under the influencer alias 'Eth Father,' allegedly pre-accumulated a dominant CATFI position, executed circular wash trades to inflate the price 1,001-fold within 26 hours, then drained all liquidity, causing 256 investors to lose approximately 900 million won (~$600,000). Five suspects were arrested on May 11, 2026, and formally indicted by the Seoul Southern District Prosecutors' Office on May 27, 2026, under South Korea's Virtual Asset User Protection Act.

Axiom Trading (axiom.trade) is a Y Combinator Winter 2025-backed Solana trading terminal that generated over $390 million in revenue since its January 2025 launch. In February 2026, blockchain investigator ZachXBT published a report alleging that senior business development employee Broox Bauer and associates systematically abused internal customer support tools to access private user wallet data and front-run customer trades for more than ten months, with alleged profits exceeding $400,000. Axiom removed access to the implicated tools and stated it was investigating, but no public disclosure of disciplinary or legal outcomes had been made as of June 2026.

Verus Protocol is an open-source, fair-launched blockchain protocol founded in May 2018 by developer Michael Toutonghi that offers a hybrid proof-of-work/proof-of-stake consensus, decentralized identity (VerusID), and Public Blockchains as a Service (PBaaS) infrastructure. On May 18, 2026, the Verus-Ethereum cross-chain bridge was exploited for approximately $11.58 million due to a validation gap in bridge logic that allowed an attacker to claim vastly more value on Ethereum than was deposited on the Verus side. The Verus team subsequently negotiated a partial recovery, with the attacker returning 4,052.4 ETH (approximately $8.5 million) in exchange for a 1,350 ETH bounty (~$2.8 million) and a commitment to halt investigations.

LayerZero is an omnichain messaging protocol developed by LayerZero Labs that enables cross-chain communication across 90+ blockchains. On April 18, 2026, a $292 million exploit of the KelpDAO rsETH bridge — the largest DeFi hack of 2026 — exposed a critical single-point-of-failure in the protocol's Decentralized Verifier Network (DVN) configuration, attributed by LayerZero to North Korea's TraderTraitor (Lazarus Group). LayerZero initially blamed KelpDAO for the configuration before reversing course in May 2026 and admitting fault, triggering a mass client exodus exceeding $1 billion in migrated assets.

Machine Hallucinations is a series of AI-generated NFT artworks created by Turkish-American media artist Refik Anadol, deployed on the Ethereum blockchain beginning in 2021. The project has generated over $30 million in total NFT sales across multiple collections auctioned through Sotheby's, Christie's, and secondary markets including OpenSea. The project is notable for its institutional legitimacy — MoMA acquired the related 'Unsupervised' work as its first NFT in its permanent collection — but has attracted criticism regarding conflicts of interest between museum endorsement and commercial NFT promotion.

Light Protocol is a Solana-native ZK compression infrastructure layer developed by Luminous Labs Lda, a Portugal-based company co-founded in 2021 by Swen Schäferjohann. The protocol reduces on-chain state storage costs by up to 99% using zero-knowledge proofs and has undergone multiple independent security audits including formal circuit verification. No fraud allegations, regulatory actions, or fund-loss incidents have been identified; primary risk signals are inherent ZK/smart-contract complexity, partially unaudited SDK tooling, and infrastructure scaling concerns raised by Solana node operators.

Jupiter Perps is a perpetual-futures decentralized exchange (DEX) built on Solana, operated by Jupiter Exchange, offering up to 250x leveraged trading on SOL, ETH, and wBTC against a shared liquidity pool called JLP (Jupiter Liquidity Pool). The protocol has grown to become the dominant perps venue on Solana with a JLP TVL that surpassed $2 billion in September 2025 and over $100 billion in cumulative trading volume as of 2024. The platform has undergone multiple independent smart contract audits with no critical exploits against its own contracts reported, though JLP token holdings in third-party vaults were implicated as stolen assets in the April 2026 Drift Protocol breach.

Claynosaurz is a Solana-native NFT collection and web3 animation studio launched in November 2022, comprising 10,222 animated 3D dinosaur characters. Founded by Montreal-based animation professionals with verifiable film industry credits, the project has delivered multiple product milestones including physical merchandise, a Solana Phone exclusive NFT drop, cross-chain expansion to Sui, and a forthcoming Gameloft mobile game. No fraud, rug pull, or regulatory actions have been identified; the primary risk factors relate to NFT market depreciation, complex multi-token ecosystem mechanics, and the inherent execution risk of an early-stage gaming and entertainment IP.

Kaspa is a proof-of-work cryptocurrency launched in November 2021 that implements the GHOSTDAG blockDAG protocol, developed from academic research by Yonatan Sompolinsky at the Hebrew University of Jerusalem. The project claims a fair launch with no premine, no ICO, and no venture capital allocation to insiders, though pre-launch R&D was funded by Polychain Capital through the now-dissolved DAGLabs entity. Kaspa has a credible technical foundation and transparent governance, but faces centralization concerns from institutional ASIC miners and carries unresolved questions about the erasure of early transaction history following a genesis reset in November 2021.

Ethereum (ETH) is the second-largest cryptocurrency by market capitalization (~$278 billion as of May 2026) and the leading smart-contract platform, hosting the majority of decentralized finance (DeFi) and NFT activity. The protocol has a documented history of governance controversy stemming from the 2016 DAO hack hard fork, ongoing centralization concerns around liquid staking and MEV infrastructure, and persistent smart-contract and phishing-based fraud targeting end users, though Ethereum itself has not been the subject of any regulatory enforcement action and its spot ETFs have received SEC approval.

The Solana address FQ1tyso61AH1tzodyJfSwmzsD3GToybbRNoZxUBz21p8 is the token mint for Dasha (ticker: VVAIFU), the native token of vvaifu.fun — a no-code AI agent launchpad on Solana launched via Pump.fun on October 19, 2024. The token reached an all-time high of approximately $0.21 in November 2024, driven by speculative hype around the AI agent narrative, but has since collapsed approximately 99.9% to under $0.0003 as of mid-2026. The team behind vvaifu.fun operates pseudonymously, no formal audits have been disclosed, and CoinMarketCap lists a CertiK security score of 3.5 out of 10.

Bitstamp is a Luxembourg-headquartered cryptocurrency exchange founded in 2011 by Nejc Kodric and Damijan Merlak, widely regarded as the world's longest-running active crypto exchange. It was acquired by Robinhood Markets for approximately $200 million in June 2025 and holds over 50 active licenses and registrations globally, including an EU MiCA CASP license and a MiFID MTF license. The exchange has maintained a strong regulatory compliance posture for most of its history, though it suffered a significant $5.3 million hack in 2015 and a 2025 French court found it civilly liable for a period of unregistered operation in France.

Juicebox is an Ethereum-based programmable treasury and crowdfunding protocol first launched in July 2021 by a pseudonymous developer known as Jango, enabling projects to raise ETH, issue contributor tokens, and manage on-chain treasuries without intermediaries. V3 is the third major iteration of the core contracts, deployed in September 2022, and subsequently patched through versions 3.1, 3.1.1, and 3.1.2 to address a series of high-severity and critical accounting vulnerabilities. A protocol logic exploit in April 2026 resulted in an alleged $52,000 loss via a borrowFrom spoof attack, and the platform's permissionless architecture has enabled misuse by bad actors operating fraudulent fundraising projects.

Rocket Pool is a decentralized, non-custodial Ethereum liquid staking protocol founded in 2016 by David Rugendyke and launched on mainnet in November 2021. It issues two tokens: rETH (a liquid staking derivative) and RPL (a governance and collateral token). As of mid-2026, the protocol holds approximately $924 million in total value locked, making it the second-largest decentralized Ethereum staking provider by TVL, behind Lido Finance.

The Alephium TokenBridge is a Wormhole-fork cross-chain bridge linking the Alephium blockchain to Ethereum and BNB Chain. On May 30, 2026, the bridge was exploited for approximately $815,000 in locked assets, and 13.76 million unbacked wrapped ALPH tokens were minted on Ethereum; the attack completed in roughly seven minutes. Alephium has taken the bridge offline, pledged user compensation, and executed a partial governance burn of fraudulently minted tokens, but the underlying root cause — described by the team as an off-chain backend vulnerability — remains disputed against earlier reports of direct guardian key compromise.

edgeX Exchange is a StarkEx-powered perpetual futures DEX incubated by Amber Group, which launched its EDGE token on March 31, 2026. On June 1, 2026, the EDGE token collapsed approximately 70–77% within hours, erasing over $220 million in market capitalization and triggering roughly $2.81 million in liquidations. The team attributed the crash to deliberate external market manipulation, while on-chain investigator ZachXBT publicly alleged insider supply control and demanded disclosure of market-maker agreements — allegations that remain publicly unanswered as of June 3, 2026.

Gnosis Pay is a self-custodial Visa debit card platform launched in 2023 that allows users to spend stablecoins such as EURe directly from Safe smart-contract wallets at over 80 million merchants globally. On June 1, 2026, an active exploit was discovered targeting a vulnerability in the Zodiac Delay Modifier v1.1.0 and Roles Modifier v2 modules used by Gnosis Pay, allowing attackers to bypass the platform's built-in three-minute transaction delay protection and drain funds from affected Safe wallets. Gnosis co-founder Martin Köppelmann committed to covering all user losses, and a phased service restoration with new card-linked Safe accounts was announced for affected users as of June 2, 2026.

Alexander Mashinsky is the founder and former CEO of Celsius Network, a cryptocurrency lending platform that collapsed in July 2022 after freezing approximately $4.7 billion in customer assets. In December 2024, Mashinsky pleaded guilty to commodities fraud and a scheme to manipulate the price of Celsius's CEL token; he was sentenced to 12 years in federal prison in May 2025. Regulatory actions were brought by the DOJ, SEC, CFTC, and FTC.

Amazon is a major e-commerce and technology company that has faced significant regulatory challenges and consumer protection issues. While not itself a scam, Amazon's scale has made it a frequent target for impersonation scams and has led to multiple regulatory actions including a $2.5 billion FTC settlement for deceptive Prime subscription practices.

Grass is a Solana-based decentralized physical infrastructure network (DePIN) developed by Wynd Labs that pays users GRASS tokens in exchange for contributing unused internet bandwidth, which is then sold to AI companies and research institutions for large-scale public web scraping. The project launched in June 2023, completed a $3.5M seed round and a subsequent $10M bridge round backed by Polychain Capital and Tribe Capital, and executed its first major token airdrop in October 2024. While the project reports meaningful revenue growth and legitimate enterprise customers, it operates in a legally grey area involving residential proxy networks, carries unanswered questions about code transparency, and its token has declined approximately 94% from its all-time high amid sustained unlock pressure.

Forsage was a smart-contract-based pyramid and Ponzi scheme launched in January 2020 that raised approximately $340 million from investors worldwide across the Ethereum, Tron, and Binance Smart Chain networks. Four founders — including Ukrainian national Olena Oblamska (known online as 'Lola Ferrari') and Russian national Vladimir Okhotnikov (known as 'Lado') — were indicted by the U.S. DOJ in February 2023 on conspiracy to commit wire fraud charges. As of May 2026, Oblamska has been extradited from Thailand and has pleaded not guilty, with a jury trial scheduled for July 14, 2026; the remaining three co-founders are believed to be at large.

SIGMA is a multi-chain Telegram trading bot operating at sigma.win that supports Ethereum, BSC, Base, Solana, Avalanche, and other networks. On May 11, 2026, a crypto trader known as Unihax0r suffered a private key compromise draining over $200,000 across Ethereum, Base, and BSC, with both affected wallets traceable exclusively to SIGMA's wallet generation infrastructure. SIGMA has published no post-mortem, security advisory, or public statement in response to the incident as of late May 2026.

Africrypt was a South African cryptocurrency investment platform founded in 2019 by brothers Raees and Ameer Cajee. In April 2021, the platform abruptly shut down following an alleged hack, after which the founders fled South Africa with investor funds. The case became one of the most prominent alleged cryptocurrency exit scams in African history, though the exact amount lost remains disputed.

Mad Lads is a Solana-based NFT collection launched in April 2023 by Coral, the development company behind Backpack wallet. Created by former Alameda Research and FTX employees Armani Ferrante and Tristan Yver, the project gained significant attention for its innovative mint process that used honeypot tactics to deter bots and for being the first major xNFT collection.

0G Labs (Zero Gravity Labs) is a Web3 AI infrastructure company building a modular, AI-first layer-1 blockchain and decentralized AI operating system, having raised $325 million across multiple funding rounds since March 2024. The project has faced a protocol-level smart contract exploit in December 2025 ($516K lost), a separate compromise of its official social media account in October 2025, and significant community criticism over alleged funding misrepresentation, undisclosed insider token allocations, and concerns that two co-founders departing from Conflux Network constituted a reputational 'soft rug' of that project. No regulatory actions have been identified as of May 2026.

Aave is a decentralized, non-custodial liquidity protocol built on Ethereum and multiple other blockchains, enabling users to supply assets to earn interest or borrow against overcollateralized positions. Founded in 2017 as ETHLend by Finnish lawyer Stani Kulechov, it rebranded to Aave in 2020 and grew into the largest DeFi lending platform by total value locked, reporting over $40 billion in net deposits as of early 2025. The protocol has faced notable security incidents, a multi-year SEC investigation that closed without enforcement in December 2025, ongoing governance tensions between token holders and Aave Labs, and significant indirect exposure to a $292 million exploit in April 2026 attributed to North Korea's Lazarus Group.

Amazon Web Services is a leading cloud computing platform that controls 38% of the cloud infrastructure market. While generally reliable and secure, AWS has experienced multiple significant outages and faces ongoing privacy lawsuits, though no major regulatory sanctions have been identified in recent searches.

Tesla, Inc. is a publicly traded electric vehicle and clean energy company led by CEO Elon Musk. While the company has achieved significant market success and technological advances, it faces ongoing regulatory scrutiny regarding securities disclosures, workplace safety allegations, and autonomous driving claims.

StablR is a Malta-based, MiCA-regulated stablecoin issuer holding an Electronic Money Institution license from the Malta Financial Services Authority (MFSA), backed by strategic investors including Tether and Kraken. On May 24, 2026, an attacker compromised a single private key on the issuer's 1-of-3 minting multisig, gaining full administrative control and minting approximately 8.35 million USDR and 4.5 million EURR (~$13.5 million face value in unbacked tokens). The attacker extracted an estimated $2.8 million net profit after selling into thin DEX liquidity, causing both stablecoins to depeg by more than 20%; StablR subsequently froze minting and redemption, acknowledged the breach caused a MiCA-mandated 1:1 reserve shortfall, and engaged law enforcement and external cybersecurity firms.

USD Coin (USDC) is a fiat-backed stablecoin issued by Circle Internet Group, pegged 1:1 to the US dollar and backed by cash and short-dated US Treasury instruments held in a regulated money market fund. First launched in September 2018 via the Centre Consortium (a joint venture with Coinbase), USDC is among the largest and most regulated stablecoins globally, with approximately $75.8 billion in circulation as of May 2026. The stablecoin has maintained a generally stable peg but experienced a significant temporary depeg to $0.87 in March 2023 following Circle's disclosure of $3.3 billion in deposits held at the failed Silicon Valley Bank.

Revert Lend is a decentralized lending protocol built by Revert Finance that allows Uniswap v3 liquidity providers to use their LP positions as collateral to borrow ERC-20 tokens. The protocol has experienced two confirmed security incidents: a 2023 exploit of the V3Utils contract resulting in approximately $30,000 in losses, and a January 2026 protocol logic exploit on Base chain resulting in approximately $50,000 in losses. The protocol has undergone multiple audits but the recurrence of exploits raises questions about smart contract security practices.

Álvaro Romillo Castillo, a Spanish cryptocurrency influencer operating publicly as 'CryptoSpain,' was arrested on November 6, 2025, by Spain's Civil Guard under Operation PONEI on charges of large-scale fraud, money laundering, and criminal organization in connection with the Madeira Invest Club (MIC), an alleged Ponzi scheme that authorities say defrauded over 3,000 investors of approximately €260 million (roughly $300 million USD) between early 2023 and September 2024. A Spanish National Court judge ordered Romillo held without bail citing flight risk, and the case has acquired a political dimension following revelations of an alleged undisclosed €100,000 cash transfer from Romillo to far-right MEP Luis 'Alvise' Pérez Fernández days before the June 2024 European elections. Romillo faces up to 18 years in prison if charges are classified as mass offenses.

Goliath Ventures (formerly Gen-Z Venture Firm) was an Orlando, Florida-based cryptocurrency investment company whose CEO, Christopher Alexander Delgado, was arrested on February 24, 2026 on federal wire fraud and money laundering charges. Federal prosecutors allege the firm operated as a Ponzi scheme from January 2023 through January 2026, raising at least $328 million from approximately 1,500 to 2,000 investors under false promises of 3–8% monthly returns from cryptocurrency liquidity pools, while actually placing only approximately $1.5 million into any crypto platform. The company filed for Chapter 11 bankruptcy on March 16, 2026, and subsequent civil litigation has named JPMorgan Chase, Bank of America, Coinbase, and the law firm Alston & Bird as alleged enablers.

Lucifer Drainer is a criminal drainer-as-a-service (DaaS) platform that industrializes cryptocurrency wallet theft through a structured affiliate model. Active since at least early 2025, it operates by providing affiliates with phishing kits, automated site-cloning tools, and commission-split infrastructure (operators retain 20% per successful drain) while affiliates supply phishing traffic. Despite Telegram bot bans in August 2025 and documentation domain suspension in November 2025, the operation migrated to IPFS and remained active as of May 2026, making it one of the most operationally resilient drainer platforms in the current threat landscape.

Base is an Ethereum Layer-2 optimistic rollup incubated and operated by Coinbase, built on the OP Stack and launched on mainnet on August 9, 2023. As of mid-2026 it is the largest Layer-2 by DeFi TVL, holding approximately $4.6 billion locked and processing millions of daily transactions. It carries legitimate structural risks — most notably a single Coinbase-operated sequencer and Coinbase's regulatory exposure as operator — that are partially offset by the April 2025 move to Stage 1 decentralization and the May 2026 Azul upgrade introducing a multiproof system.

Celestia is a modular blockchain network that provides a dedicated data availability (DA) and consensus layer for rollups and application-specific chains, using data availability sampling to allow light nodes to verify block data without downloading full blocks. Developed by Celestia Labs and launched on mainnet on October 31, 2023, the project raised $155 million from prominent venture capital firms including Bain Capital Crypto and Polychain Capital. The project has faced significant controversy over its tokenomics, alleged insider token selling, and a 95%+ decline in the TIA token from its June 2024 all-time high of approximately $20.91.

A fraudulent cryptocurrency presale operation, discovered by Malwarebytes on February 18, 2026, that deployed a custom AI chatbot impersonating Google's Gemini assistant to sell a non-existent token called 'Google Coin.' The site mimicked Google's visual identity, displayed fabricated endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and promised investors 7x returns through irreversible cryptocurrency payments. Google (Alphabet Inc.) has never issued a cryptocurrency; this operation was entirely fabricated and constitutes an AI-automated impersonation fraud with no legitimate entity behind it.

Lido Finance is the largest Ethereum liquid-staking protocol, launched in December 2020, enabling users to stake ETH and receive the liquid derivative token stETH without meeting the standard 32 ETH validator minimum. Governed by the Lido DAO via the LDO token, the protocol held approximately 24% of all staked ETH and roughly $19 billion in TVL as of early 2026. Lido carries no fraud or exit-scam history, but poses well-documented systemic centralization risk to Ethereum consensus, governance-concentration concerns among LDO token holders, and faces an active US federal securities lawsuit alleging that LDO is an unregistered security.

Veil Cash is a zero-knowledge privacy protocol deployed on Coinbase's Base L2 network, enabling anonymous ETH and USDC transfers via zk-SNARK proofs and a UTXO model. In February 2026 the protocol's legacy pools were exploited due to an incomplete Groth16 trusted-setup ceremony, resulting in 2.9 ETH being drained before funds were returned by the exploiter. The incident attracted industry attention because the same misconfiguration pattern was subsequently replicated in a larger $2.26 million exploit of FoomCash, raising broader questions about cryptographic setup hygiene across ZK DeFi protocols.

The SpaceX brand has been systematically exploited by unaffiliated third-party scammers to promote fraudulent cryptocurrency schemes since at least 2020. SpaceX (the aerospace company founded by Elon Musk) has no official cryptocurrency, token, or digital asset. Documented fraud typologies include fake token presales with rug pulls on Uniswap, fake crypto giveaway and doubling scams, AI deepfake livestreams on YouTube and social media, and wallet-draining airdrop phishing sites — collectively responsible for tens of millions of dollars in documented victim losses.

Aethir is a Singapore-based decentralized GPU cloud computing protocol operating as a Decentralized Physical Infrastructure Network (DePIN), founded in 2021 by Mark Rydon and Daniel Wang. The project raised approximately $109M across funding rounds and a $100M+ checker node sale, launched its ATH token in June 2024, and claims $147M+ ARR from enterprise AI and gaming clients. Risk factors include a 95% token price decline from its all-time high, a redirected Season 3 community airdrop, a cross-chain bridge exploit in April 2026 resulting in up to $400K in losses, heavy insider token allocation, and a ZachXBT flag whose specific basis has not been publicly detailed.

Crossmint is a New York-based web3 infrastructure company founded in 2022 by Alfonso Gómez-Jordana Mañas and Rodrigo Fernández Touza. It provides APIs and no-code tools for embedded wallets, NFT minting, stablecoin orchestration, and AI-agent payments, reporting over 40,000 enterprise and developer customers. The company raised $23.6 million in March 2025 led by Ribbit Capital, holds SOC 2 Type II certification, a VASP license, and received MiCA authorization in Spain in December 2025.

Thodex was a Turkish cryptocurrency exchange founded in 2017 (originally as Koineks) by Faruk Fatih Özer that collapsed in April 2021 when the platform abruptly halted trading and its founder fled to Albania, leaving approximately 391,000 users unable to access funds estimated at $2 billion to $2.6 billion. Özer was arrested in Albania in August 2022, extradited to Turkey in April 2023, convicted in September 2023 and sentenced to 11,196 years in prison alongside his two siblings, and died in a Turkish high-security prison on November 1, 2025, in circumstances that prompted a formal investigation.

BonkBot is a Solana-focused Telegram trading bot launched in 2023, affiliated with the BONK memecoin community but operated as a legally separate entity. It has grown to become one of the largest Telegram-based trading bots by volume, reporting over $14 billion in lifetime trades and more than 500,000 total users, with all 1% trading fees directed toward purchasing and burning BONK tokens. The platform operated in a custodial manner for most of its history before announcing a non-custodial key management system upgrade in October 2024; a March 2024 incident in which 302 users lost approximately $523,000 in SOL highlighted custody risks common to this class of product, though BonkBot attributed the losses to a compromise at a rival bot (Solareum) rather than its own infrastructure.

PGI Global (Praetorian Group International) was a fraudulent cryptocurrency and foreign exchange investment platform operated by Ramil Ventura Palafox from December 2019 through October 2021. The scheme raised over $201 million from more than 90,000 investors worldwide by promising daily returns of 0.5% to 3% through purported Bitcoin and forex trading, while in reality operating as a Ponzi scheme. Palafox pleaded guilty in September 2025 to federal wire fraud and money laundering charges and was sentenced in February 2026 to 20 years in prison. He did not immediately begin serving the sentence: according to the FBI, on April 6, 2026 Palafox removed his court-ordered GPS monitor and fled rather than report to prison, but was recaptured in Los Angeles approximately nine days later, on or about April 15, 2026, and was ordered detained pending transfer to federal prison. The SEC filed parallel civil charges in April 2025 over an alleged $198 million fraud.

Geoffrey Woo is an American entrepreneur and venture capitalist who co-founded Anti Fund with Jake Paul in 2021 and serves as chairman of Ketone-IQ. In February 2026, Woo launched an AI-themed memecoin called AntiHunter (ANTIHUNTER) on the Base blockchain and publicly claimed it carried '0% rug pull risk' because he was already wealthy. On-chain investigator ZachXBT challenged the claim, citing the Paul brothers' documented history of five failed crypto projects — all down 99%+ from peak — and identifying three alleged token sales by Woo's wallet that appeared to contradict his stated promise to pre-announce any insider transactions. As of June 2026, ANTIHUNTER trades approximately 99%+ below its February 2026 all-time high, consistent with ZachXBT's expectations.

On September 1, 2025, blockchain investigator ZachXBT published a leaked spreadsheet documenting over 200 crypto influencers (key opinion leaders, or KOLs) approached to promote a token campaign, with more than 160 confirmed to have accepted payments ranging from $50 to $60,000 per post via the Solana network. Of those 160+, fewer than five disclosed the promotional posts as paid advertisements — a compliance rate under 3% — in apparent violation of U.S. Federal Trade Commission Endorsement Guides and, where promoted assets qualify as securities, Section 17(b) of the Securities Act of 1933. The sponsoring project was later identified as AI memecoin platform Memenetic, which publicly acknowledged the payments.

Clipper is a decentralized exchange (DEX) built by Shipyard Software and governed by AdmiralDAO, designed to offer retail traders the lowest per-transaction costs on trades under $10,000 using a novel Formula Market Maker (FMM) mechanism. On December 1, 2024, a protocol logic exploit drained approximately $457,878 from its Optimism and Base liquidity pools by manipulating a single-asset deposit and withdrawal function; the attacker voluntarily returned 104 ETH in January 2025. While the protocol has legitimate venture backing and a documented technical architecture, the exploit revealed a gap between audited and deployed code, and the protocol has been flagged by on-chain investigator ZachXBT.

Dogecoin (DOGE) is a cryptocurrency created in December 2013 by Billy Markus and Jackson Palmer as a deliberate parody of Bitcoin. It has grown to a top-10 cryptocurrency by market cap (~$17B). While the protocol itself has no documented exploits, Dogecoin carries risks from Elon Musk's outsized price influence (an $258B class action was filed and dismissed), significant whale concentration (149 wallets hold ~108.5B DOGE), and documented illicit use including PlusToken seizures and darknet market acceptance.

Railgun is a zero-knowledge (ZK) privacy protocol deployed on Ethereum and multiple EVM-compatible chains that allows users to interact with DeFi applications privately. The protocol gained significant notoriety in January 2023 when the FBI alleged that North Korea's Lazarus Group used it to launder over $60 million stolen from the Harmony Horizon Bridge, though Railgun disputed these claims. The project distinguishes itself from sanctioned mixer Tornado Cash through a compliance feature called Private Proofs of Innocence, has received public endorsements from Ethereum co-founder Vitalik Buterin, and has accumulated over $4 billion in total transaction volume as of 2025.

Terraform Labs Pte. Ltd. was a Singapore-based blockchain company founded in 2018 by Do Kwon and Daniel Shin, best known for developing the Terra blockchain, the algorithmic stablecoin TerraUSD (UST), and the associated LUNA cryptocurrency. In May 2022, UST lost its dollar peg, triggering a collapse that wiped out approximately $40–45 billion in market capitalization within days. Following SEC civil fraud proceedings, a unanimous jury verdict in April 2024, and a $4.47 billion settlement, the company filed for Chapter 11 bankruptcy in January 2024 and received court approval to wind down operations in September 2024. Co-founder Do Kwon was sentenced to 15 years in federal prison in December 2025.

Michele Spagnuolo, 36, a Staff Information Security Engineer at Google Zürich known online as 'AlphaRaccoon,' was arrested in New York on May 27, 2026, and charged by federal prosecutors with commodities fraud, wire fraud, and money laundering. He is alleged to have accessed nonpublic internal Google search-trend data to place highly accurate prediction-market bets on Polymarket, generating approximately $1.2 million in profits on roughly $2.75 million wagered. The charges, filed simultaneously by the U.S. Attorney's Office for the Southern District of New York (SDNY) and the Commodity Futures Trading Commission (CFTC), represent the second high-profile federal insider-trading prosecution arising from Polymarket activity in 2026. All allegations are unproven; Spagnuolo has not entered a plea.

Kamino Finance is a Solana-based DeFi protocol that combines automated concentrated-liquidity vaults, a lending and borrowing market (K-Lend), and leveraged yield strategies. Launched in August 2022 as a spin-off from Hubble Protocol, it has grown to become the largest DeFi protocol by total value locked on Solana, with multi-billion-dollar deposits as of 2026. The protocol has maintained a zero-bad-debt record since launch, completed more than ten independent security audits, and operates a $1.5 million bug bounty program, though centralization risks around upgrade authority keys and token distribution remain publicly documented concerns.

bandcampro is a Russian-speaking threat actor who operated an 8-month AI-assisted crypto theft and influence campaign (September 2025–May 2026) via the Telegram channel @americanpatriotus, which had accumulated roughly 17,000 subscribers over a five-year run beginning February 2021. The actor distributed a trojanized self-custody wallet called StellarMonster that deployed the GoToResolve remote access tool, enabling seed phrase harvesting and full wallet compromise. A jailbroken Google Gemini instance and 73 stolen API keys automated content generation, credential attacks, and infrastructure management. The campaign was publicly exposed by Trend Micro researchers on or around May 22, 2026.

Polkadot (DOT) is a multi-chain protocol founded by Gavin Wood, ranked #41 by market cap (~$2.3B). The project faces significant headwinds: a $133M treasury overspending crisis (projected 2-year depletion), the 2017 Parity wallet freeze that locked ~$98M of ICO proceeds, an April 2026 Hyperbridge exploit minting $1B in fake bridged DOT (losses ~$2.5M), and steep ecosystem decline with active parachains dropping from 200+ to ~30. No SEC enforcement actions exist, and ETF applications are under review.

DeepSnitch AI is an Ethereum-based utility token project marketed as an AI-powered crypto scam-detection platform, operated by SignalPlex Lab Ltd., a company incorporated in the British Virgin Islands with no publicly disclosed team members. The project raised an alleged $2.87M in a multi-stage presale (figures across sources range from $2.2M to $2.87M and cannot be independently verified from a primary financial source) before listing on Uniswap on March 31, 2026, after which the token price collapsed approximately 99% within days, accompanied by widespread reports of presale buyers unable to claim tokens, a honeypot flag from security scanner Blockaid, and extended team silence. The team subsequently attributed the Blockaid flag to contract anti-dump mechanics misread as a honeypot, launched a V1 platform on April 10, 2026, and the contract flag was reportedly cleared; however, trading volume subsequently went dormant and no Tier 1 or Tier 2 source has independently verified any key claim.

In February 2026, Malwarebytes researcher Stefan Dasic documented a live fraudulent cryptocurrency presale site promoting a non-existent token called 'Google Coin.' The operation deployed a custom AI chatbot impersonating Google's Gemini assistant — using its sparkle icon, green 'Online' indicator, and name — to deliver scripted investment pitches, fabricated institutional endorsements from OpenAI, Binance, Coinbase, Squarespace, and SpaceX, and personalized return projections (e.g. $395 presale investment projected to become $2,755 at listing). Victims were directed to send irreversible cryptocurrency payments to six wallets spanning Bitcoin, Ethereum, Solana, TRON, and XRP Ledger. Google has never issued a cryptocurrency; the token, the chatbot persona, and all associated endorsements were entirely fabricated.

Orca is a concentrated-liquidity automated market maker (AMM) and decentralized exchange built on the Solana blockchain, launched in February 2021 by co-founders Grace "Ori" Kwan and Yutaro Mori. Its core product, Whirlpools, is an open-source CLMM protocol with six independent security audits, a verifiable on-chain build, and no confirmed exploits since inception. The protocol operates via a DAO governed by the ORCA token and has expanded to Eclipse mainnet; the primary documented risk factors are residual upgrade-authority centralization, the legacy Three Arrows Capital investor relationship (now defunct), and a 2023 decision to geo-block U.S. users from the web interface without a public regulatory explanation.

Elijah Armstrong (21), Nino Chindavanh (21), and Jayden Rucker (25), all from the Nashville, Tennessee area, were federally indicted on March 31, 2026 in the Northern District of California for a violent cryptocurrency robbery and kidnapping spree carried out across the San Francisco Bay Area and Los Angeles between November 22 and December 31, 2025. The three men allegedly posed as delivery workers to gain entry into victims' homes, then used firearms, duct tape, and zip ties to restrain and assault victims before forcing cryptocurrency transfers; in at least one documented incident, $6.5 million in digital assets was transferred at gunpoint. All three defendants remain in federal custody without bond.

LeadBlock's Morpho Blue Market refers to a permissionless lending market and associated MetaMorpho vault curated by LeadBlock Partners on the Morpho Blue protocol. On October 13, 2024, an oracle misconfiguration in the LeadBlock-curated PAXG/USDC market enabled an opportunistic user to borrow approximately $230,000 in USDC against only $350 of PAXG collateral, exploiting an overvalued asset price of $2.6 trillion per unit of gold. The incident was attributed to an incorrectly configured SCALE_FACTOR by LeadBlock's oracle provider and raised questions about the adequacy of pre-launch testing and risk curation practices.

BitClout was a blockchain-based social media platform launched in March 2021 by Nader Al-Naji, operating under the pseudonym 'Diamondhands', which later rebranded to the DeSo (Decentralized Social) blockchain. In July 2024, the SEC and DOJ charged Al-Naji with raising approximately $257 million through alleged unregistered securities sales and fraud, while allegedly concealing his identity and misusing at least $7 million of investor funds for personal expenses including a Beverly Hills mansion and cash gifts to family members. Both the DOJ criminal case (dismissed without prejudice, February 2025) and the SEC civil case (dismissed with prejudice, March 2026) were dropped with no penalties, fines, or admissions of guilt, though the documented fundraise scale and the SEC and DOJ allegations remain part of the public record.

Pokemon itself is a legitimate intellectual property owned by The Pokemon Company International, Nintendo, and Game Freak. However, the brand has been extensively exploited in various scam operations including fraudulent NFT projects, trading card fraud schemes, counterfeit merchandise sales, and cryptocurrency investment scams that have collectively resulted in millions of dollars in losses.

ElizaOS (formerly ai16z) is an open-source AI agent framework developed by Eliza Labs and launched on Solana in October 2024. The project reached a $2.6 billion token market cap in January 2025 before collapsing more than 99% amid allegations of unauthorized brand misappropriation from Andreessen Horowitz, disputed claims about the autonomy of its marketed AI agent, and a disputed token migration in late 2025 that critics alleged diluted retail holders. As of April 2026 a federal class action lawsuit (SDNY case 1:26-cv-3238) is pending against Eliza Labs, founder Shaw Walters, co-defendant Sebastian Quinn-Watson, and AI16Z DAO.

Helium Mobile is a Mobile Virtual Network Operator (MVNO) launched by Nova Labs, Inc. in 2023, marketed as the world's first crypto-powered consumer cellular service. It provides coverage primarily via T-Mobile's wholesale 5G network, supplemented by a community-built Wi-Fi hotspot layer, and issues MOBILE token rewards to subscribers and hotspot operators. Parent company Nova Labs settled a $200,000 SEC fraud charge in April 2025 over misrepresentations made to investors about enterprise partnerships, while the MOBILE token has been deprecated in favor of HNT under community governance proposal HIP 138.

Gemcoin was a fraudulent cryptocurrency launched in September 2014 by Steve Chen through his company US Fine Investment Arts (USFIA), operating out of Arcadia, California. The scheme falsely claimed that Gemcoin tokens were backed by billions of dollars in amber and gemstone mine holdings in the Dominican Republic, Argentina, Mexico, and the United States; those mines did not exist. The SEC filed fraud charges and obtained asset freezes in September 2015 when at least $32 million had been raised; a subsequent court-appointed receiver and DOJ criminal prosecution ultimately established total investor losses of approximately $147 million from around 70,000 victims, predominantly Chinese and Chinese-American investors. Steve Chen pleaded guilty in 2020 to conspiracy to commit wire fraud and tax evasion, was sentenced to ten years in federal prison in January 2021, and died in custody on November 19, 2022.

CLS Global FZC LLC (UAE) and ZM Quant Investment Ltd (British Virgin Islands) are crypto market-making firms charged in October 2024 as part of DOJ Operation Token Mirrors, an FBI undercover sting that created a fake token called NexFundAI to expose market-manipulation-as-a-service. Both firms are alleged to have generated billions of dollars in artificial trading volume through algorithmic wash trading on behalf of token promoters. CLS Global pleaded guilty to criminal charges in January 2025 and was sentenced to pay $428,059 in April 2025; parallel DOJ criminal proceedings against ZM Quant (case 1:24-cr-10187) remain on record as of June 2026. The SEC voluntarily dismissed its civil enforcement actions against both entities on March 31, 2026, reflecting a policy shift under the current administration, though those dismissals do not constitute a finding of innocence and do not affect the DOJ criminal proceedings.

Alameda Research was a cryptocurrency trading firm co-founded by Sam Bankman-Fried in 2017 that became central to one of the largest financial frauds in US history. The firm secretly used billions in [[ftx|FTX]] customer funds for trading and investments, leading to both companies filing for bankruptcy in November 2022.

The DPRK IT Worker Network is a state-directed, multi-year operation run by the North Korean government that places thousands of fraudulently credentialed software developers inside U.S. and global technology and crypto companies using stolen identities, fake personas, and U.S.-based facilitators. Workers generate hundreds of millions of dollars annually in illicit wages funneled back to Pyongyang to fund weapons of mass destruction and ballistic missile programs, and have escalated to data theft and extortion. The operation has drawn DOJ indictments of dozens of individuals across multiple enforcement waves (2024–2026), OFAC sanctions designating front companies and facilitators in China, Vietnam, Laos, Russia, and Spain, and FBI warnings to private industry.

Citrine Sleet (also tracked as AppleJeus, Gleaming Pisces, UNC4736, and Labyrinth Chollima) is a North Korean state-sponsored threat cluster attributed to Bureau 121 of the Reconnaissance General Bureau (RGB), active since at least 2018. The group specializes in financially motivated cyberattacks against cryptocurrency exchanges, DeFi protocols, and developer toolchains, deploying trojanized trading applications, supply chain compromises, and zero-day exploits to steal digital assets. Chainalysis estimates DPRK-linked actors have stolen at least $6.75 billion in cryptocurrency since 2016, with Citrine Sleet/UNC4736 operations accounting for multiple hundred-million-dollar individual incidents including the April 2026 Drift Protocol exploit ($285 million) and the October 2024 Radiant Capital breach ($50 million).

TraderTraitor (also tracked as UNC4899, Jade Sleet, Slow Pisces, and PUKCHONG) is a North Korean state-sponsored cyber threat cluster operating under the Reconnaissance General Bureau (RGB), formally designated by the FBI, CISA, and U.S. Treasury as responsible for stealing billions of dollars in cryptocurrency from blockchain companies, exchanges, and developers since at least 2020. The cluster is most prominently attributed to the February 2025 Bybit heist — the largest cryptocurrency theft in history at approximately $1.5 billion — as well as the May 2024 DMM Bitcoin theft ($308 million), the July 2023 JumpCloud supply chain attack, and the April 2022 Ronin Network compromise ($620 million). Chainalysis estimates North Korean actors, dominated by TraderTraitor operations, stole $2.02 billion in 2025 alone, pushing their all-time attributed total to approximately $6.75 billion since 2017.

Marinade Finance is a non-custodial liquid staking protocol on Solana, launched on mainnet August 2, 2021. It operates two primary products — mSOL (liquid staking) and Marinade Native (non-liquid delegation) — and as of mid-2025 held approximately 10–11 million SOL in total staked value, making it one of Solana's largest staking providers. The protocol is governed by MNDE token holders via an on-chain DAO and has compiled a clean auditing track record with no confirmed exploits as of the investigation date.

Korea Mangyongdae Computer Technology Company (KMCTC) is a North Korean state-linked IT firm sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on November 4, 2025, for operating overseas IT worker delegations in China and using Chinese nationals as banking proxies to launder proceeds from fraudulent employment and cybercrime schemes. The company is operated under the MAEI 607 Management Office, which connects it to the DPRK's military-industrial apparatus, and its IT workers are alleged to have generated hundreds of millions of dollars annually for the North Korean regime's weapons programs. KMCTC and its president, U Yong Su, are designated on the U.S. SDN list under Executive Order 13810.

Cheil Credit Bank, also known as First Credit Bank and formerly as Kyongyong Credit Bank, is a North Korean state-controlled financial institution headquartered in Pyongyang with representative offices in Beijing, Shenyang, and Shanghai. First designated by OFAC in September 2017 under Executive Order 13810 for operating in North Korea's financial services sector, the bank was dramatically re-expanded on November 4, 2025, when OFAC added 53 cryptocurrency addresses to its Specially Designated Nationals listing, linking it to over $12.7 million in USDT-TRC20 flows between June 2023 and May 2025 — funds attributed primarily to DPRK overseas IT workers and cybercrime proceeds destined for the regime's weapons programs.

Amnokgang Technology Development Company is a North Korean state-controlled IT firm established in 1982 and headquartered in Pyongyang. The U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned it on March 12, 2026, for managing overseas DPRK IT worker delegations that allegedly generated nearly $800 million in illicit revenue in 2024 to fund North Korea's weapons of mass destruction programs. Seven cryptocurrency addresses across Ethereum and Tron networks were designated, with TRM Labs reporting over $12 million in tracked on-chain transactions through those addresses.

Safe{Wallet}, operated by the Safe Ecosystem Foundation, is the dominant smart-contract multisig platform on Ethereum and EVM-compatible chains, securing approximately $35 billion in assets across 61 million accounts as of Q1 2026. In February 2025, a developer machine compromise by North Korea's Lazarus Group (TraderTraitor) allowed attackers to inject malicious JavaScript into the app.safe.global frontend, enabling the theft of approximately $1.5 billion in ETH from Bybit — the largest cryptocurrency heist in history. The Safe smart contracts themselves were not compromised; the attack was entirely at the infrastructure and frontend layer. Safe has since rebuilt its infrastructure and launched Safenet, a decentralized transaction-security network, as a structural response.

Krish Kumar is a Tulsa, Oklahoma college student who, between approximately January 2024 and February 2025, raised approximately $7.8 million across two self-managed crypto-focused investment funds — Future Fractal Investments LLC and Arcane Resonance Fund LLC. On March 26, 2026, the SEC filed settled civil charges (LR-26507, Case No. 4:26-cv-00184, N.D. Okla.) alleging Kumar misappropriated nearly $7 million: transferring more than $5.6 million of Future Fractal assets to personal accounts to buy 33,009 options on a Bitcoin mining company, losing approximately 98% in four trading days, then fabricating a cover-up including a photoshopped brokerage screenshot, before raising $1.8 million through a second fund and using $300,000 of that capital to pay off a prior investor in a Ponzi-like manner. Kumar consented to a bifurcated judgment with permanent injunctions; monetary remedies including disgorgement, civil penalties, and a five-year conduct bar remain pending as of June 2026.

Manu Singh, an Indian national age 34, was the Chief Executive Officer of Contrarian, a cryptocurrency market-making firm registered in the British Virgin Islands. On September 4, 2025, a federal grand jury in Oakland (N.D. Cal.) indicted Singh and three co-defendants as part of DOJ/FBI Operation Token Mirrors for alleged wire fraud conspiracy and wire fraud related to coordinated pump-and-dump wash trading schemes. Singh was arrested in Singapore on October 2, 2025 at U.S. request, extradited to the United States, and made his initial court appearance in Oakland on March 30, 2026; he remained in federal custody as of that date. All charges are allegations; Singh has not been convicted and is presumed innocent.

OverHere Limited is a Hong Kong-registered Web3 launchpad founded and controlled by Clinton So. The company served as the primary launch platform for the $HAWK memecoin on December 4, 2024, a token associated with viral internet personality Haliey Welch. Within hours of launch the token surged to an alleged peak market cap of approximately $491 million before collapsing more than 90%, and on December 19, 2024 OverHere Limited and Clinton So were named defendants in a federal securities class action (EDNY Case No. 1:24-cv-08650) alongside co-defendants Alex Larson Schultz and the Tuah the Moon Foundation. The litigation was actively proceeding as of early 2026, with lead plaintiff Alexander Escobar appointed April 23, 2025 and co-lead counsel Wolf Popper LLP and Burwick Law designated by Judge Cheryl L. Pollak; an amended complaint filed in November 2025 expanded the defendant pool and added coordinated fraud allegations.

RIVER is the native governance token of River Protocol, a chain-abstraction stablecoin project that launched via Binance Wallet's inaugural BuildKey IDO in September 2025, raising $100 million in two hours. The token surged to an all-time high of approximately $87.79 on January 26, 2026, before collapsing more than 94% to roughly $5 as of early June 2026. On-chain investigator ZachXBT publicly named RIVER as the anchor case in his May 2026 investigation into Hong Kong-based market maker Heisenberg Guru (HSBG), alleging coordinated supply-control manipulation across centralized exchanges, and offering a $10,000 personal bounty for insider evidence targeting HSBG operators identified by the handles 'Sion' and 'Chao'.

$MELANIA is a Solana-based memecoin launched on January 19, 2025 by MKT World LLC, a Florida company linked to First Lady Melania Trump, one day before her husband's presidential inauguration. The token reached a peak market capitalization of approximately $1.6–1.73 billion before losing roughly 99% of its all-time high value; as of June 2026 it trades near $0.09. A class action lawsuit filed in the Southern District of New York (Hurlock v. Kelsier Ventures, amended October 2025) alleges that Kelsier Ventures CEO Hayden Davis and Meteora co-founder Benjamin Chow orchestrated a pre-engineered pump-and-dump scheme across at least 15 tokens, using Melania Trump's name as 'window dressing' without her alleged knowledge of the insider mechanics.

@beaverd is an anonymous X (Twitter) account that won X's $1 million Creators Prize in February 2026 for an investigative article on Deloitte. Days after the prize announcement, on-chain analytics firm Bubblemaps published a detailed investigation alleging that wallet clusters linked to @beaverd had engaged in serial pump-and-dump activity across dozens of Solana memecoins launched via Pump.fun, extracting an estimated $600,000 in profits. @beaverd did not dispute the wallet links, responding publicly with 'cry me a river, also these aren't even the top 5 greatest hits,' a statement widely interpreted as an implicit admission of the activity.

Sahil Arora (also known online as 'Sahil Crypto', formerly @Habibi_Comm on X) is an Indian-born, Dubai-based entrepreneur documented across multiple Tier 2 sources as a serial celebrity memecoin operator who allegedly orchestrated pump-and-dump schemes involving Caitlyn Jenner, Jason Derulo, Iggy Azalea, Rich the Kid, Floyd Mayweather, Davido, and others between 2021 and 2025. He allegedly paid celebrities fees ranging from $15,000 to $200,000+ per promotional post while secretly controlling 25–40% of each token's supply, then dumping his holdings immediately after the celebrity promotion caused a price spike. Arora was permanently banned from X in June 2024 and admitted in public interviews to profiting from rug pulls; in July 2025 Dubai authorities reportedly detained him and seized assets exceeding $20 million, though Arora publicly denied arrest via video.

Geoffrey Woo, Stanford-educated co-founder of the Anti Fund venture capital firm alongside Jake Paul, launched the AntiHunter (ANTIHUNTER) AI-themed memecoin on the Base blockchain in February 2026, publicly claiming '0% rug pull risk' because he is 'already rich.' Blockchain investigator ZachXBT subsequently identified three token swaps attributed to insider wallets that appear to violate Woo's stated commitment to pre-announce all insider sales, raising credible concerns about transparency. The token reached an all-time high market cap of approximately $12.6 million on February 13, 2026, before declining roughly 99% to a market cap of approximately $85,000 as of early June 2026.

On September 1, 2025, blockchain investigator ZachXBT published a leaked price sheet documenting over 200 crypto influencers (key opinion leaders) who were approached to promote an AI memecoin platform called Memenetic on Solana, with on-chain payment verification showing more than 160 accepted compensation ranging from $50 to $60,000 per post. Fewer than five of the roughly 160 confirmed paid recipients disclosed the arrangements as advertisements, a compliance rate below 3% and in direct violation of FTC Endorsement Guides. The evidence — consisting of Solana wallet addresses and publicly verifiable transaction hashes — indicates the promotions were organized through a tiered commercial infrastructure, with an additional allegation from the Memenetic project team that two intermediaries, @MsCryptomom1 and @imanihamida, allegedly defrauded them of $232,000 in USDC while managing the influencer campaign.

Michele Spagnuolo, 36, a Staff Information Security Engineer at Google Zürich known in crypto communities as 'AlphaRaccoon,' was arrested in New York on May 27, 2026 and charged by the U.S. Department of Justice with commodities fraud, wire fraud, and money laundering. Federal prosecutors allege he accessed confidential internal Google 'Year in Search 2025' data and used it to place approximately $2.75 million in bets on Polymarket prediction markets between October and December 2025, netting over $1.2 million in alleged illegal profits. The case, filed in the Southern District of New York alongside a parallel CFTC civil enforcement action, is among the first insider trading prosecutions applied to a crypto prediction market platform.

CLS Global FZC LLC (UAE) and ZM Quant Investment Ltd (British Virgin Islands) were crypto market-making firms that provided market-manipulation-as-a-service to token issuers. Both were charged in October 2024 by the U.S. DOJ and SEC as part of Operation Token Mirrors, a coordinated FBI sting that used a fake token called NexFundAI to document wash trading solicitation in real time. CLS Global pleaded guilty in January 2025 and was sentenced in April 2025 to pay $428,059 and serve a three-year U.S. market ban; ZM Quant's criminal case (1:24-cr-10187, D. Mass.) remained pending as of mid-2025 with its two individual defendants, Baijun Ou and Ruiqi Liu, based outside the United States. The SEC voluntarily dismissed its parallel civil actions against both entities on March 31, 2026, consistent with the current administration's broader rollback of crypto enforcement actions initiated under the prior administration.

Krish Kumar, a 19-year-old college freshman from Tulsa, Oklahoma, is the subject of settled civil charges filed by the SEC on March 26, 2026, for allegedly misappropriating nearly $7 million from two crypto-focused investment funds he solely managed: Future Fractal Investments LLC and Arcane Resonance Fund LLC. Between January 2024 and February 2025, Kumar raised approximately $7.8 million from roughly two dozen investors, then transferred the vast majority of those assets to personal accounts, lost approximately 98% by purchasing speculative options in a Bitcoin mining company over four trading days, and allegedly fabricated performance records including a photoshopped brokerage screenshot. Kumar later launched a second fund targeting parents of college friends, in a structure the SEC characterizes as resembling a Ponzi scheme.

NYC Token ($NYC) is a Solana-based memecoin launched on January 12–13, 2026, by former New York City Mayor Eric Adams at a Times Square press conference. The token surged to an approximately $540–600 million market capitalization before losing more than 80 percent of its value within roughly 30 minutes, following on-chain movements in which a wallet linked to the token deployer withdrew approximately $2.43–$3.18 million in USDC from the liquidity pool. Adams and the NYC Token team denied any wrongdoing, attributing the liquidity movements to routine market-maker adjustments, while blockchain analytics firms and multiple credible media outlets characterized the pattern as consistent with a 'rug pull.' Adams separately carried a prior federal indictment on bribery and campaign-finance charges — unsealed in September 2024 — that was dismissed with prejudice in April 2025 following a DOJ directive under the Trump administration.

Alex Larson Schultz (known online as 'Doc Hollywood'), OverHere Limited CEO Clinton So, and the Cayman Islands-registered Tuah The Moon Foundation are the principal architects behind the $HAWK memecoin launched December 4, 2024, on Solana, which used the viral celebrity of Hailey Welch ('Hawk Tuah Girl') to attract retail investors before collapsing more than 93% within hours of launch. A federal class action (Case 1:24-cv-08650, EDNY) filed December 19, 2024, alleges unregistered securities violations and a coordinated pump-and-dump scheme; the lawsuit has since been amended to add Welch, her manager, and Meteora DEX as additional defendants. The SEC and FBI investigated Welch and closed their inquiries without charges in early 2025; the civil litigation against Schultz, So, and OverHere remains active.

Jump Trading is a Chicago-based proprietary trading firm founded in 1999, operating one of the largest high-frequency trading operations globally across futures, equities, fixed income, FX, and cryptocurrency markets. Its crypto division, Jump Crypto, became a major force in DeFi infrastructure between 2021 and 2023, co-developing Wormhole, Pyth Network, and the Firedancer Solana validator client. The firm has faced significant regulatory and legal exposure: its subsidiary Tai Mo Shan settled with the SEC in December 2024 for $123 million over TerraUSD manipulation, the Terraform bankruptcy administrator filed a $4 billion civil lawsuit in December 2025 naming Jump and individual executives, and a separate CFTC investigation was reported in 2024 with no public resolution as of mid-2026.

Manu Singh, 34, is the alleged CEO of Contrarian Capital, a British Virgin Islands-registered cryptocurrency market-making firm. On September 4, 2025, a federal grand jury in the Northern District of California indicted Singh and three associates on charges of wire fraud and wire fraud conspiracy as part of DOJ and FBI Operation Token Mirrors, a multi-firm undercover enforcement action targeting coordinated pump-and-dump market manipulation. Singh and co-defendant Vasu Sharma were arrested in Singapore on October 2, 2025 and extradited to the United States; both were in federal custody as of their initial appearance in Oakland on March 30, 2026. All charges are allegations; Singh has not been convicted and is presumed innocent.

SIREN is a BNB Chain AI-themed meme token launched in early 2025 via the Four.meme fair-launch platform. Beginning in March 2026 the token underwent a series of extreme pump-and-dump cycles, crashing roughly 90% from its all-time high of approximately $3.83 within ten days. On-chain investigators ZachXBT and BubbleMaps identified a single wallet cluster holding nearly 50% of circulating supply, linked by ZachXBT to addresses associated with DWF Labs-affiliated tokens; ZachXBT later named SIREN as one of at least six tokens subject to a coordinated market-maker manipulation playbook allegedly enabled by Bitget, alongside RAVE, RIVER, LAB, MYX, and SKYAI.

Morocoin Tech Corp., Berge Blockchain Technology Co. Ltd., Cirkor Inc., AI Wealth Inc., Lane Wealth Inc., AI Investment Education Foundation Ltd., and Zenith Asset Tech Foundation are seven entities charged by the SEC on December 22, 2025 (Case No. 1:25-cv-04102, D. Colo.) with defrauding at least $14 million from U.S. retail investors in a coordinated pig-butchering and AI-themed investment confidence scheme operating from January 2024 through January 2025. The scheme used WhatsApp-based fake investment clubs, deepfake social media advertisements, fabricated AI-generated trading signals, and counterfeit trading platforms that conducted no actual trading, followed by advance fee demands to further extract funds from victims attempting withdrawals.

$TRUMP (Official Trump) is a Solana-based memecoin launched on January 17, 2025, two days before Donald Trump's presidential inauguration, by two Trump-affiliated entities — CIC Digital LLC and Fight Fight Fight LLC — who collectively retain 80% of the 1 billion token supply under a multi-year vesting schedule. The token peaked near $75 within hours of launch before declining approximately 97% to roughly $1.96 as of June 2026, generating an estimated $320–$600 million in fees and token proceeds for insider entities while on-chain analytics attribute more than $4.3 billion in aggregate losses to retail investors. The project has drawn formal congressional investigations, foreign-influence concerns, and ethics scrutiny, though no criminal charges or SEC enforcement actions have been filed against it as of the investigation date.

Aguilar v. Baton Corporation Ltd. (Case No. 1:25-cv-00880, S.D.N.Y.) is an active federal class action alleging that Pump.fun, Solana Labs, the Solana Foundation, and named executives operated a coordinated racketeering enterprise — referred to as the 'Solana-Pump.Fun Racketeering Enterprise' — that rigged its memecoin launchpad to benefit insiders while marketing it as a fair platform to retail investors. Plaintiffs allege aggregate retail losses between $4 billion and $5.5 billion, while the platform collected an alleged $722 million in fees. As of early 2026, defendants have filed motions to dismiss the Second Amended Complaint; no ruling on those motions has been publicly reported as of June 2026.

Crypto Beast is the online handle of Chris Woytko (@cryptobeastreal), a crypto influencer with approximately 800,000 X followers who has been publicly exposed by on-chain investigator ZachXBT for allegedly orchestrating a pump-and-dump scheme on the $ALT (Altcoin Fun) token in July 2025. According to ZachXBT's on-chain analysis, 45 linked wallets coordinated an $11 million dump on July 14, 2025, collapsing the token from a $190 million market cap to approximately $3 million within hours. ZachXBT also documented an alleged pattern of similar bundled rug-pull operations across at least six prior tokens ($ALPHA, $RICH, $YE, $RUG, $ACE, $JOHN). No confirmed legal or regulatory action had been filed as of the time of research.

Beginning at least as early as March 2026 and escalating sharply through May 2026, a sustained and coordinated phishing campaign has impersonated Xaman Wallet — the dominant self-custody wallet for the XRP Ledger, developed by XRPL Labs — across fake social media accounts, counterfeit domains, fraudulent browser extensions, and fake desktop wallet applications. Xaman founder Wietse Wind confirmed on May 23, 2026 that more than 20 fake X/Twitter accounts and more than 10 fraudulent domains are created daily as part of this campaign. The legitimate Xaman product and XRPL Labs are the impersonated party and bear no responsibility for the fraudulent activity.

A family of increasingly sophisticated wallet-drainer toolkits targeting the Solana ecosystem that weaponize legitimate Solana protocol features — Blinks (blockchain action links), durable nonces, and the system 'assign' instruction — to bypass the transaction-simulation safety layer that most Solana wallets rely on as their primary defense. Documented in detail by security researchers from February 2024 onward and materially escalated in late 2025 and early 2026, these kits are distributed as scam-as-a-service products supporting 90+ wallet types; losses attributable to Solana phishing reached approximately $90 million in H1 2025 alone, before the simulation-bypass generation was widely deployed. A state-level durable-nonce attack on Drift Protocol (April 2026) demonstrated that the same primitive can scale to $285 million in a single operation.

On March 19, 2026, DeFi protocol Neutrl experienced a suspected DNS hijack of its frontend domain, in which attackers allegedly social-engineered the protocol's DNS provider to redirect user traffic to a malicious interface targeting Permit2 wallet approvals. Neutrl paused its smart contracts as a precaution, migrated to new infrastructure by March 21, and confirmed all user funds remained safe via the protocol's custodial isolation framework. This incident is considered the earliest confirmed event in a six-week cluster of DeFi frontend hijacks in early 2026 that also struck HypurrFi (April 3) and CoW Swap (April 14).

Donald G. Basile, founder of Bitcoin Latinum (LTNM) and CEO of Monsoon Blockchain Corporation, was charged by the SEC on April 17, 2026 with defrauding hundreds of U.S. investors of approximately $16 million through a SAFT offering that relied on fabricated insurance claims, a phantom asset-backed trust, and misrepresentations about how investor funds would be used. The token launched on overseas exchanges in October 2021 and subsequently collapsed by more than 90%, and the SEC alleges Basile diverted investor proceeds to personal real estate, credit card expenses, and a $160,000 horse while no underlying fund was ever created.

An ongoing phishing campaign, active since at least July 2025, impersonates Chainbase — a legitimate Singapore-based Web3 data infrastructure company — to lure cryptocurrency holders into either granting unlimited wallet spend approvals or surrendering seed phrases via fake 'wallet update' forms. The campaign exploits the timing of Chainbase's real $C token airdrop (launched July 14, 2025 on airdrop.chainbase.com) and operates through dozens of rotating domains anchored by chainbz[.]vip, using stolen branding, malicious ads, and social media spam. Chainbase has not authorized any third-party claim sites; all legitimate claims occurred exclusively at airdrop.chainbase.com.

A coordinated phishing campaign active in late May 2026 impersonated MetaMask by sending fake 'mandatory 2026 system upgrade' notifications via email and push alerts, directing victims to pixel-accurate clone sites that solicited a single Permit/token-approval signature draining wallets within seconds. On-chain investigator ZachXBT placed total losses at more than $9 million across 400+ addresses on Ethereum, Polygon, Arbitrum, and Base as of May 30, 2026. The campaign is part of a sustained multi-variant operation against MetaMask users that began at least as early as January 2026; MetaMask itself is an impersonation victim and is not at fault.

On December 24, 2025, a malicious version (v2.68) of the Trust Wallet Chrome extension was published to the Chrome Web Store using a stolen Chrome Web Store API key obtained via the Shai-Hulud 2.0 npm supply chain worm in November 2025. The backdoored extension silently exfiltrated decrypted seed phrases from 2,520 to 2,596 wallet addresses (figure varies by source and verification cutoff) to an attacker-controlled server, resulting in approximately $7–8.5 million in cryptocurrency losses over roughly 48 hours. Trust Wallet (a Binance subsidiary) voluntarily committed to reimbursing all verified victims and released an emergency clean patch (v2.69) on December 26, 2025.

Unicoin, Inc. (formerly TransparentBusiness, Inc.) is a New York-based crypto company that sold 'Unicoin Rights Certificates' — instruments purportedly convertible one-for-one into future Unicoin tokens backed by real-world assets — beginning in February 2022. On May 20, 2025, the U.S. Securities and Exchange Commission filed a civil fraud complaint in the Southern District of New York against the company and four executives, alleging that the firm raised up to $110 million from more than 5,000 investors while fabricating $3 billion in sales, overstating real estate asset values by billions of dollars, and falsely marketing the certificates as SEC-registered. As of June 2026 the case remains active; Unicoin has filed a motion to dismiss and no ruling has been reported.

An industrialized, automated address poisoning campaign targeting Ethereum users accelerated sharply after the Fusaka protocol upgrade on December 3, 2025 reduced gas fees approximately sixfold, removing the prior economic barrier to mass-scale dust-transaction attacks. Security firm ScamSniffer documented at least $62.25 million in confirmed losses across two high-profile victims in December 2025 and January 2026 alone, while Blockaid flagged over 65.4 million poisoning transactions since January 2025 averaging 160,000 per day. The campaign represents a commercial, industrialized threat infrastructure sold as a service on Telegram rather than a single threat actor, and is ongoing as of the research date.

Shai-Hulud is a self-replicating supply chain worm attributed to the financially motivated threat group TeamPCP (also tracked as DeadCatx3, PCPcat, ShellForce, CipherForce, and UNC6780 by Google's Threat Intelligence Group). Active since September 2025, the campaign has compromised hundreds of npm and PyPI packages by harvesting CI/CD credentials through malicious preinstall lifecycle hooks, directly enabling the Trust Wallet Chrome extension hack of December 2025 in which approximately $8.5 million was stolen from 2,520 wallets. As of June 2026, the campaign remains active through copycat variants following TeamPCP's public open-sourcing of the worm's source code on May 12–13, 2026.

Paxful was a U.S.-based peer-to-peer Bitcoin marketplace founded in 2015 by Ray Youssef and Artur Schaback. After operating for a decade and processing approximately $5 billion in trades across 14 million users, the platform ceased operations by November 1, 2025, citing the lasting impact of historic compliance failures and unsustainable remediation costs. In December 2025, Paxful Holdings pleaded guilty to three federal criminal charges — including conspiring to violate the Travel Act, operating an unlicensed money transmitting business, and BSA anti-money laundering violations — and was sentenced in February 2026 to a $4 million criminal penalty; FinCEN separately assessed a $3.5 million civil penalty for the same underlying conduct.

Gravity Bridge is a purpose-built, decentralized blockchain bridge developed by Althea Network that enables bidirectional transfer of ERC-20 tokens between Ethereum and the Cosmos IBC ecosystem. It launched mainnet in December 2021 after three independent security audits and became the most widely adopted bridge in the Cosmos ecosystem. On May 30, 2026, the bridge suffered a critical security incident in which approximately $5.4 million was drained via an alleged validator signing-key compromise, prompting a full bridge halt that remained in effect as of June 2, 2026.

Jonathan Spalletta, 36, of Rockville, Maryland, was charged on March 30, 2026 by the U.S. Attorney's Office for the Southern District of New York with one count of computer fraud and one count of money laundering in connection with two hacks of the decentralized exchange Uranium Finance in April 2021 that allegedly yielded approximately $54.7 million in stolen cryptocurrency. He is alleged to have laundered proceeds through Tornado Cash and converted them into rare collectibles including Magic: The Gathering cards, first-edition Pokemon sets, and antiquities. He surrendered to authorities on March 30, 2026, entered a not-guilty plea, and is awaiting trial scheduled for September 2026 before U.S. District Judge Jed S. Rakoff.

Brandon Michael Tardibone, 28, of Miami, Florida, was federally indicted on May 11, 2026 in the Southern District of Florida (case 1:26-cr-20181) on charges of conspiracy to commit money laundering and harboring an alien unlawfully present in the United States. Prosecutors allege he provided housing and material support to Canadian co-defendant Trenton Richard David Johnston — who allegedly orchestrated a $13 million cryptocurrency fraud scheme via social-engineering impersonation attacks — while Johnston was unlawfully overstaying his visa, and that both defendants jointly laundered more than $1 million of stolen proceeds through luxury goods and South Florida nightlife. All charges are allegations; both defendants are presumed innocent unless and until proven guilty at trial.

LayerZero is a major omnichain interoperability protocol operated by LayerZero Labs, deployed across 130+ blockchains and processing over 200 million cross-chain messages as of early 2026. The protocol gained institutional backing from Citadel Securities, ARK Invest, Tether, and Sequoia Capital, and is the infrastructure behind USDT0, which processed over $70 billion in cross-chain USDT transfers. In April 2026, LayerZero's off-chain DVN infrastructure was compromised via a social engineering attack attributed to North Korea's Lazarus Group (TraderTraitor), enabling the $292 million KelpDAO rsETH bridge exploit — the largest DeFi hack of 2026 — and triggering a multi-billion-dollar client exodus to competing bridge providers.

CoW Protocol (trading interface: CoW Swap) is a decentralized exchange aggregator and MEV-protection protocol spun out of GnosisDAO in 2022. On April 14, 2026, the protocol's cow.fi domain was hijacked via a social engineering attack that exploited registrar Gandi SAS and the Finnish .fi registry authority Traficom using forged identity documents, redirecting users to a phishing interface for approximately 90 minutes and causing confirmed losses of approximately $1.2 million. The protocol's smart contracts were not compromised; CoW DAO subsequently passed CIP-86 in May 2026 to offer discretionary grants reimbursing verified victims up to 100% of their losses.

Daos.fun is a Solana-based platform that allows vetted creators to launch on-chain investment DAOs (marketed as 'meme hedge funds'), raising SOL from the public and trading it across SPL tokens with full unilateral discretion. Launched in September 2024 by pseudonymous developer Baoskee (identified by Alliance DAO as Bao Mai), the platform gained rapid notoriety through the ai16z / ElizaOS DAO and attracted significant speculative capital. Structural risks include fund-manager custody with no investor veto, extreme market-cap-to-NAV premiums documented at 29x–58x, the absence of a public smart-contract audit, and unresolved securities-law exposure in multiple jurisdictions.

Decaf (decaf.so) is a non-custodial stablecoin wallet and payments platform built on Solana and Stellar, founded in 2022 and headquartered in Miami, FL, targeting emerging-market users who need low-cost cross-border payments and fiat cash-out. The company has raised a seed round from recognizable crypto-native and fintech investors including Visa, and has established formal partnerships with Circle, MoneyGram, and the Stellar Development Foundation. No regulatory actions, hacks, or fraud allegations have been identified as of the investigation date.

Dogwifhat (WIF) is a Solana-based memecoin launched anonymously in November 2023, featuring a Shiba Inu dog wearing a pink knitted hat. It reached a peak market capitalization of approximately $4.8 billion in March 2024 before declining more than 90% from its all-time high by mid-2026. The project carries inherent memecoin risks — no utility, anonymous creators, speculative-only value — alongside a notable failed community fundraiser for a Las Vegas Sphere advertisement that raised nearly $700,000 but never executed, ultimately refunding donors in 2025.

Dual Finance is a Solana-based structured-products protocol offering Dual Investment Pools (DIPs) and Staking Options, products designed to provide yield to token holders and sustainable liquidity incentives to DAOs. Founded in 2022 by named individuals with verifiable TradFi and FAANG backgrounds, the protocol reached a peak TVL of approximately $35 million in 2023 but has since contracted sharply to under $500K as of mid-2025. No exploits, regulatory actions, or fraud allegations have been identified in public records; the primary concerns are low current TVL, limited publicly-verifiable audit documentation, and significant DUAL token price depreciation since its 2023 ATH.

Edgevana is a Las Vegas-based bare-metal infrastructure and node-deployment platform founded in 2019, specializing in Solana validator onboarding, RPC node provisioning, and decentralized edge compute. The company operates a liquid staking product (edgeSOL) with approximately 839,000 SOL under management and has secured notable partnerships with the Solana Foundation, Avalanche, and StackPath. No regulatory actions, fraud allegations, or significant security incidents have been identified.

Famous Fox Federation (FFF) is a Solana-native NFT ecosystem founded in September 2021, comprising a genesis collection of 7,777 fox PFP NFTs and several sub-collections under the 'Foxosphere' umbrella. The team, operating under the pseudonyms 'DraxxTs' and 'FoxyDev', has built and shipped multiple on-chain utilities including the Rafffle raffle platform, the Citrus NFT lending protocol, a token marketplace, and gamified staking missions. No regulatory actions, exploits, or rug-pull incidents have been identified through public sources, though the founders remain pseudonymous and $FOXY token value has declined substantially from its all-time high.

Fartcoin (FARTCOIN) is a Solana-based memecoin launched anonymously on October 18, 2024 via the Pump.fun launchpad, inspired by a suggestion from Truth Terminal, an autonomous AI chatbot developed by Andy Ayrey and funded with a $50,000 grant by Marc Andreessen of a16z. The token carries no stated utility and derives all value from speculation, community sentiment, and association with the AI-agent narrative; it reached an all-time high market capitalization of approximately $2.3 billion in January 2025 before declining more than 93% to approximately $160 million by May 2026. As a memecoin with an anonymous founding team, no intrinsic value, high whale concentration, and significant price volatility, it represents substantial speculative risk.

Flash Trade (flash.trade) is a non-custodial, asset-backed perpetuals and spot exchange built on Solana, founded in early 2023 by Anas Khader and Zoheb Shahzan (previously of the Investin project). The protocol is bootstrapped, has undergone multiple third-party security audits, publishes an open-source reference implementation, and has processed over $20 billion in cumulative trading volume. No exploits, regulatory actions, or fraud allegations have been identified; primary risk factors are a modest TVL (~$10.7M), a low-cap governance token (FAF, ~$3.7M market cap), oracle dependency on Pyth Network, and limited public background on the founding team.

Fragmetric (fragmetric.xyz) is a Solana-native liquid restaking protocol that issues fragSOL, fragJTO, and fragBTC as Liquid Restaking Tokens (LRTs) built on Jito's restaking infrastructure. The protocol raised $12 million across seed and strategic rounds from recognized institutional backers including Hashed, Finality Capital, and RockawayX, and has undergone multiple independent security audits by Certora and Quantstamp. Material risks include smart-contract complexity inherent to restaking, slashing exposure through Node Consensus Networks (NCNs), partial team pseudonymity, and significant FRAG token price depreciation following the July 2025 listing.

Malone Lam Yu Xuan (born July 19, 2004), a Singaporean national residing in Miami and Los Angeles, is the alleged ringleader of a crypto theft and money laundering enterprise responsible for stealing over $263 million across multiple victims between 2023 and 2025. He was arrested by the FBI on September 18, 2024, and faces RICO conspiracy charges in what prosecutors describe as the first Bitcoin-related RICO prosecution in U.S. history. As of early 2026, he remains in pretrial detention while negotiating a plea deal.

Velodrome Finance is an automated market maker (AMM) and decentralized exchange (DEX) launched on June 2, 2022, on the Optimism Layer 2 network. It is a fork and improvement of Andre Cronje's Solidly Exchange, implementing a ve(3,3) governance and liquidity incentive model. The protocol has experienced three documented security incidents: an insider theft of $350,000 by a team member in August 2022, a DNS/frontend social-engineering attack in November–December 2023 resulting in approximately $250,000 in user losses, and a second DNS hijacking in November 2025 attributed to a NameSilo registrar insider, resulting in estimated losses of $700,000–$1,000,000. Smart contracts have not been directly exploited; all monetary losses have stemmed from front-end and operational security failures.

M2 is a UAE-based cryptocurrency exchange licensed by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority, operating as a regulated Multilateral Trading Facility and custodian since late 2023. On October 31, 2024, the exchange suffered a $13.7 million hot wallet breach attributed to an access control vulnerability across the Bitcoin, Ethereum, and Solana networks. M2 subsequently reimbursed all affected customers from its own assets and stated it had engaged law enforcement and regulatory authorities.

Rapper Nelly (Cornell Iral Haynes Jr.) is flagged here not as a perpetrator of crypto fraud, but as a victim of an account compromise. In October 2023, an X (formerly Twitter) account associated with Nelly — handle @NellioETH — was hacked by an unknown third party who then used it to run a social engineering phishing campaign against crypto users. Blockchain investigator ZachXBT first identified and publicized the incident; specific amounts stolen from victims and detailed on-chain forensics have not been publicly confirmed.

Trezor is a legitimate Prague-based hardware wallet manufacturer (SatoshiLabs) and one of the oldest in the industry, but it has accumulated a significant threat ecosystem around its brand. A January 2024 breach of its third-party support portal exposed contact data for approximately 66,000 users, which subsequently fueled targeted phishing campaigns delivered via email, physical mail, and fake apps. Trezor hardware devices have also been subject to disclosed physical attack vectors, including an alleged unpatchable flaw in the STM32 microcontroller used in the Trezor T model.

Ninamo is a purported crypto entity whose name was submitted for investigation on AVOID.NET. Exhaustive searches across regulatory databases, blockchain explorers, crypto news outlets, scam trackers, social media platforms, domain registries, and the Wayback Machine returned no verifiable information about any crypto project, exchange, token, or DeFi protocol operating under the name Ninamo. No wallet addresses, enforcement actions, community reports, or archived web presence could be located.