Cybersecurity articles tagged #Cryptocurrency Theft on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/jewelbug-apt-dual-motivation-espionage-crypto-heistshttps://runtimerebel.com/blog/jewelbug-apt-dual-motivation-espionage-crypto-heistsJewelbug APT, a unique 'hackers-for-hire' group, conducts state-sponsored espionage and financially motivated cryptocurrency heists from a single operational panel.Thu, 13 Aug 2026 16:47:11 GMTCyber EspionageCryptocurrency TheftThreat ActorFinancially MotivatedJewelbug APThttps://runtimerebel.com/blog/uat-11795-deploys-starland-rat-wldr-agent-in-financial-campaignhttps://runtimerebel.com/blog/uat-11795-deploys-starland-rat-wldr-agent-in-financial-campaignUAT-11795, a Russian-speaking financially motivated adversary, uses Starland RAT and the WLDR C2 agent to target credentials and crypto in the U.S. and Europe.Sat, 08 Aug 2026 16:24:54 GMTFinancially MotivatedCredential TheftCryptocurrency TheftUAT 11795Starland RAThttps://runtimerebel.com/blog/apple-app-store-fraud-fake-sparrow-wallet-steals-1-8m-in-bitcoinhttps://runtimerebel.com/blog/apple-app-store-fraud-fake-sparrow-wallet-steals-1-8m-in-bitcoinA fraudulent Sparrow Wallet application on the Apple App Store has resulted in a $1.8 million Bitcoin theft, sparking a lawsuit over platform security claims.Mon, 27 Jul 2026 17:43:38 GMTCryptocurrency TheftApple App StoreSparrow WalletMalicious AppsBitcoin Fraudhttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletshttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletsBlueNoroff uses a custom phishing kit to profile crypto wallets before delivering malware through impersonated Zoom and Microsoft Teams platforms.Fri, 24 Jul 2026 17:39:06 GMTBlueNoroffLazarus GroupCryptocurrency TheftClickFixPhishinghttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attackshttps://runtimerebel.com/blog/okobot-framework-multi-payload-data-crypto-theft-attacksThe new OkoBot framework deploys over 20 distinct payloads, primarily targeting cryptocurrency seed phrases, credentials, and sensitive data.Thu, 16 Jul 2026 21:02:27 GMTOkoBotMalwareInfostealerCryptocurrency TheftCredential TheftData Exfiltrationhttps://runtimerebel.com/blog/sim-swapping-ring-busted-millions-in-crypto-theft-via-telecom-hackshttps://runtimerebel.com/blog/sim-swapping-ring-busted-millions-in-crypto-theft-via-telecom-hacksPolish authorities dismantle a sophisticated SIM-swapping ring that hijacked telecom partners and email accounts to steal millions in cryptocurrency.Fri, 26 Jun 2026 01:02:30 GMTSIM SwappingCryptocurrency TheftTelecommunications SecurityAccount TakeoverCybercrimePolandhttps://runtimerebel.com/blog/cross-platform-clipboard-hijacker-fake-reputation-campaign-targets-cryptohttps://runtimerebel.com/blog/cross-platform-clipboard-hijacker-fake-reputation-campaign-targets-cryptoAnalysis of a cross-platform clipboard hijacker spread via elaborate fake reputation campaigns on GitHub, YouTube, and VirusTotal to steal cryptocurrency.Mon, 22 Jun 2026 17:39:28 GMTClipboard HijackerCryptocurrency TheftSocial EngineeringFake ReputationCross Platform Malwarehttps://runtimerebel.com/blog/crypto-gang-sentencing-inside-the-243m-greavys-group-heisthttps://runtimerebel.com/blog/crypto-gang-sentencing-inside-the-243m-greavys-group-heistA 20-year-old gang member receives a 6.5-year sentence for his role in a $243 million crypto heist involving home invasion and social engineering.Thu, 07 May 2026 12:46:44 GMTCryptocurrency TheftSocial EngineeringMoney LaunderingGreavys GroupThreat Intelhttps://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026https://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026North Korean threat actors are projected to be responsible for 76% of all cryptocurrency stolen by 2026, utilizing sophisticated methods for large-scale heists.Sat, 02 May 2026 00:49:12 GMTNorth KoreaCryptocurrency TheftLazarus GroupCybercrimeFinancial CrimeNation State APThttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attackshttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attacksAn analysis of Lazarus Group's persistent and financially motivated cyber operations, highlighting over $2B in crypto theft and critical supply chain attack risks.Tue, 28 Apr 2026 16:47:53 GMTLazarus GroupDPRKCryptocurrency TheftSupply Chain AttackFinancial CybercrimeAPThttps://runtimerebel.com/blog/global-law-enforcement-disrupts-45m-crypto-theft-networkhttps://runtimerebel.com/blog/global-law-enforcement-disrupts-45m-crypto-theft-networkInternational authorities in the US, UK, and Canada freeze $12 million and identify $45 million in stolen assets linked to global crypto theft schemes.Mon, 13 Apr 2026 12:32:39 GMTCryptocurrency TheftOperation SpincasterPig ButcheringFBIFinancial Crimehttps://runtimerebel.com/blog/bitcoin-depot-credential-theft-3-6m-stolen-from-hot-walletshttps://runtimerebel.com/blog/bitcoin-depot-credential-theft-3-6m-stolen-from-hot-walletsBitcoin Depot reports a $3.6 million loss after attackers compromised administrative credentials to drain corporate hot wallets. Analyze the breach and TTPs.Thu, 09 Apr 2026 08:43:08 GMTBitcoin DepotCryptocurrency TheftHot Wallet SecurityCredential Compromisehttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysishttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysisA deep dive into the six-month DPRK social engineering operation targeting Drift protocol, resulting in a $285 million Solana-based cryptocurrency theft.Sun, 05 Apr 2026 20:11:07 GMTDPRKLazarus GroupDrift ProtocolSocial EngineeringSolanaCryptocurrency Thefthttps://runtimerebel.com/blog/sparkcat-mobile-malware-variant-steals-crypto-recovery-phraseshttps://runtimerebel.com/blog/sparkcat-mobile-malware-variant-steals-crypto-recovery-phrasesA new SparkCat malware variant targets iOS and Android users, stealing crypto wallet recovery phrase images from compromised apps on official stores.Fri, 03 Apr 2026 12:21:17 GMTSparkCatMobile MalwareiOSAndroidCryptocurrency TheftApp Store MalwareRecovery Phrase Theft