Key cybersecurity incidents include Ukrainian authorities seizing $8.3 million in crypto, Kraken facing extortion, and the FBI recovering Signal messages.
Recent events in cybersecurity have revealed significant threats and developments, including a major cryptocurrency seizure in Ukraine and extortion attempts against Kraken.
- Ukrainian law enforcement confiscated $8.3 million in cryptocurrency from hackers.
- A new trojan targeting cryptocurrency users has been identified.
- Kraken reported being extorted by a criminal group.
- The FBI retrieved deleted messages from Signal amid a court case.
Ukrainian Authorities Confiscate $8.3 Million in Cryptocurrency
Ukrainian officials apprehended a member of an international hacking organization linked to cybercrimes in Europe and the U.S. Prosecutor General Ruslan Kravchenko announced that the group employed malware to extract confidential documents for ransom, laundering the proceeds primarily through luxury goods and real estate in Ukraine.
The operation resulted in over $100 million in estimated damages, with authorities executing more than 30 searches that led to the seizure of assets worth around $11.1 million. This included $1 million in cash, various vehicles, residential properties, and the aforementioned cryptocurrency.
Additionally, law enforcement identified a collaborator involved in laundering the stolen funds.
New Trojan Discovered Targeting Crypto Wallet Addresses
Kaspersky Lab has reported the emergence of the ClipBanker trojan, which stealthily replaces cryptocurrency wallet addresses in the clipboard. This malware masquerades as a legitimate application for redirecting traffic through Proxifier, a tool often used by developers.
Analysts noted that the trojan utilizes a fileless infection method during Proxifier's installation, making it difficult to detect. Since early 2025, over 2,000 users, mainly in India and Vietnam, have reported encounters with this threat.
Kraken Faces Extortion Threats
Kraken's Chief Information Security Officer, Nick Percoco, disclosed that the exchange is under threat from a criminal group demanding compliance to prevent the release of videos purportedly showcasing internal client data.
We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands.
— Nick Percoco (@c7five) April 13, 2026
Despite the threat, Percoco emphasized that Kraken's systems were not compromised, and client funds remain secure. He indicated that the incident was linked to unauthorized access by support personnel, with around 2,000 accounts affected.
The exchange is cooperating with law enforcement and has shared evidence regarding the situation.
FBI Recovers Deleted Messages from Signal
In a noteworthy development, the FBI successfully retrieved deleted messages from the Signal app during an investigation related to an attack on an ICE center in Texas. The messages were recovered from the iPhone of defendant Lynette Sharp, utilizing push notifications stored within iOS.
This incident highlights potential vulnerabilities in messaging applications, as the content can remain retrievable even after deletion, provided certain settings are not adjusted. Pavel Durov, co-founder of Telegram, commented on the situation, underscoring the security of secret chats.
Signal representatives confirmed they received inquiries regarding this case but did not provide further comments.
Obsidian App Used as Trojan Delivery Mechanism
Elastic Security Labs has uncovered a scheme where attackers exploit the Obsidian note-taking app to deliver a new trojan named PHANTOMPULSE. The attack targets employees in financial and cryptocurrency sectors.
The attackers present themselves as venture firm employees and subsequently lure victims into connecting to a fake cloud vault in Obsidian. The malicious code is executed by convincing victims to enable third-party plugins, which are disabled by default.
Once activated, the trojan can execute commands, gather telemetry, and even escalate privileges on infected systems, posing a significant threat to targeted organizations.
