Cryptohack Roundup: US Extradition of Accused in $340M Scam

Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime Cryptohack Roundup: US Extradition of Accused in $340M Scam Also: Hackers Stole From Verus Bridge, ThorChain and Echo Protocol Rashmi Ramesh (rashmiramesh_) • May 21, 2026     Credit Eligible Get Permission Image: Billion Photos/Shutterstock Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, Forsage's co-founder was extradited to the U.S. over his role in a $340M scam, Verus Bridge exploit drains over $11M, ThorChain halted trading after a suspected $10.7M hack, ZachXBT alleged insider control behind LAB token surge, an Ohio man was sentenced in a Ponzi scheme case, hackers drained over $800,000 from Echo Protocol and crypto ATM scams cost Americans $388M in 2025. See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation Forsage Co-Founder Extradited to US Over $340M Crypto Scam A Ukrainian national accused of co-founding the Forsage cryptocurrency $340 million Ponzi scheme has been extradited from Thailand to the United States to face fraud charges. Olena Oblamska, also known online as Lola Ferrari, pleaded not guilty in Oregon federal court after being charged with conspiracy to commit wire fraud. U.S. federal prosecutors allege that Forsage operated as a decentralized investment scam that used smart contracts on ethereum, BNB Smart Chain and Tron to funnel money from new investors to earlier participants. Authorities say the platform falsely promoted wealth-building opportunities while its founders secretly diverted investor funds through internal wallets. The Department of Justice said that more than 80% of investors lost money, and over half received nothing in return. Oblamska is the first of four founders indicted in 2023 to appear in a U.S. courtroom. The remaining co-defendants, all Russian nationals, remain at large. If convicted, Oblamska faces up to 20 years in prison. Verus Bridge Exploit Drains More Than $11M Privacy-focused decentralized finance protocol Verus is investigating an exploit targeting its ethereum bridge that drained roughly $11.6 million in crypto assets. Security companies Blockaid, PeckShield and GoPlus said the attacker stole more than 103 tBTC, 1,625 ETH and 147,000 USDC before converting the assets into about 5,400 ETH. Researchers said the exploit may involve forged cross-chain messages, bypassed withdrawal checks or flaws in access controls. PeckShield said the attacker's wallet was initially funded through Tornado Cash, a crypto mixer often used to obscure transactions. The Verus team halted much of the network after block-producing nodes shut down to contain the fallout. Developers are still investigating how the attack occurred and evaluating recovery steps. Verus launched its ethereum bridge in 2023 to allow asset transfers between its network and ethereum. ThorChain Halts Trading After Suspected $10.7M Exploit Cross-chain crypto protocol ThorChain paused trading after security researchers ZackXBT and PeckShield identified an attack affecting bitcoin, ethereum, BNB Smart Chain and Base networks. The exploit is estimated to have caused more than $10 million in losses. ThorChain said the hackers compromised one of its Asgard vaults, resulting in the loss of about $10.7 million in protocol-owned funds. The project added that early findings suggest user swapped funds were not impacted. Following the disclosure, the protocol's RUNE token fell as much as 11%. The incident adds to ThorChain's growing list of security and operational challenges. The protocol halted its ThorFi lending platform in 2025 over insolvency concerns and later restructured roughly $200 million in debt. It has also faced scrutiny for its repeated use in laundering funds from crypto hacks, including the recent Kelp DAO exploit (see: North Korea Steals Bulk of Crypto So Far). ZachXBT Alleges Insider Control Behind LAB Token Surge Blockchain investigator ZachXBT has accused insiders behind the LAB AI trading token of controlling more than 95% of its supply and orchestrating a market-driven price surge to a $6 billion valuation. ZachXBT alleged that LAB's founders and associated market makers manipulated supply, token unlocks and over-the-counter sales while leaving retail investors with little visibility into the token's actual circulation. The report claims LAB insiders moved hundreds of millions of tokens through exchanges including Bitget, Binance and Gate.io. ZachXBT linked the activity to prior token manipulation cases involving other crypto projects. ZachXBT alleged that LAB founders altered investor lockup terms without consent, offered deeply discounted OTC token deals and routed funds to personal exchange accounts. ZachXBT urged exchanges to freeze insider profits or delist the token, warning that concentrated insider ownership could continue driving volatile price swings. Ohio Man Gets 9 Years for $10M Crypto Ponzi Scheme An Ohio resident, Rathnakishore Giri, received nine years in prison for running a fraudulent investment scheme that collected at least $10 million from investors. Giri pleaded guilty in 2024 to wire fraud charges tied to a cryptocurrency derivatives operation that prosecutors described as a Ponzi scheme. Federal prosecutors said that Giri falsely promised investors high returns while guaranteeing their principal investments were safe. The prosecutors said that he used the money from new investors to repay earlier participants and concealed a long history of failed investments and financial losses. Court filings also revealed that Giri continued soliciting investor funds even after entering his guilty plea. Regulators previously accused him of operating the scheme through companies including SR Private Equity and NBD Eidetic Capital. Echo Protocol Exploit Drains More Than $800K Bitcoin-focused DeFi platform Echo Protocol suffered an exploit after attackers minted fake eBTC tokens and used them to drain assets from connected lending markets. Security researchers estimate the attacker stole roughly $816,000, although the attacker briefly controlled far larger amounts of counterfeit tokens. Blockchain analysts said the exploiter minted 1,000 eBTC tokens on the Monad network and used part of the balance as collateral on lending protocol Curvance to borrow wrapped bitcoin. The stolen assets were later bridged to ethereum, converted into ether and routed through Tornado Cash. Echo later said the attack stemmed from a compromised admin key tied to its Monad deployment. The protocol said it regained control of the affected keys and burned 955 eBTC still held in the attacker's wallet. Monad and Curvance said their core infrastructure was unaffected, though Curvance paused the impacted market as a precaution. Crypto ATM Scams Cost Americans $388M in 2025 Americans lost $388 million to scams involving cryptocurrency ATMs in 2025, the FBI says. The agency said criminals increasingly direct victims to crypto kiosks, where they convert cash into cryptocurrency and transfer it to scammers. The FBI's Internet Crime Complaint Center received more than 13,400 complaints last year, marking a 23% rise in reports and a 58% jump in losses from 2024. Older adults were hit hardest, with people over 50 accounting for more than $302 million in losses. Texas reported the highest losses at nearly $57 million, followed by Florida with $32.7 million. California, Illinois and several other states also recorded losses in the tens of millions. The authorities said scammers commonly use fake investment offers, tech support fraud and romance scams.