Pocket Bitcoin said on Sept. 3 that its August security incident exposed additional personal and financial information involving 5,411 customers, expanding the scope described in its initial disclosure.

The Swiss Bitcoin services provider identified two distinct groups after completing its forensic investigation. One contained bank transaction information involving 5,120 customers. The other covered correspondence containing potentially more sensitive records from 291 customers.

Pocket Bitcoin breach exposed two data groups

The larger group consisted of transaction lists that partner banks sent to Pocket Bitcoin during compliance checks. Those lists contained customer names, residential addresses, transfer amounts and transaction dates. Some also included the IBAN connected to a transfer.

The smaller group involved correspondence Pocket Bitcoin sent to partner banks. Depending on the customer, the exposed material included names, postal addresses, public Bitcoin addresses, identity document copies and source-of-funds records.

The company said the information appeared in different combinations, meaning every customer in the 291-person group did not necessarily have every listed data type exposed. Pocket Bitcoin has contacted affected customers individually with details about their cases.

The two groups cover 5,411 customers combined. Other customers may have had email addresses or support conversations exposed under the company’s original disclosure, but Pocket said those without a new personal notification should continue relying on that initial notice.

Core databases and customer Bitcoin were unaffected

Pocket Bitcoin said attackers did not compromise its main customer or transaction databases. Instead, the records came from correspondence and bank-generated lists stored in a copied backup within the affected support system.

This distinction explains why data resembling transaction and identity records was exposed even though the underlying databases remained secure. The affected support material contained copies of information produced or received during regulatory compliance procedures.

Pocket Bitcoin operates as a noncustodial service and does not hold customers’ private keys. The company said Bitcoin balances were never accessible to the attacker, while buying and selling services continue to operate normally.

A disclosed Bitcoin address cannot authorize a transfer. However, linking a public address to a customer’s identity may allow another person to inspect its visible blockchain activity. Pocket noted that moving Bitcoin cannot erase the address’s existing transaction history.

Exposed records create physical phishing risks

Pocket Bitcoin said it currently has no indication that the exposed information has been misused. That statement reflects information available after its investigation and does not guarantee that misuse will not occur later.

“As things stand, we have no indication that any of the affected information has been misused,” Pocket Bitcoin said.

The company identified forged letters and other physical communications as particular risks because names and postal addresses were included. A fraudster could refer to a genuine bank transfer or Bitcoin transaction to make an impersonation attempt appear credible.

Email addresses and login credentials were not linked to the two newly identified data groups, according to Pocket Bitcoin. The company therefore said it does not see a direct targeted email-phishing risk arising specifically from those records.

The incident follows several disclosures involving customer information held outside core crypto systems. As crypto.news reported, three recent breaches exposed 253,487 records, raising concerns that residential and transaction data could support phishing or physical targeting years later.

A separate August incident at Bits of Gold potentially exposed customer identity, banking and wallet information through a third-party system. That investigation similarly found that customer funds and passwords remained unaffected.

Pocket Bitcoin notified regulators and police

Pocket Bitcoin reported the incident to Switzerland’s Federal Data Protection and Information Commissioner and Liechtenstein’s Data Protection Office. It also filed a police report but did not identify the suspected attacker or provide details about the investigation.

The company said the vulnerability behind the incident has been closed and additional safeguards have been installed. It is reviewing how bank correspondence and related compliance records are stored and transferred.

Pocket expects to publish more information about those changes in the coming weeks. It does not expect to identify further exposure categories, although it said it would notify customers if later findings changed that assessment.

Affected users should monitor bank activity and treat unexpected letters, calls or messages cautiously. Pocket Bitcoin said it will never ask customers to disclose a seed phrase or transfer Bitcoin through an unsolicited telephone call or letter.

Notional Finance may have suffered a $1.7 million exploit involving an escrow contract, blockchain investigators reported on Sept. 4. The reported losses include approximately $69,242 in DAI and $1.66 million in USDC.

Security firm PeckShield cited findings published by blockchain investigation group Specter. Neither report provided a complete technical explanation of how the assets left the contract.

“The Notional Finance escrow contract may have been exploited,” PeckShield said, preserving uncertainty about the incident’s status.

Notional Finance exploit report identifies two addresses

Researchers identified two Ethereum addresses allegedly connected to the movement of the assets. The first address is 0xC954…De69, while the second is 0xDaCC…Ce38.

The addresses were labelled as theft addresses by Specter. That description remains an investigator attribution rather than a finding confirmed by Notional Finance, law enforcement or a court.

The available reports do not identify the precise escrow function involved. They also do not establish whether the event resulted from a smart-contract vulnerability, compromised credentials, faulty permissions or another cause.

Stablecoins were reportedly converted into 689.2 ETH

The suspected attacker reportedly exchanged the DAI and USDC for approximately 689.2 ETH. The Ether was then deposited into Tornado Cash, according to Specter and PeckShield.

Tornado Cash is a set of Ethereum smart contracts designed to reduce the visible connection between deposits and later withdrawals. Its use can complicate blockchain tracing, although depositing assets into the protocol does not independently prove criminal ownership or intent.

The rapid conversion of stablecoins may also reduce opportunities for issuers or centralized platforms to restrict the assets. Both DAI and USDC can be followed publicly before conversion, while subsequent withdrawals from a mixer become harder to associate with the original address.

In related coverage, crypto.news reported that an address tied to the Drift Protocol exploiter moved $44 million through Tornado Cash after remaining inactive for several months.

No technical cause or official response is available

Notional Finance had not published a public incident report or confirmation through its official account when checked. The project had also not disclosed whether contracts were paused, whether remaining assets were secured or whether users needed to take protective action.

The lack of confirmation means the reported $1.7 million loss should remain described as preliminary. It is also unclear whether the affected assets belonged directly to users, the protocol treasury or another party using the escrow contract.

No verified market reaction can be attributed to the report. Without an official assessment, linking token-price movements or changes in deposited value directly to the suspected exploit would be premature.

Previous recoveries depended on rapid containment

DeFi projects commonly respond to suspected exploits by pausing vulnerable contracts, contacting stablecoin issuers and exchanges, tracing connected wallets and offering return agreements. Those options can become more limited after assets enter privacy protocols.

Some projects have still recovered positions or protected unaffected products after an attack. As crypto.news reported, Term Labs recovered its affected fixed-rate positions following an $8.5 million governance exploit, although several products remained closed.

Stake DAO also secured its Ethereum backing and closed a bridge after an unauthorized minting incident, according to related coverage. Those cases involved direct project responses that are not yet available for Notional Finance.

Meanwhile, Notional Finance operates as an Ethereum-based lending protocol focused on fixed-rate, fixed-term borrowing. Its documentation explains that deposited currencies can support borrowing obligations denominated in other currencies. 

This makes contract-level accounting and collateral controls central to maintaining solvent user positions. However, researchers have not established whether the reported escrow incident affected Notional’s primary lending system, a separate integration or an older contract.

DAI and USDC have long formed part of Notional’s supported lending markets. The protocol’s technical materials describe currency pairs connecting those stablecoins with their interest-bearing equivalents. 

The reported loss therefore involves assets used within Notional’s broader lending architecture, but the available evidence does not show that open loans, collateral balances or fixed-term positions were affected. An official contract identification is needed before the exposure can be measured accurately.

What happens next for Notional Finance

The next confirmed update would likely need to establish which contract was involved, how the transactions were authorized and whether other funds remain exposed. A post-mortem could also clarify the ownership of the lost assets.

Investigators may continue tracking any Ether withdrawn from Tornado Cash. Exchanges and blockchain analytics companies could monitor later transactions, but the reported mixer deposits make attribution and recovery more difficult. Until Notional publishes an assessment, the scale, cause and effect on users remain unresolved.

Hargreaves Lansdown opened access to nine Bitcoin and Ether exchange-traded notes on Sept. 3, bringing regulated cryptocurrency exposure to eligible users of the United Kingdom’s largest retail investment platform.

The products come from BlackRock’s iShares, WisdomTree, 21Shares, Invesco, CoinShares and Bitwise, according to a Financial Times report. The issuers charge annual product fees ranging from 0% to 0.35%.

Hargreaves Lansdown serves approximately two million investors. However, the crypto ETNs are only available through its Advanced Investing service and are not automatically accessible to every customer.

Hargreaves Lansdown adds crypto after long delay

The launch comes almost 11 months after the Financial Conduct Authority ended its four-year restriction on retail access to qualifying crypto ETNs. Other major British investment platforms had already introduced the products.

Hargreaves Lansdown initially adopted a more cautious position. In October 2025, the platform told investors that “Bitcoin is not an asset class,” while acknowledging that some customers might still want speculative exposure.

Doug Abbott, Hargreaves Lansdown’s chief product officer, said the platform delayed its launch to ensure client testing and safeguards were properly designed. He said customers should understand the products and encounter the “right level of friction” before investing.

The company’s current crypto ETN page warns that the instruments are volatile and high risk. It says investors could lose all the money they commit.

Investors face eligibility checks and a waiting period

Customers must first self-certify as advanced investors. They must then complete an online appropriateness assessment designed to test whether they understand the products and associated risks.

Eligible customers must also complete a 24-hour cooling-off period before viewing the available ETNs. They need either a Fund and Share Account or a self-invested personal pension to buy, hold or sell the instruments.

Hargreaves Lansdown charges a 0.35% annual platform fee for holding crypto ETNs, capped at £12.50 per month. Dealing charges range from £3.95 to £6.95, depending on the customer’s trading frequency. These charges are separate from each product’s management fee.

The notes trade during London Stock Exchange market hours. They do not provide continuous 24-hour trading like cryptocurrency exchanges.

Crypto ETNs provide exposure without direct ownership

Crypto ETNs are listed financial instruments designed to follow the price of an underlying digital asset. Investors purchase a note issued by a financial institution rather than buying Bitcoin or Ether directly.

The issuer arranges custody of the underlying cryptocurrency. Customers therefore do not control private keys, manage wallets or withdraw the digital assets represented by their investment.

This structure introduces risks that differ from direct cryptocurrency ownership. Investors depend on the issuer, custodian, trading venue and investment platform. Product fees and market spreads may also cause returns to differ from movements in the underlying asset.

Crypto.news previously reported that BlackRock listed its Bitcoin product on the London Stock Exchange after the retail restrictions changed. The listing was among several products introduced as regulated providers prepared for wider individual access.

FCA rules restrict how platforms offer crypto ETNs

The FCA lifted its retail prohibition on qualifying crypto ETNs on Oct. 8, 2025. Products must appear on the regulator’s Official List and trade through a recognized U.K. investment exchange.

The regulator classifies the products as restricted mass-market investments. Its official guidance requires appropriateness assessments, customer categorization, cooling-off periods and prominent risk warnings.

Platforms cannot offer incentives encouraging customers to invest. They must also identify an appropriate target market and take reasonable measures to prevent foreseeable consumer harm.

As crypto.news reported when the policy was announced, the FCA reopened retail access while keeping crypto derivatives prohibited. The regulator said investors would not receive the same protections available for conventional regulated investments.

Demand remains an open question

Hargreaves Lansdown said it had received a consistent level of customer enquiries about crypto ETNs, particularly from experienced investors. That interest has not yet established how many eligible clients will invest.

Other platforms have described British retail uptake as modest. Restrictions preventing newly purchased crypto ETNs from being held in conventional stocks-and-shares ISAs may also limit demand.

The launch nevertheless gives Hargreaves Lansdown customers a regulated route to Bitcoin and Ether price exposure without opening an exchange account. Future adoption will depend on investor demand, cryptocurrency prices and whether the available product range expands.

Scammers running crypto-related “investment” fraud operations are increasingly the target of coordinated international policing, with the United States and the United Kingdom announcing a new cross-border law enforcement partnership designed to disrupt organized scam centers.

On Thursday, the US Department of Justice (DOJ) said the US Attorney’s Office for the District of Columbia, the Crown Prosecution Service for England and Wales, and the UK National Crime Agency signed a memorandum of understanding to enable “first-of-its-kind” cooperation against scam centers involved in crypto and cyber-enabled investment fraud. The DOJ also linked the effort to a growing volume of losses attributed to these crimes, citing FBI Internet Crime Complaint Center reporting.

Key takeaways

• The US and UK have signed a memorandum of understanding to run parallel investigations into cross-border scam center targets tied to crypto and cyber-enabled investment fraud.
• Under the agreement, agencies plan to share information on organized crime syndicates and coordinate which jurisdictions should prosecute specific cases.
• The DOJ says an early October in-person disruption operation is planned in London with private-sector partners.
• The new pact builds on the DOJ’s “Scam Center Strike Force,” created to target organized networks linked to scam centers operating in parts of Southeast Asia.
• US-reported losses from crypto investment fraud have risen sharply, according to DOJ figures referencing FBI Internet Crime Complaint Center data.

A US-UK framework for joint investigations

The memorandum of understanding announced by the DOJ formalizes how agencies from both sides of the Atlantic will investigate shared targets. According to the DOJ, the participating authorities will conduct investigations in parallel into overlapping scam center cases, exchange information about organized crime syndicates, and discuss which jurisdictions are best positioned to pursue prosecutions.

The DOJ said authorities have already identified overlapping cases and intend to take further steps that move beyond information sharing—specifically, an in-person disruption operation in London scheduled for early October. The plan includes collaboration with private-sector partners, reflecting the reality that many crypto fraud ecosystems rely on services, infrastructure, and payment channels that sit outside traditional law enforcement boundaries.

This type of coordination matters because scam centers often operate as part of wider networks. Victims can be recruited online, funds can be routed across multiple platforms and jurisdictions, and enforcement challenges multiply when different stages of the scheme fall under different legal systems. By aligning investigative work, the US and UK aim to reduce the “handoff gaps” that criminals exploit.

Why the crackdown is accelerating

The DOJ’s announcement comes alongside escalating reported losses tied to crypto investment fraud. In its statement, the agency pointed to FBI Internet Crime Complaint Center data indicating US losses rose 89% from $4.57 billion in 2023 to $8.65 billion in 2025. The implication for readers is straightforward: while enforcement actions continue, the scale of the harm—at least as measured through US reporting—has been increasing rapidly.

Just as importantly, the DOJ’s focus is not limited to isolated hacking or single-offender schemes. The agency tied the new cooperation to scam centers—physical or semi-physical operations that enable large-volume fraud, often using fraudulent websites, fake “investment” platforms, and other cyber-enabled recruitment methods. These operations can persist for long periods if criminals can rotate locations, compartmentalize teams, or move money through layers that are difficult to unwind quickly.

Expansion of the Scam Center Strike Force

According to the DOJ, the agreement expands the “Scam Center Strike Force,” an initiative US Attorney Jeanine Ferris Pirro launched in November 2025. The strike force is described as targeting Chinese organized crime networks that operate scam centers primarily in Southeast Asia, where schemes can include crypto investment fraud and are frequently linked, according to the DOJ, to human trafficking and money laundering.

The strike force includes a broad range of US agencies: the FBI, US Secret Service, Internal Revenue Service Criminal Investigation, and Homeland Security Investigations, along with Justice Department components. The DOJ said it also coordinates with the US Treasury and State departments and works with private companies to disrupt scam operations and recover victims’ funds.

That mix of responsibilities—investigation, financial accountability, and victim recovery—reflects the structure of many crypto investment fraud cases. Even when scams originate through social engineering or fake platforms, the proceeds often move through financial rails that require different expertise to identify, freeze, and trace.

Other international actions and tougher domestic proposals

The US-UK memorandum fits into a broader pattern of cross-border activity targeting scam operations connected to crypto fraud. The DOJ previously highlighted an operation led by Dubai police, working with the FBI and China’s Ministry of Public Security, which it said took place on April 29. That effort resulted in 276 arrests and the closure of at least nine crypto scam centers, according to the DOJ. The DOJ’s earlier report also said six people were charged over alleged schemes using fake crypto investment platforms to solicit deposits from victims.

Meanwhile, enforcement pressure is also showing up in domestic legislation in parts of Southeast Asia. According to earlier coverage cited in the DOJ-related article, Myanmar’s military government released draft legislation on May 15 proposing sentences ranging from 10 years to life for digital currency fraud, with the death penalty possible where victims coerced into working at scam centers were killed. That bill, according to the same coverage, was approved by Parliament on July 28, though presidential assent had not been confirmed at the time.

Taken together, these developments suggest a gradual tightening of both investigation coordination and legal deterrence. For investors and users, the practical takeaway is not that fraud will disappear quickly, but that authorities are increasingly treating crypto-enabled investment scams as a cross-border organized crime issue rather than a series of isolated cyber incidents.

What to watch next

The immediate next milestone is the planned early October in-person disruption operation in London, alongside the information-sharing and parallel investigation mechanics outlined in the US-UK memorandum. As authorities continue to align cases across jurisdictions and work with private-sector partners, victims and compliance teams should expect more coordinated takedowns—and also pay close attention to how governments define responsibility across the entire fraud pipeline, from recruitment to money movement to platform infrastructure.

El Salvador has provided documentation showing that its Bitcoin accumulation since June 27, 2025, came from private donations rather than public resources, according to the International Monetary Fund.

The disclosure appeared in a Sept. 3 IMF statement announcing a staff-level agreement covering the combined second and third reviews of the country’s Extended Fund Facility.

The IMF said it also reached an understanding with Salvadoran authorities that no further Bitcoin accumulation beyond the documented donations is expected. The announcement does not identify the donors or specify the amount of Bitcoin received privately.

El Salvador Bitcoin records address funding questions

The latest disclosure helps explain apparent increases in wallets associated with El Salvador’s Strategic Bitcoin Reserve. Those increases had raised questions about whether the government was continuing to purchase Bitcoin despite its IMF commitments.

The IMF said Salvadoran authorities supplied documentation verifying that the accumulation recorded after the first EFF review reflected private donations. It stated that no public money financed those additions.

The distinction matters because blockchain records can show assets entering a wallet but do not automatically identify whether they came from purchases, internal transfers or donations. Crypto.news previously examined how government wallet movements can create misleading impressions of sovereign Bitcoin purchases.

In July 2025, IMF documentation said the total amount held across government-controlled wallets remained unchanged. It explained that some reported increases reflected Bitcoin consolidation among different state-controlled addresses.

Earlier crypto.news reporting also found that daily Bitcoin purchase claims conflicted with IMF program disclosures. The new documentation introduces private donations as the source of accumulation recorded after June 27, 2025.

IMF agreement could release another $140 million

IMF staff and Salvadoran authorities reached their agreement following the combined second and third EFF reviews. The arrangement remains subject to approval by the IMF Executive Board and completion of agreed prior actions.

If those requirements are met, El Salvador would receive approximately $140 million, equivalent to SDR 101.96 million. The IMF approved the 40-month EFF in February 2025 with total access of approximately $1.4 billion.

The country has received SDR 172.32 million under the program so far. The IMF described the latest agreement as preliminary because its Executive Board has not approved the reviews or authorized the additional disbursement.

The Fund said El Salvador’s economic activity had exceeded earlier expectations. It projects real gross domestic product growth of 4.5% in 2026, supported by investment, consumption, remittances, tourism and capital inflows.

That forecast remains subject to economic conditions. IMF staff also called for continued fiscal consolidation, stronger governance and a reduction in public debt toward 80% of GDP by 2030.

Chivo wallet moves under private control

El Salvador has substantially reduced public participation in Chivo, the electronic wallet introduced alongside its Bitcoin policy. Majority ownership and operational control have been transferred to an unidentified private operator.

The government retained a minority stake and custodial responsibilities for customer assets. The IMF said authorities were also working to improve transparency surrounding Bitcoin held across different wallets.

The transfer follows prolonged discussions over reducing the government’s direct role in crypto services. As crypto.news previously reported, negotiations over Chivo formed part of the wider IMF funding arrangement.

Under the original EFF conditions, El Salvador made private-sector Bitcoin acceptance voluntary, required taxes to be paid in U.S. dollars and limited public-sector participation in Bitcoin-related activities.

No further Bitcoin accumulation is expected

The IMF said it reached an understanding that El Salvador would not accumulate more Bitcoin beyond the documented private donations. The wording describes an expectation under the staff-level agreement rather than an independently enforceable ban announced by the Fund.

“Going forward, no further Bitcoin accumulation beyond the documented donations is expected,” IMF staff said.

The two sides also agreed to pursue changes to El Salvador’s legal, regulatory and supervisory framework for digital assets. Planned work includes strengthening governance and risk controls for crypto assets held by the public sector.

The Executive Board must now consider the staff report. Until it approves the reviews and El Salvador completes the required actions, the additional $140 million remains unavailable.