Autor Cointelegraph By Stephen Katte

Keonne Rodriguez, one of the developers behind the crypto-mixing protocol Samourai Wallet, is appealing to the crypto community for donations to help cover legal bills and fines tied to his trial over money laundering. Samourai Wallet co-founders Rodriguez and William Lonergan Hill were sentenced on Nov. 19 to five and four years in prison, respectively, on charges stemming from their involvement in the protocol.Rodriguez said in an X post on Wednesday that he desperately needs help after being “financially wiped out,” accruing $2 million in debt from legal fees and a $250,000 fine imposed by the sentencing judge.Source: Keonne Rodriguez“We are entirely out of options. We need to pay off these legal bills and other debts accrued attempting to defend myself. We desperately need your help. Now.”The case against Rodriguez and Hill, along with Tornado Cash co-founder Roman Storm, has been closely followed by crypto advocates, many of whom argue they shouldn’t be held responsible for the actions of third parties using their software. They also argue that their convictions risk criminalizing open-source privacy tools and restricting privacy rights.Costs racked up over long legal battleRodriguez and Hill were first charged with conspiracy to commit money laundering and conspiracy to operate an unlicensed money transmitting business in April 2024. They initially pleaded not guilty, but in July 2025, they agreed to plead guilty to one charge of operating an illegal money transmitter.Rodriguez said in an interview with journalist and Bitcoin educator Natalie Brunell last December that he pleaded guilty after crunching the numbers and finding that a conviction would mean significantly more jail time and millions more in legal fees.Online legal marketplace Lawful estimates a criminal defense lawyer can cost on average $200 to $500 per hour, with retainer fees exceeding $10,000. Rates increase based on the type of case, the overall complexity and the number of lawyers working on the case.Presidential pardon likely off the tableUS President Donald Trump said last December that he would review Rodriguez’s case and explore a pardon. There is also a petition for a pardon that had attracted 15,953 signatures as of Thursday.Related: US prosecutors seek Roman Storm retrial after mixed verdictHowever, Rodriguez said that, unlike Trump’s pardons of Binance founder Changpeng “CZ” Zhao and Silk Road founder Ross Ulbricht, his prospects are low.“There was some hope during the Bitcoin 2026 conference, but that has now come and gone, and one must come to terms with the fact that I am simply a federal prisoner without money, power, or influence, and I will serve my full sentence,” he said.“Perhaps it was denial or delusion, but I had hoped to do what I have always done and dig myself out of this hole myself – but with the reality of serving a full sentence that is not possible.”Magazine: Singapore isn’t a ‘crypto hub’ — it’s something better: StraitsX CEO  Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Investment group BG Wealth Sharing, a suspected $150 million crypto Ponzi scheme, has had its domain seized by law enforcement days after allegedly rug-pulling users.Onchain sleuth ZachXBT said on X on Tuesday that “illicit actors” connected to the group tried to launder more than $92 million in crypto between April 27 and Sunday, but he helped lead an initiative that froze more than $41 million, working alongside Tether, Binance, OKX and US law enforcement.He also said the scheme was likely responsible for losses greater than $150 million, given it’s been operating since 2025 and the “thousands of victim exchange withdrawals identified.”“While these Chinese investment frauds are obvious to most, they purposely target unsophisticated retail investors via social media,” ZachXBT added. “Reading through victim posts, many still seem to be in denial that they were scammed.”Source: ZachXBTThe US Federal Bureau of Investigation reported in April that American victims lost $21 billion to cyber-enabled crime last year, with crypto investment scams accounting for a large share of the losses.BG Wealth Sharing domain seized by US law enforcementAs of Wednesday, the BG Wealth Sharing website displays a notice that it was seized by US law enforcement as part of a joint operation between Operation Level Up and the Scam Center Strike Force.Several regulators had warned that BG Wealth Sharing was an unlicensed entity and advised caution since 2025. In April, the Central Bank of Samoa said it was an investment scam and advised investors to avoid the company.A domain linked to BG Wealth Sharing has been seized by US authorities. Source: BG Wealth Sharing BG Wealth Sharing, according to authorities, claimed to provide guidance on crypto trading, advertised heavily on social media and offered “daily profit opportunities,” referral commissions, rank-based bonuses and a daily yield of 1.3% to 2.6%.Related: Google Cloud flags North Korea-linked crypto malware campaign One last rug pull before going offline, users sayBefore BG Wealth Sharing went offline, purported CEO Stephen Beard told users in a video address Saturday that its DSJ Exchange was on the cusp of an initial public offering and that a 12% tax on account balances was required as part of the regulatory process.BG Wealth Sharing CEO Stephen Beard told users a 12% tax on account balances was required as part of an initial public offering process. Source: ZachXBTBy Sunday, users warned on social media that the whole scheme was a rug pull in progress. On Monday, the Washington State Department of Financial Institutions issued a similar warning.In an update to its earlier post about BG Wealth Sharing, the regulator said it had received complaints from investors and warned that it was likely a scam.“A company that requires an investor to deposit additional external funds in order to withdraw their investment is highly likely to be operating an advance fee scam.”Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks   Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

DeFi protocol Kelp DAO said it will be migrating its restaking token, rsETH, to the Chainlink oracle platform after the $292 million exploit in April, as it continued to blame the attack on LayerZero’s cross-chain infrastructure.Hackers stole 116,500 Kelp DAO restaked ETH tokens on April 18 from Kelp DAO’s LayerZero-powered bridge, then used them as collateral on Aave v3 to borrow wrapped Ether.“After the recent LayerZero exploit, we are taking steps to ensure rsETH is fully secure, which is why we are migrating to Chainlink CCIP,” Kelp DAO said in an X post on Tuesday.Source: Kelp DAOThe Kelp DAO hack has been one of the year’s largest security incidents, causing broader ecosystem contagion and impacting the interconnected crypto lending market. At the center of the exploit has been an argument over who was responsible for the vulnerability. Kelp says it wasn’t warned of the security risksA day after the exploit, LayerZero released a postmortem arguing the hack occurred because of an inadequate setup tied to Kelp’s decentralized verifier network (DVN), which relied on a single LayerZero DVN as the only verified path rather than requiring multiple independent checks to validate cross-chain transactions. LayerZero said it advised against this setup.However, Kelp DAO said Tuesday the 1-1 setup is the default and is used by many other protocols, citing data from analytics platform Dune that found roughly half of LayerZero users have a single DVN. It also accused LayerZero of approving the setup and failing to warn about the related security risk.“Kelp has operated on LayerZero infrastructure since January 2024 and has maintained an open communication channel with the LayerZero team throughout. The question of DVN configuration came up multiple times and these configurations were confirmed as secure at that time,” Kelp DAO added.Following the hack, LayerZero announced it will no longer validate or approve cross-chain messages for any app that relies on a single verifier, and that it is in the process of migrating protocols using the setup to a multi-DVN. LayerZero CEO says many of the claims are untrueBryan Pellegrino, co-founder and CEO of LayerZero, said in a reply on X that a “ton” of Kelp’s claims were “just completely untrue.”Related: US law firm attempts to block transfer of frozen ETH from Kelp exploitHe argued that Kelp originally used the defaults, which were multi-DVN, and later manually changed to a 1/1 configuration, which isn’t recommended for production applications.“The defaults Kelp is referencing in their screenshot were multiDVN or DeadDVN, which force-rejects an application using the defaults at all and requires them to manually set configuration. rsETH was originally configured to use the default LayerZero configuration of a multiDVN setup of LayerZero Labs + Google,” he added.Source: Bryan PellegrinoPellegrino also said a complete postmortem by external security firms would be published soon. North Korea-linked hackers are suspected of being behind the attack on Kelp and the April 1 exploit of decentralized exchange Drift, which totaled $285 million. Magazine: Bitcoiners eye ‘sell in May,’ SBF’s bid for new trial shut down: Hodler’s Digest, April 26 – May 2Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Decentralized finance protocol Aave filed an emergency motion on Monday in New York to vacate a restraining notice from a US law firm aimed at blocking Arbitrum DAO from transferring 30,766 Ether to the victims of the Kelp exploit. Gerstein Harrow LLP served Arbitrum DAO with a restraining notice on Friday, arguing its clients are owed over $877 million in default judgments against North Korea. The law firm claims the North Korean hacker group behind the Kelp exploit had possession of the tokens, giving its clients a legal claim over the Ether.Aave filed the emergency motion in a New York district court, arguing that a thief doesn’t gain lawful ownership of property by stealing it. It also argued that North Korea is only suspected of being part of the theft, and that the law firm’s argument “defies logic, common sense and the law.”The Arbitrum DAO has been voting on whether to release the Ether to assist DeFi United, an industrywide coordination effort to make rsETH holders whole and help restore rsETH’s backing following the $292 million Kelp DAO hack on April 18. Voting ends May 7. Source: AaveDelay will cause “irreparable harm” to Aave, crypto ecosystemAave argued that if the court upholds Gerstein Harrow’s notice, it could deter future recovery efforts for North Korea-related hacks because of the possibility of additional legal challenges to recover funds. It further argued that it could incentivize bad actors to target more crypto protocols.Aave’s lawyers also warned that the delay is causing “irreparable harm” to the protocol, its users and the wider DeFi community, “none of which can be later cured by monetary damages.”“If the immobilized assets remain subject to a freeze and are not made available to restore value to Aave protocol users, the entire DeFi ecosystem risks being destabilized,” Aave’s lawyers said.“While Aave protocol users cannot retrieve their assets from the Aave protocol, if those assets were being used for collateral for other positions elsewhere then continued restraint on the immobilized assets may render those users unable to meet their related collateral obligations.”Aave said that if a court upholds Gerstein Harrow’s notice, it could incentivize bad actors to target more crypto protocols. Source: CourtListenerThey further argued against Gernstein Harrow’s claim that its clients have a right to the frozen Ether and also said the case is based on unsupported conjecture that the thief is North Korea. “Plaintiffs in this case showed up, contending – based on conjecture from posts on the internet – that the thief was North Korea, and that by stealing the assets for a few hours, North Korea somehow became the rightful owner of those assets such that Plaintiffs here could restrain them for their own purposes,” lawyers for Aave said.“The immobilized assets do not belong to North Korea or any affiliated entities. Instead, the immobilized assets belong to the users of the Aave protocol who were victimized when a third-party thief effectively stole their assets during a cyber exploit April 18, 2026.” Related: Google Cloud flags North Korea-linked crypto malware campaignIf the court can’t immediately vacate the notice, Aave’s lawyers are requesting that Gerstein Harrow pay a $300 million bond to maintain the restraining notice until a decision is reached.A judge hasn’t ruled on the emergency motion yet, and a hearing date hasn’t been scheduled. Gerstein Harrow has filed similar cases in the past, arguing its clients have a claim to funds stolen by North Korea and frozen by crypto firms, including assets from the 2023 Heco Bridge hack and the 2025 Bybit exploit.Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks  Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

A US law firm has filed a restraining notice to block the transfer of frozen Ether from the Kelp exploit, arguing that its clients are owed over $877 million in compensation and damages by North Korea. Charlie Gerstein, a lawyer for US law firm Gerstein Harrow LLP, said in a post on the Arbitrum DAO forum on Friday that a New York district court signed off on a restraining notice and three writs of execution preventing the DAO from moving the Ether under threat of contempt of court.The law firm argued that its clients, who were not affected by the Kelp exploit, won default judgments against North Korea in three separate US court cases in 2010, 2015 and 2016 and are owed a collective $877 million in compensatory and punitive damages, plus interest. It also argued that its clients have a claim to DPRK property. Gerstein said in the restraining notice that the stolen Ether is “property” in which the DPRK has a stake because the hacker group is affiliated with the country. The freeze could mean those affected by the Kelp exploit would need to wait longer to see their funds recovered. This isn’t the first time the firm has attempted to claim stolen cryptocurrency. Kelp DAO suffered a $292 million hack on April 18, which is believed to have been carried out by TraderTraitor, a subgroup of North Korea’s state-backed hacking unit, Lazarus Group. Days later, Arbitrum Security Council took emergency action to freeze 30,766 Ether (ETH), worth over $73 million, held in a wallet linked to the Kelp exploit.Charlie Gerstein, a lawyer for Gerstein Harrow, posted a restraining notice seeking to prevent the Arbitrum DAO from moving the frozen Ether. Source: Arbitrum DAOFunds were proposed for Kelp victimsAave Labs proposed on April 25 that the Arbitrum DAO unfreeze the $73 million in Ether tied to the Kelp DAO attack and direct those funds to “DeFi United,” a fund aimed at restoring rsETH and compensating its holders.An Arbitrum DAO member under the handle Zeptimus said that if the law firm’s action is successful, the DPRK debt will be transferred to the Kelp DAO victims.“Your clients’ losses are real and the DPRK should answer for them. But the remedy the restraining notice asks for, blocking the return of stolen funds to their actual owners shifts the cost of the DPRK’s debt onto a different set of victims who were themselves robbed. That compounds the original harm; it doesn’t redress it,” they said.Gerstein Harrow filed similar claims beforeGerstein Harrow has filed similar cases in the past, arguing its clients have a claim to funds stolen by the DPRK and frozen by crypto firms. In February, the firm filed a claim against funds frozen by Tether that were stolen in the 2023 Heco Bridge hack.Related: North Korean hackers used AI-enabled social engineering in Zerion attackIt has also filed class-action suits against multiple DAOs. At the same time, onchain sleuth ZachXBT accused the law firm of using his research in court documents to stake a claim on funds from the $1.5 billion Bybit hack.The law firm has three live cases against DAOs on its website. Source: Gerstein HarrowNorth Korea-affiliated actors have been accused of stealing at least $578 million across major incidents throughout April and have been linked to many of the industry’s largest hacks, including the Bybit exploit.Magazine: DeFi’s billion-dollar secret: The insiders responsible for hacks Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.