- \n
- Thai investors accused the head of 1000X of a $42m fraud.<\/li>\n
- Co-founder of a $1m crypto pyramid scheme detained in Kyiv.<\/li>\n
- The FBI seized Iranian hackers\u2019 websites after a large-scale attack on the healthcare sector.<\/li>\n
- Nordstrom customers targeted by a crypto scam.<\/li>\n<\/ul>\n<\/div>\n
Thai investors accuse 1000X boss of $42m fraud<\/h2>\n
Thai law enforcers are searching for billionaire and crypto-industry pioneer Worawat Narknawdee, Thai PBS<\/a> reports.<\/p>\n
A case was opened after users of the crypto platform 1000X<\/a> went to the police. The damage is estimated at roughly 1.39bn baht (~$42m at the time of writing). <\/p>\n
In March 2023, SEC<\/span> filed<\/a> a complaint with the Cyber Crime Investigation Bureau, accusing Narknawdee of running 1000X without a licence. According to media reports, before launching his crypto venture he was the lead singer of the rock band DoubleDeep, whose members were active investors. He later founded the Traderist community, where he offered free public education on handling cryptocurrencies.<\/p>\n
Through investments since 2012, the trader amassed about 11,000 BTC. His company ACET became one of the industry\u2019s fastest-growing.<\/p>\n
![\"image\"](\"https:\/\/forklog.com\/wp-content\/uploads\/img-6aa2f1c231df6479-9255249652340579-1024x658.png\")
Worawat Narknawdee listed among Thailand\u2019s top five forex traders. Source: Traders Union<\/a>.<\/figcaption><\/figure>\n However, data from the Department of Business Development revealed another side of his activities. According to Creden Data<\/a>, Narknawdee owns two companies: Bitnance Company (a loss of ~30m baht<\/span>) and Great Begins Company (a debt of ~5.8m baht<\/span>).<\/p>\n
Police say the billionaire fled to the UAE, where he owns property, a hotel business and other assets.<\/p>\n
Co-founder of $1m crypto pyramid detained in Kyiv<\/h2>\n
Ukrainian law enforcement uncovered a ring that appropriated funds under the guise of crypto investments. One of the scheme\u2019s co-founders was detained in Kyiv, reported<\/a> the Cyber Police.<\/p>\n
According to investigators, since 2022 the group built a network of financial pyramids across Ukraine. They urged citizens to invest in their own token, promising steady returns. In practice, payouts came from new investors and were distributed via pyramid or binary commission schemes.<\/p>\n
The founder and his spouse promoted the project on Instagram, with other bloggers amplifying the ads. Losses totalled about $1m.<\/p>\n
Police searched suspects\u2019 residences in Khmelnytskyi, Odesa, Chernihiv and Poltava regions, seizing computer equipment, notes and a car.<\/p>\n
One participant was notified of suspicion of fraud, an offence punishable by up to eight years in prison.<\/p>\n
FBI seizes Iranian hackers\u2019 websites after major attack on the healthcare sector<\/h2>\n
The FBI seized two websites used by the hacktivist group Handala after a destructive cyberattack on medtech giant Stryker, reports<\/a> BleepingComputer.<\/p>\n
There has been no official statement from law enforcement about the seizures. However, the domains\u2019 DNS servers were switched to those the FBI typically uses when taking sites offline.<\/p>\n
![\"image\"](\"https:\/\/forklog.com\/wp-content\/uploads\/img-e57f5cb275dc43f6-9255249146061169-1024x576.png\")
FBI \u2018splash page\u2019 on one of Handala\u2019s sites. Source: BleepingComputer.<\/figcaption><\/figure>\n Media say Handala (also known as Handala Hack Team, Hatef, Hamsa) is an Iran-linked hacktivist group that emerged in December 2023. Its operations are associated with the country\u2019s Ministry of Intelligence and Security. It has targeted Israeli organisations using wiper malware for Windows and Linux.<\/p>\n
The takedowns followed a mass attack by Handala on March 11th 2026. The hackers compromised a Windows domain administrator account and factory-reset about 80,000 devices, including employees\u2019 PCs and mobile phones. The attackers claimed to have stolen 50 terabytes of data before wiping.<\/p>\n
After the incident, CISA<\/span> urged<\/a> US organisations to follow Microsoft\u2019s updated guidance<\/a> to harden defences.<\/p>\n
Nordstrom customers hit by crypto scam<\/h2>\n
In the US, customers of high-end fashion department store chain Nordstrom received scam emails offering to double their crypto-wallet balances, reports<\/a> BleepingComputer.<\/p>\n
Emails promised a 200% return on any cryptocurrency sent to a listed bitcoin address. Victims were given two hours to decide \u2014 a ploy to create urgency. <\/p>\n
The messages appeared to originate from an official sender the company uses for marketing, indicating a security breach. Some customers said the email reached an address that had never been disclosed or leaked online. <\/p>\n
As of March 18th, more than $5,600 had been sent to the scammers in cryptocurrency. According to a blockchain explorer<\/a>, on March 20th the wallet held just 0.00001386 BTC.<\/p>\n
Scammers airdropped TRC-20 tokens posing as the FBI<\/h2>\n
On March 19th the FBI warned crypto investors about a new phishing scheme in which scammers, posing as the agency, distributed fake tokens.<\/p>\n
\n
FBI New York encourages users of the Tron blockchain network to exercise caution if they encounter a token purported to be from the FBI. If you receive a token from an account with the details below, do not provide any identifying information to any website associated with such\u2026 pic.twitter.com\/VF03sjM4VW<\/a><\/p>\n
\u2014 FBI New York (@NewYorkFBI) March 19, 2026<\/a><\/p><\/blockquote>\n