Cryptohack Roundup: Sentencing in $97M Laundering Case

Blockchain & Cryptocurrency , Cryptocurrency Fraud , Fraud Management & Cybercrime Cryptohack Roundup: Sentencing in $97M Laundering Case Also: Zcash Patches Flaw, $32M Humanity Protocol Hack Rashmi Ramesh (rashmiramesh_) • June 11, 2026     Share Post Share Credit Eligible Get Permission Image: Shutterstock Every week, ISMG rounds up cybersecurity incidents in digital assets. This week, a key player in a $97 million laundering scheme sentenced to five years in prison, Humanity Protocol suffered $32 million in losses, Zcash patched a flaw, the European Union targeted crypto platforms tied to Russia, authorities froze $3.8 million in illicit funds and researchers exposed a Trezor chip weakness. See Also: OnDemand | NSM-8 Deadline July 2022:Keys for Quantum-Resistant Algorithms Implementation Washington Man Gets 5 Years for $97M Laundering Scam A Washington man received a federal prison sentence of five years for helping launder nearly $100 million generated by investment fraud schemes that targeted victims with false promises of oil and gas investments. Federal prosecutors said 47-year-old Geoffrey K. Auyeung, of Newcastle, conspired with overseas fraudsters to move stolen funds through a network of bank accounts and cryptocurrency exchanges. Between August 2022 and August 2024, victims sent money to what they believed were escrow accounts for oil storage investments that promised high returns. Auyeung created at least nine business entities to receive the funds and opened 81 bank accounts across 24 financial institutions, along with 19 accounts on eight cryptocurrency exchanges. Investigators said the accounts received more than $97 million in deposits and wire transfers tied to fraudulent activity. After receiving victim funds, Auyeung and his associates funneled the money through multiple accounts, moved it overseas or converted it into cryptocurrencies including bitcoin, ether, USDT and USDC. Much of the cryptocurrency was ultimately sent to Binance accounts controlled by individuals in Nigeria and Russia. Authorities said Auyeung earned at least $4 million in commissions and continued participating in the scheme after his 2024 indictment by using accounts in his wife's name. He pleaded guilty in February. As part of the case, he will forfeit millions of dollars in cash, cryptocurrency and assets. Humanity Protocol Breach Sparks $32M Token Losses A security incident linked to Humanity Protocol resulted in the theft of approximately $32 million worth of H tokens, said onchain analyst Specter. The exploit initially affected 17 wallets holding Humanity's native token, with losses estimated at $5 million. Subsequent analysis showed the damage was larger. Specter said attackers converted about $23.7 million of the stolen assets into ethereum, while roughly $7.9 million remained in H tokens. The cause of the breach is unclear. Specter said that the affected wallets appeared to share a common connection to Humanity Protocol. Humanity founder Terence Kwok later said that private keys belonging to a member of the Humanity Foundation had been compromised and said the team was working with security experts and exchange partners to address the incident. The situation escalated when Specter reported that the attacker had minted 100 million additional H tokens and was selling them for BNB, increasing pressure on the token's price. Blockchain investigator ZachXBT questioned whether the event was a genuine theft, suggesting it could instead be linked to a market maker exiting its position. He said the team's account of the incident was unconvincing. The breach triggered a sharp market reaction, with the H token losing roughly 89% of its value in 24 hours. Humanity Protocol is a decentralized identity platform that uses biometrics and zero-knowledge proofs to verify users without exposing personal information. Zcash Fixes Flaw That Could Mint Fake Tokens A security researcher discovered and helped patch a critical vulnerability in Zcash's privacy-focused Orchard transaction pool that would have allowed an attacker to create unlimited counterfeit ZEC tokens without detection. The flaw was identified by security engineer Taylor Hornby during an independent security review commissioned by Shielded Labs, a Zcash support organization. Hornby found the vulnerability using a combination of traditional security analysis and Anthropic's Opus 4.8 AI model. He reported the issue to engineers at the Zcash Open Development Lab, who patched it on June 1. The vulnerability affected the Orchard circuit, the zero-knowledge proof system that verifies transactions in Zcash's shielded transaction pool. According to Shielded Labs, a flaw in the circuit's constraints allowed attackers to submit false inputs that could still pass validation checks. Hornby demonstrated the issue in a test environment, generating unlimited counterfeit ZEC tokens that would have appeared legitimate within the Orchard pool. The bug had existed since Orchard launched in May 2022, but Shielded Labs said there is no evidence it was exploited in the wild and believes such an attack is unlikely, given the complexity of the vulnerability and the intense scrutiny Zcash has received from cryptographers over the years. EU Targets Crypto Platforms in Russia Sanctions The European Union unveiled new measures that would expand restrictions on cryptocurrency platforms accused of helping Russia evade existing sanctions. European Commission President Ursula von der Leyen announced the measures as part of a sanctions package aimed at increasing pressure on Russia's financial, energy and trade sectors. The package - it needs approval from EU member state governments - would extend transaction bans to 20 non-EU entities, including banks, crypto platforms and oil traders that have conducted business with sanctioned Russian individuals and organizations. For the first time, the EU is also considering a country-level ban on crypto services from non-EU jurisdictions that host platforms used to evade sanctions. The proposal reflects growing concern over crypto's role in sanctions avoidance. Blockchain analytics firm Chainalysis reported that illicit cryptocurrency addresses received $154 billion in 2025, with Russia-linked activity accounting for a significant share of state-backed transactions. The firm cited $93.3 billion in volume tied to the ruble-backed stablecoin A7A5. Earlier this year, Elliptic identified several crypto exchanges that allegedly facilitated sanctions evasion, while U.K. regulators recently sanctioned the exchange HTX over its support for Russian government-related activity (see: Grinex Collapse Won't Dent Russian Sanctions Busting). Global Anti-Scam Operation Freezes $3.8M Private technology companies and the U.S. Department of Justice disrupted cryptocurrency fraud networks operating across Southeast Asia, freezing more than $3.8 million in illicit assets during a coordinated initiative called "Disruption Week." The operation involved Apple, Coinbase, Google, Meta, Microsoft, Silent Push, SpaceX, TRM Labs and Zenlayer, with Meta helping coordinate private-sector participation. Authorities in Thailand arrested seven suspects, while investigators identified additional scammers and fraud platforms for potential prosecution in the United States. Coinbase said it froze more than $3 million in cryptocurrency linked to the criminal networks. Across the broader operation, participants disabled more than 1.4 million accounts, terminated thousands of Starlink internet kits and contributed to 63 arrests. The effort also dismantled servers, hosting services and other infrastructure used to support scam operations. U.S. agencies, including the FBI, Secret Service and Homeland Security Investigations, provided intelligence support. International partners included law enforcement agencies from Australia, Canada, New Zealand, Thailand and the United Kingdom. Attack Exposes Trezor Chip Weakness Ledger's Donjon security team identified a hardware vulnerability in a security chip used in the Trezor Safe 7 hardware wallet, reported The Block. Researchers showed that an attacker with physical access to a device and specialized laboratory equipment could bypass the chip's firmware verification process by using a targeted laser attack. That would allow unauthorized firmware to be loaded and executed on the chip. To demonstrate the flaw, Ledger modified the chip to display the message "Hack" in a basic identification response. Tropic Square, the chip's manufacturer, confirmed that the vulnerability affects all Tropic01 chips currently deployed. The vulnerable chip is only one of three security layers in the Trezor Safe 7 and does not store private keys, wallet backups or user funds. Ledger also did not compromise the chip's hardware-backed secret storage system, known as MAC-and-Destroy, during its initial testing. Tropic Square discovered an additional attack path affecting that protection mechanism and plans to address it in a hardened chip revision expected in late 2026. In the meantime, a firmware update can disable the chip's maintenance mode, making exploitation more difficult.