Chinese National Extradited for $37 Million Crypto Scam; BTCPay Wallets Drained
A Chinese national has been extradited to the U.S. to face charges in a $37 million cryptocurrency investment scam, while a separate incident saw hackers drain funds from BTCPay Server wallets.
A Chinese national, Zhen Zhao, 44, has been extradited from the Netherlands to the United States to face charges in connection with a cryptocurrency investment scam that defrauded 174 Americans of nearly $37 million. Zhao allegedly collaborated with accomplices in the U.S. and Cambodia, using social media, dating platforms, text messages, and phone calls to lure victims into investing in fraudulent cryptocurrency trading websites. These sites falsely depicted growing investment returns to build trust before absconding with funds, which prosecutors allege were moved to a Bahamian bank account, converted to tether (USDT), and sent to Cambodian-controlled wallets. Zhao faces up to 20 years in prison if convicted of conspiracy to commit money laundering, with eight alleged accomplices already having pleaded guilty.
In a separate incident, hackers successfully drained bitcoin and litecoin from users of BTCPay Server who were running outdated software. The company issued an urgent warning for users to update to version 2.4.7, as attackers exploited a security weakness in version 2.4.1 and earlier releases. Investigators are working to understand how the attackers gained administrator access and withdrew funds from hot wallets, which are used for immediate online transactions. BTCPay Server founder Nicolas Dorier stated that the attacks did not target publicly accessible servers and that there have been no credible reports of wallet theft involving the latest release.
Adding to the week's digital asset security concerns, Trezor has alerted customers who purchased hardware wallets from reseller CryptoBilis since March 2026 to move their funds immediately. This warning follows reports of a potential spying device found within a Trezor Safe 5 wallet. The Czech company removed CryptoBilis from its authorized reseller network after previous reports of tampered Ledger wallets. The suspected implant in the Trezor wallet reportedly contains a mobile communication module and antenna capable of capturing screen information, including recovery phrases, and transmitting it remotely. While Trezor has examined other devices from the reseller without finding evidence of tampering, they are offering affected customers replacements and support.
In other news, two Texas brothers, Raymond Christian Garcia and Isiah Angelo Garcia, have been sentenced to approximately 15 years each for a violent cryptocurrency robbery. In September 2025, they held a Minnesota family at gunpoint for nine hours, stealing cryptocurrency valued at $8 million. Isiah forced the father to access his accounts and transfer funds, while the brothers later sought additional cryptocurrency stored on a physical device. Investigators tracked the brothers to their Texas home using evidence such as a Wendy's receipt, motel surveillance footage, and rental car records.
Brazilian cryptocurrency exchange Mercado Bitcoin has also reported a security incident resulting in the loss of approximately $46.3 million in digital assets, according to blockchain analytics firm Arkham. The exchange confirmed the incident, temporarily suspending deposits and withdrawals while investigating the unauthorized transactions. Mercado Bitcoin stated that customer assets and personal information were not affected and published wallet addresses associated with the suspicious transfers to aid tracing efforts. Tether CEO Paolo Ardoino confirmed that the company had frozen over $4.5 million in USDT linked to the incident.
Finally, Polymarket announced it would be issuing refunds totaling $3.9 million, and a former crypto executive reported a $14,000 loss due to a phone theft in London, rounding out a busy week of digital asset security events.