The Texas sheriff’s bold move ignited debates over crypto kiosk regulation and law enforcement authority. He was able to recover $32,000, but critics argue the destruction of private property was unjustified without proof the ATM operator was complicit. This event only added to the growing concerns about crypto ATM fraud, which caused $246 million in losses across nearly 11,000 reported scams in 2024 alone, according to the FBI. Cities like Spokane, Washington, are now banning these machines altogether, due to a disproportionate impact on elderly and low-income victims. Meanwhile, other global threats also continue to rise. Cisco Talos recently uncovered a North Korean-linked malware campaign targeting crypto professionals through fake job offers to steal wallet credentials. Overall, regulators and law enforcement now face increasing pressure to balance protection with due process. Sheriff Recovers Stolen Funds from Bitcoin ATM A Texas sheriff’s unconventional approach to tackling a crypto scam ignited a very heated discussion among digital asset enthusiasts. In Jasper County, northwest of Houston, Sheriff Chuck Havard took matters into his own hands after a local family was duped out of $25,000 by a scammer impersonating a government official. (Source: KDFM ) A crypto ATM is a physical kiosk that allows users to buy or sell cryptocurrencies like Bitcoin using cash or debit cards. Unlike traditional ATMs, these machines connect to a digital wallet instead of a bank account. This allows for quick crypto transactions, often with minimal identification or regulatory oversight. The fraudster reportedly instructed the victims to deposit the funds into a Bitcoin address via a local crypto ATM. To try and recover the money, Havard obtained a search warrant and physically cut open the machine, which was operated by Bitcoin Depot. The was ultimately able to retrieve around $32,000. Some of the recovered money (Source: KDFM ) The sheriff’s actions sparked controversy , particularly online. Crypto users on Reddit questioned whether the sheriff overstepped his authority, and some even compared the move to seizing a store’s entire cash register after a fraudulent transaction. Critics also argued that unless the ATM operator was involved in the scam, the destruction of private property and seizure of funds was unjustified. Havard, however, stood by his decision, and stated that his primary goal was to protect Jasper County citizens from malicious actors and that he would continue to use all available resources to do so. Havard acknowledged that crypto-related crimes are difficult to resolve and confirmed that the scammer responsible for the incident has not been located yet. The event happened during a broader wave of scrutiny directed at crypto ATMs, which are increasingly being used in fraudulent schemes. The FBI reported nearly 11,000 crypto ATM scam complaints in 2024, totaling more than $246 million in losses. This is a 31% rise from the previous year. Australia has also taken steps to limit risk. The country recently capped cash deposits and withdrawals at crypto ATMs to AU$5,000. As the use of these machines grows, so too does the urgency to address the challenges they present in fraud prevention and consumer protection. Spokane Bans Crypto ATMs Spokane, Washington also recently became the first city in the state to ban cryptocurrency ATMs . The move was prompted by a rising number of scams targeting local residents. The Spokane City Council voted unanimously on Monday to approve the measure, which was introduced by Council member Paul Dillon . He pointed to the growing use of crypto kiosks by scammers as a primary concern and believes there is a need to protect vulnerable residents from being exploited. According to Dillon, many of these machines are found in lower-income neighborhoods and retail locations, where victims are often misled by fraudsters posing as authorities or officials. (Source: Spokane City Council ) The ordinance mandates the removal of all existing crypto ATMs within 60 days, or operators could face civil penalties and risk losing their business licenses. The city also plans to monitor the ban’s effectiveness and assess whether it actually leads to a measurable drop in crypto-related crimes. Spokane police detective Tim Schwering addressed the council, and shared cases in which victims were tricked into feeding money into these kiosks under the false belief that it would protect their savings or prevent legal consequences. The transferred funds often end up in overseas accounts in countries like China, Russia, or North Korea, making recovery nearly impossible. Crypto ATM scam reports (Source: FBI ) Troublingly, two-thirds of the victims are over the age of 60 , making this a growing issue among older Americans. As cities like Spokane and Houstin take a hardline stance against crypto kiosks, the broader debate over regulation and consumer protection in the crypto space is picking up steam. North Korean Hackers Target Crypto Job Seekers Crypto users should be on the lookout for other scams as well. A North Korean-linked cyber threat group known as “Famous Chollima,” or “Wagemole,” has been targeting cryptocurrency professionals with a newly discovered malware strain called “PylangGhost.” This is according to cybersecurity firm Cisco Talos . Key points of Cisco Talos’ report The malware is a Python-based remote access trojan (RAT) and appears to be a variant of the previously known GolangGhost RAT. Its primary function is to steal sensitive credentials, including those for cryptocurrency wallets and password managers. The group’s attack method centers around elaborate fake job recruitment campaigns that are specifically aimed at job seekers with blockchain and crypto experience. Most of the victims identified so far are based in India. These campaigns involve creating fraudulent websites that impersonate legitimate crypto companies like Coinbase, Robinhood, and Uniswap. Victims are contacted by fake recruiters and directed to complete skill assessments or tests hosted on these counterfeit platforms. The social engineering tactics extend to fake video interviews, during which the victim is persuaded to enable camera access and run malicious commands under the guise of installing video drivers. Example of fake job responsibilities (Source: Cisco Talos ) Once executed, the PylangGhost malware allows the hackers to gain remote access to the victim’s system. It is capable of stealing cookies and credentials from more than 80 browser extensions, including popular crypto wallets like MetaMask, Phantom, TronLink, MultiverseX, and Bitski, as well as password managers like 1Password and NordPass. Beyond credential theft, the malware can also take screenshots, manage files, exfiltrate browser data, and maintain persistent access to the infected device. Cisco Talos shared that, based on the code's structure and comments, it does not appear that a large language model or AI tool was used in its development. This campaign is the latest in a pattern of North Korean cyber activity using fake job offers to infiltrate the crypto industry. Similar tactics were seen earlier this year in connection with hackers responsible for a $1.4 billion Bybit exploit.
