Daily Check-in: October 28, 2026

RugPull News reported that the Treasury sanctioned 10 individuals and one entity over North Korean IT worker schemes. Russian nationals Boykov and Obertas and a North Korean-controlled center in Russia were targeted for allegedly converting crypto for DPRK IT worker networks. RugPull News also reported that a Miami federal judge sentenced Trenton Johnston, 20, of Canada to 25 months after he pleaded guilty to money laundering conspiracy tied to stolen crypto, in a $13M crypto impersonation theft. About $3.8M was surrendered. In a third article, RugPull News reported that the FBI seized the domain virtualine.net on October 27, 2026, the domain of the Virtualine bulletproof hosting provider, in an action with German, Dutch and UK authorities. Blockchain analysts tie the provider's Bitcoin inflows to ransomware, drug sales and sextortion. According to DefiLlama, a tranche vault tied to Fence Finance and Valinor Digital was exploited on October 27, 2026, via flash-loan share inflation. An attacker used a flash loan to obtain an inflated allocation of vault shares and then redeemed about $1.01 million in USDC. The loss was put at about $1.01 million "so far" across roughly two transactions, on Avalanche, per Blockaid's alert. The alert did not say which entity operates the vault, and neither company had commented publicly at the time of writing. According to The Crypto Times, CoinDCX warned users on October 27 of an active phishing campaign using fake emails and notifications that urge recipients to click links or connect wallets. The exchange said it is investigating, reported no confirmed data breach, and said other exchanges had reported similar activity. CoinDCX said it will not ask for private keys, recovery phrases or one-time passcodes, and will not send links asking users to withdraw funds. The warning follows its October 25 disclosure of a separate $15.99 million loss tied to a retired wallet. Readers can protect themselves by never clicking links in unsolicited emails or notifications that claim to come from an exchange, and by never connecting a wallet or sharing private keys, recovery phrases or one-time passcodes in response to such a message. Instead, they should open the exchange's official site or app directly.