A project claimed to represent “the first organic neuron Bitcoin miner based on the fly brain” has gone live. Yes, this is a cryptomining project that leans on the fruit fly connectome recently shared by Google. FutureBit, the company behind the Apollo series of ASIC miners, introduced the world to its HashFly this week. However, HashFly is merely a proof of concept for now.

If you open the dedicated HashFly site, you can also participate in this agitation of fruit fly brains in the (vain) hope of a crypto payout. I clicked the 'Mine' button and left it running for an hour, for science, and periodically flipped back to the tab to see the gently rotating fly brain’s neuron traces firing. Looking at the website overlay, one can see the web app represents “2,914 traces firing” within the fly’s brain. It is worth mentioning that this figure is just a small subset of the full 165,122 reconstructed neurons in the MaleCNS v1.0 fruit fly connectome.

We understand that FutureBit’s HashFly focuses on the simulated photoreceptors that would usually sense light in the fly’s eye. These read a block header, and neurons called PPL101 cells light up when a double-SHA-256 target is computed. You can make the target harder and easier by adjusting the ‘zeros’ up and down. Even at maximum difficulty in this proof of concept (level 6), it is far, far easier than finding a real Bitcoin hash, and I saw about 80 blocks checked off in an hour or so.

What’s the point of this proof of concept? According to its designers, it provides some more insight into the potential efficiency of organic computing, or wetware. “Fun fact,” teases FutureBit. “If this could be scaled on real organic neurons, it would hash at ~ 1 watt per terahash... 10x the efficiency of the best silicon 3nm ASICs!” These guesstimates are based on “total power used by the fruit fly, and assuming all neurons could be used to hash Bitcoin functions and continually keep firing,” says the Bitcoin mining hardware maker in a follow-up tweet.

Those who find this experiment interesting may be happy to hear that the HashFly demo will be scaled up to its logical conclusion. “We are working on simulating all neurons in the dataset with the sha256 hash function and will publish all our findings,” says FutureBit. It certainly needs scaling up if my HashFly web performance of ~100 kH/s is typical. Compare that to the firm’s 5-inch cube Apollo III, which is claimed to deliver “up to 18 TH/s of Hashpower.”

We’ve seen a few other fly brain connectome mapping-inspired projects from the fevered minds active on social media over the last week or so. Almost immediately after Google announced it had published the complete brain and central nervous system of an adult male fruit fly, we saw people seeing if it could play Doom, indulge in financial day trading, and many more frivolous pursuits.

There’s even a rival cryptomining scheme dubbed the FlyMiner. Visiting this portal, you can see a fruit fly connectome that has been put under the control of an ASIC miner. Visiting that site will also be limited to a brain-nourishing, not money-spinning, activity, as FlyMiner admittedly has “almost zero chance” of mining success.

Symbiosis is one of the many useful DeFi networks that let users trade across almost any crypto pair without having to talk to an exchange. It's been operating for five years, and links some 50-odd chains together. The ecosystem's reliance purely on smart contracts (code that's hosted on the blockchain, visible to anyone) is fully logical but paradoxically creates an accountability problem. This was demonstrated on September 11, when Symbiosis got hacked to the tune of at least $770,000, or 9.97 BTC.

Smart contracts are published on the blockchains themselves and are open-source by definition. This means anyone can find a bug, and Symbiosis' thief found two: an undisclosed privilege escalation exploit that let them fake network administrator privileges, plus a Coding-101 failure of not checking if a transaction fee was a positive number.

The method was simple: being an admin, the thief set the transaction fee to a negative value, then issued 12 transactions. With the transaction fee now negative, instead of deducting from the moved amount, it added to it. The thief only spent 330 satoshi (the smallest unit of BTC), about 25 cents, but he managed to issue 46 billion syBTC — BTC wrapped in Symbiosis' network. For reference, the maximum theoretical amount of BTC in circulation is 21 million.

These syBTC tokens meant nothing by themselves as they weren't backed, but they were tradable. And trade the thief did, selling syBTC against matching wrapped pairs including BTCB, cbBTC, WBTC, and RBTC, draining those pools, and causing $770,000 worth of BTC in damage. It's known that they only converted about $336,000 into cash via Uniswap before being cut off.

The rest of the wrapped BTC tokens were flagged by security firms and exchanges, making it difficult for the thief to use. That's of little comfort for the victims, though, until such time as the thief returns the tokens by themselves or by law. Some of them, like Coinbase's cbBTC, are issued by centralized entities and can be nullified and re-minted after a legal process, but others like RBTC cannot.

For the uninitiated, DeFi (decentralized finance) pools can be broadly described as automated trading pots. They run on existing blockchain networks like Ethereum or Solana, via smart contracts, and let users trade directly against the money in the pool, with no third party in between. Depositors providing liquidity to the pool get a cut of transaction fees whenever other users trade for it.

Example: lock 1 ETH, and you get a small amount whenever someone buys or sells ETH, effectively netting you "interest" on held currency with next to zero effort. The trader didn't have to interact with anyone: just with a piece of code, the smart contract. To make the transactions work, DeFi networks "wrap" other tokens in their own variations, like BTC turning into syBTC.

Symbiosis says it intends to repay the incurred debts, stating that "a portion will be returned from the evacuated funds, and each LP will be offered an individual compensation plan." In practice, this ultimately means that Symbiosis is going to talk to the big wrapped-BTC holders in its pool and offer them an IOU, interest-bearing debt package, or some variation/combination thereof. In these situations, it's somewhat expected, but not guaranteed, that big holders take the deal, as forcing liquidation would end the network entirely and net them pennies on the virtual dollar.

The project also said it's going to rewrite the Bitcoin-side logic and has requested an independent audit before implementing the new code. Likewise, it claims it requested a full audit of the "entire system." Symbiosis also says that "capable AI models have lowered the cost of finding bugs like this," a perfectly valid argument — and yet one that isn't likely to find much purchase given the code's high-risk nature involving money, plus the base fact that someone missed a basic negative-value check in only what's likely only a few thousands lines of code total.

The country of Venezuela has had a few embattled decades, but it has massive oil reserves continually attracting buyers, despite the U.S.-led sanctions that effectively block dealings with the nation. A few years back, in 2023, Poland's state-backed Orlen energy group had $600m in hand and was looking to buy 6 million barrels during a sanction reprieve. Like many before him, one executive thought it expedient to use the USDT stablecoin cryptocurrency (1 USD = 1 USDT). It didn't end well, with $230 million worth of crypto unaccounted for at multiple stages in an adventure chronicled by the Financial Times.

The twisted web of transactions

Orleen enlisted an external company, Hannon, to take care of the purchase, which it did by enlisting the services of UK firm Lexcor Energy, which supposedly had a Venezuelan office. Hannon first needed to convert a large sum into USDT, and did so by exchanging $245m at multiple Dubai companies, adding $15m of its own to the deal. Only one of multiple transfers of $80m into 80m USDT was fully successful.

As for the other two, $135m exchange only produced 85m USDT out the other end, with $50m still unaccounted for. A third exchange of $30m also vanished (partially returning much later). The proverbial PNL is currently -$80m, and Hannon has 165m USDT in hand. All this while, three Polish oil tankers headed to Venezuela anchored there, continually racking up millions in demurrage and port fees, as they were being chartered for far longer than initially agreed.

Weeks of delays followed, which Hannon pinned on Venezuelan energy company PDVSA. One of Hannon's reps, Kam Tse, headed to Venezuela himself with a colleague, loaded with the USDT, stored in multiple cold wallets on USB sticks. They stayed in high-end hotels, drove around in armored cars, and employed bodyguards out of concern for the money and themselves. Tse found many brokers claiming to be from PDVSA, a cadre later revealed to contain a substantial number of con-men, many of whom fled as a local investigation came cracking down.

The buyers were nevertheless undeterred, and they handed 60m USDT in a USB wallet to a purported representative of local energy corp Synergy. After a few weeks of waiting, a Venezuelan office sent him a picture of a purported PDVSA export schedule displaying all three Polish tankers set to be loaded with 1.9m barrels of oil each, but with no predicted date. Ever-trusting, Tse's team then handed Synergy's representative another 50m USDT on another USB wallet. Said representative vanished in a cloud of smoke. PNL currently sits at -$190m.

Seemingly desperate, Tse ordered a buy of 1 million barrels of a lighter blend of oil, eventually finding it contaminated, then switched tactics to acquiring fuel oil instead, signing a contract. At last, a break: some of the money spent in the Dubai exchanges came back; only 21m USDT out of a $30m input, but still better than zero. Tse pays Consulting Services, another Venezuelan firm, 11m USDT for the fuel.

Finally, some good news: 500,000 barrels confirmed loaded onto the one ship, half of the contracted amount. Tse provides Consulting Services with another 11m USDT for the rest of the fuel, but that was never delivered, and there was no further contact. Cumulative PNL = -$186m total. With $72m in shipping costs in total (far outweighing the expected profit), plus additional expenses, the Polish government's investigation pins the total lost and spent at $424m.

The aftermath

Many folks' gut reaction may be that the use of cryptocurrency made the cash untraceable, but the problem isn't with the blockchain. In fact, for the vast majority of currencies, the on-chain ledger offers more visibility into transactions, not less. What failed here was the lack of official records linking wallets to persons or entities.

Reputable exchanges all have a form of identity verification, known as KYC, mandated by law. The problem is that apparently almost no entities Hannon traded with had any recognizable proof their crypto wallets belonged to them. The Venezuelan crude oil salesmen vanished, effectively cutting off nearly every avenue for investigation. Before their exchanges, they had even advised Tse to not keep records of their transactions due to the government's investigation into their collective's dealings.

Even in Dubai, pending court cases regarding the dollar-to-USDT exchanges hinge on the same problem, despite the presence of verifiable bank transactions. Broadly speaking, the country's legal system places the burden of proof fully on the accuser, making them prove wallet ownership before discussing the meat of the dispute. That's quite the high bar to clear for Hannon in order to prove that it wasn't handed the funds from the exchanges.

That task may well prove impossible, since one can't prove a negative when there's nothing linking the exchange to their wallet. Adding insult to injury, the two exchanges in the court were both recently created, and probably weren't a part of Dubai's VARA program for legal crypto operations. Caveat emptor.

There is increasing evidence that Mexican drug cartels are diversifying into cryptocurrency mining and are using crypto platforms to diversify their income and, at the same time, launder their ill-gotten gains and fund other illegal activities. Reuters reports that local Mexican police uncovered a clandestine cryptocurrency farm in Tlaola, a town located in the leafy mountains of Puebla's Sierra Norte region. They found 300 GPUs, electricity infrastructure, and satellite equipment. The electricity-hungry operation likely drew power by secretly tapping into the grid at Presa de Necaxa, a nearby hydroelectric dam.

While this latest hidden facility found by police may seem small, Reuters notes it is the fourth such crypto farm Mexican authorities have uncovered in this region since early last year. According to a Mexico-based security analyst, the crypto farms discovered show that the cartels are increasingly sophisticated in their operations. In the latest bust, the Mexican federal authorities, the Navy, and state police seized around 300 GPUs, 80 medium-voltage terminations, a transformer, and eight satellite antennas.

It might not be surprising to hear about the Mexican cartels being tied up in crypto. Blockchain analytics firm Chainalysis, as cited by Reuters, reckons illicit crypto transactions grew from $59 billion in 2024 to $154 billion last year. The firm links the surge recorded to sanctions evasion involving governments. However, in South America, cartels are increasingly interested in using this channel to launder money. The mining operations are also integrated into the scheme, as stealing electricity is easy for organized crime. Mainstream consumer GPU mining ended in H2 2022, flooding the market with used graphics cards.

The source report doesn’t say how authorities found the crypto farm. Perhaps locals in this remote area of Puebla alerted authorities to the operation. Two folks from neighboring communities told Reuters that they could hear the crypto farm noise (transformers, cooling) from a kilometer away (0.6 miles), and the place was apparently a mere 2 km (1.2 miles) from the nearest village. The other three recently uncovered crypto farms were also near the same HEP dam, it is noted. Tlaola is a small community with around 20,000 inhabitants, so the noise levels and power consumption of crypto farms are very perceptible even if the cartels try to hide them deep in the mountains.

Remote communities, such as Tlaola, are popular locations for clandestine crypto farms because the electricity is cheap and most of them are under the protection of the cartels. For example, the Cartel Jalisco Nueva Generación (CJNG) and its armed branch, La Barredora, have the strongest presence in Puebla.

According to SILIKN, a Mexican cybersecurity firm, the use of cryptomining to launder illegal money rose by at least 55.8% last year in México. Drug cartels such as the Cartel de Sinaloa and the CJNG have set up crypto farms to mine Bitcoin (BTC), Monero (XMR), and Tether (USDT).

Similarly remote, illicit cryptomining facilities exist around the world, with Reuters recalling news of raids in Brazil, the U.S., and Thailand. Do you think there’s one near you? Please call the local police and liberate those stressed GPUs. Meanwhile, analysts expect crypto-related crime will reach new heights in the coming years.

The ringleader of a cybercrime gang, which reportedly formed after meetups in Minecraft online, has pleaded guilty to a racketeering charge. Sentencing is yet to be finalized, but 22-year-old Singaporean and Miami resident Malone Lam could face 20 years behind bars. Lam is accused of helping to steal and launder hundreds of millions of dollars in cryptocurrency. Here are the full United States District Court for the District of Columbia documents (PDF), via The Register.

According to the court documents, Lam visited the U.S. to meet fellow Minecrafters Jeandiel Serrano and Veer Chetal, for the first time in real life, in 2023. Soon, Lam’s role in the cybercriminal gang seems to have become an important one. The Singaporean reportedly found high-net-worth crypto holders to target, supported social engineering operations, leveraged technology to trigger account access alerts on target devices, and was involved in laundering the pilfered digital booty.

Lam’s crypto fraud gang reportedly totaled 12 members, and this criminal fraternity operated for about two years. Documents indicate that the individual crypto thefts ranged from $800,000 to tens of millions of dollars. One crypto heist purportedly netted $245 million from a single victim.

Cybergang members enjoyed lavish lifestyles due to their swindling successes. The court documents mention members of the gang owning “a fleet of 31 exotic cars, ranging in value from $100,000 up to $3,800,000.” They would also run up nightclub service bills of up to $500,000 a night, buy luxury watches, clothing, and more. As well as rent prestigious homes in locations like Los Angeles, the Hamptons, and Miami – traveling around in private jets and protected by a team of security guards.

Lam was arrested in September 2024, though, so they didn’t really get to enjoy that lavish luxury lifestyle for very long. Since that time, their suspected criminal activities have been under deeper investigation. The last members of the ‘Minecraft crew’ threw in the towel around May 2025. Lam has now pleaded guilty to RICO violations, and a status hearing is scheduled for December 8 this year; the Singaporean faces up to 20 years in jail. The Register notes that another member of Lam’s fold, Marlon Ferro, was handed a 6.5-year sentence back in May. Ferro’s role was effectively a ‘physical plan B,’ and they reportedly took part in multiple physical burglaries at the behest of the gang if/when social engineering attacks weren’t enough.

Hackers reportedly claiming to be good actors have drained about $320 million worth of Bitcoin from Liquid Network's federation wallet, according to a CoinDesk report. In an X post on September 6, Liquid — a Bitcoin sidechain developed by blockchain infrastructure company Blockstream — confirmed that 4,000 BTC, roughly 95% of the entire wallet's balance, had been withdrawn.

Interestingly, the post referred to those behind the exploit as “purported white-hat hackers,” echoing the hackers’ own claim, after they self-identified as “whitehats” in a message embedded in a Bitcoin transaction. They also reportedly requested an audience with Liquid via the on-chain message, promising to return the money once the vulnerability that enabled the exploit is fixed.

“Please fix the bug first,” the on-chain message said. "The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.” Liquid responded on-chain with its security team's contact and has reportedly moved communications to an encrypted channel. Meanwhile, the platform said it has suspended transactions and warns of service disruptions as federation members work to restore service.

Launched in 2018, Liquid is a federated sidechain designed to move Bitcoin faster and more privately than the main chain. Users lock BTC on Bitcoin and receive an equivalent token, L-BTC, on Liquid, which settles blocks roughly every minute and finalizes in about two minutes. Rather than relying on miners, the network is secured by a federation of more than 80 exchanges, brokers, and other financial firms. The block signing and the multisig wallet holding the pegged-in Bitcoin are handled by 15 rotating functionaries that require 11 signatures to move funds.

The mechanics behind the exploit are also unusual, as nothing appears to have been stolen in the conventional sense. For example, in January, the Solana-based platform Step Finance lost roughly $40 million after attackers compromised devices belonging to its executive team, gaining access to the keys that guarded its treasury wallets. According to Liquid, the coins left through the Peg-out Authorization Key (PAK), belonging to SideSwap, a decentralized exchange built on the sidechain.

However, Liquid said that the key had not been compromised, nor had any others. SideSwap gave a matching account, stating a customer sent 4,000 L-BTC to its peg-out service at 14:05 UTC, the service processed the order as it would any other, and the Liquid Federation paid out 3,996 BTC to the customer's Bitcoin address twenty-three minutes later. According to SideSwap, its systems had no way of distinguishing those coins from any other L-BTC.

The incident lands in what has already been a punishing stretch for crypto infrastructure. Recently, the trading platform Drift suspended deposits and withdrawals after a suspected $270 million hack in April. In 2025, roughly $17 billion worth of Bitcoin was stolen, driven largely by impersonation schemes and AI-assisted scams.

A Nevada court has found a Las Vegas businessman guilty of 11 counts of wire fraud, two counts of mail fraud, and two counts of money laundering for defrauding over $24 million from hundreds of investors. According to the U.S. Attorney’s Office, Brent Kovar presented Profit Connect to investors as a crypto mining operation that used an artificial intelligence supercomputer for its operations. He promised a fixed rate of return that paid 15% to 30% APR and also came with a 100% money-back guarantee. However, it turned out that the “profits” that the earlier investors made only came from the influx of newer investors, and that the company wasn’t making any money.

Kovar victimized 400 investors, telling them that the company had cryptocurrency reserves worth hundreds of millions of dollars. In reality, it had zero holdings, couldn’t afford to pay investors their interest earnings, and had no way to return their cash despite the offered guarantee. “He used investor money to operate Profit Connect, to buy gifts for employees, to buy a house for himself, and to repay investors as if those repayments came from mining cryptocurrency and verifying cryptocurrency transactions,” the Department of Justice said in its press release.

Profit Connect operated from 2017 to 2021, which is around the same time that Bitcoin made its first major rally, with the cryptocurrency hitting a peak of over $19,000 in December of that year. This, combined with the buzzwords of “AI” and “supercomputer,” made it seem to investors that they were putting money in a groundbreaking new technology that would change the way we do finance. Unfortunately, the venture turned out to be a scam and defrauded investors out of their money with nothing to show for. It’s unclear if the funds that the investors lost will ever be recovered, but Kovar is facing a possibly lengthy jail time of a maximum of 280 years for his crimes.

Another scam rooted in cryptocurrency investment from 2017 saw retail investors lose $2 billion. BitConnect offered a similar guaranteed return on investment for anyone who put up cash on its platform until 2018, but instead of using the deposited money for trading, it was just siphoned off to the organization’s private digital wallet addresses. Even before this, another Ponzi-scheme scammer made off with $6 billion from her victims in China from 2014 until 2017 and converted it into 61,000 Bitcoin. While she has already been arrested, the seized cryptocurrency is still in limbo, so it’s unclear if and when her victims will get their money back.