Monat: Mai 2026

• South Korean prosecutors charge 5 people in a CATFI memecoin rug pull case.
• About 256 investors lost roughly $650K after the CATFI token crashed.
• CATFI token surged 1,000x before liquidity was drained and the price collapsed.

South Korean prosecutors have arrested and charged a group of individuals linked to the Solana-based CATFI memecoin over an alleged decentralised exchange (DEX) rug pull.

The case marks the country’s first formal criminal action targeting a memecoin scam that unfolded entirely through a decentralised trading environment.

According to a local news outlet, authorities say the operation affected hundreds of retail investors and generated substantial illicit gains before collapsing after a rapid price spike and liquidity drain.

How the CATFI memecoin scheme unfolded

The CATFI token was launched on Solana and traded primarily through decentralised platforms, including Pump.fun.

Investigators allege that the operators positioned the token as a high-potential memecoin and used aggressive online promotion to attract early buyers.

A key figure in the promotion reportedly used the alias “Eth Father,” presenting themselves as a credible community leader.

This identity was used across social channels to build trust and encourage early participation in the token.

Once liquidity and trading activity increased, prosecutors say the operators engaged in coordinated trading behaviour designed to simulate organic demand.

This included wallet splitting and wash trading patterns that created the appearance of active market interest.

At its peak, CATFI experienced a dramatic surge, reportedly increasing by more than 1,000 times in value within a short period.

That rapid rise was followed by a sudden collapse after liquidity was withdrawn and large holdings were sold off, a structure consistent with what authorities describe as a classic rug pull.

Arrests, charges, and financial impact

The Seoul Southern District Prosecutors’ Office Virtual Asset Crime unit led the investigation.

Officials confirmed that two primary suspects were arrested, while five individuals in total were charged in connection with the scheme.

Additional suspects are also being investigated for allegedly helping key figures evade arrest during the inquiry.

The case is being prosecuted under South Korea’s Virtual Asset User Protection Act, which was recently introduced to address fraud and manipulation in the digital asset market.

Authorities estimate that around 256 investors were directly affected by the CATFI collapse.

Total losses are reported at approximately 900 million won, which is about 650,000 US dollars based on prevailing exchange rates.

Investigators also identified roughly 400 million won, or about 260,000 US dollars, in illicit profits linked to the scheme.

The investigation suggests that the operators extracted value through early liquidity positions and coordinated sell-offs, leaving late participants exposed to the sharp price reversal.

Why this case is significant for South Korea’s crypto enforcement

This is the first known case in South Korea where prosecutors have pursued criminal charges specifically tied to a DEX-based memecoin rug pull.

Unlike earlier enforcement actions that focused mainly on centralised exchanges or structured investment fraud, this case extends legal scrutiny directly into decentralised trading environments.

The prosecution has made it clear that the use of decentralised platforms does not shield individuals from criminal responsibility.

By applying the Virtual Asset User Protection Act to on-chain activity, authorities are signalling that token creators and promoters can be held accountable even when no centralised intermediary is involved.

The CATFI memecoin case also highlights how quickly memecoin ecosystems can amplify both gains and losses.

The token’s reported 1,000x surge drew in a large number of retail traders, but the subsequent collapse wiped out those gains almost immediately after liquidity was removed.

With 256 confirmed victims and losses reaching hundreds of millions of won, regulators appear to be treating the incident as more than a simple market failure.

Instead, it is being positioned as a coordinated financial fraud operation built around token manipulation and misleading promotion.

The outcome of this case is likely to influence how future memecoin projects are launched and monitored in South Korea.

Prosecutors are now actively tracing wallet activity, promotional networks, and liquidity movements tied to token launches on decentralised exchanges.

The post South Korea makes first DEX rug-pull arrests in Solana CATFI case appeared first on CoinJournal.

• Ondo Finance token is down 4% after Nathan Allman’s death announcement.
• Ian De Bode officially takes over as Ondo Finance CEO.
• Ondo TVL holds above $2.67 billion amid market uncertainty.

ONDO token fell nearly 4% over the past 24 hours after news emerged that Ondo Finance founder Nathan Allman had passed away unexpectedly.

The token traded around $0.421 at the time of writing, down from an intraday high of $0.444.

Trading activity also increased sharply, with daily volume climbing to more than $229 million as investors reacted to the development.

The decline interrupted what had been a strong recovery period for ONDO.

The token had gained close to 62% over the past 30 days, supported by growing interest in real-world asset (RWA) tokenisation and expanding institutional involvement in blockchain-based financial products.

What caused Nathan Allman’s death?

Ondo Finance confirmed that Nathan Allman died unexpectedly on May 26, 2026. However, the company did not disclose the cause of death.

The lack of details led to widespread speculation across the crypto community, though Ondo leadership requested privacy for Allman’s family and close associates.

Several major figures in the digital asset industry publicly shared tributes following the announcement.

Former Binance CEO Changpeng Zhao was among those who reacted publicly, alongside Mantle and Compound founder Robert Leshner.

Messages from industry participants described Allman as one of the key figures driving institutional adoption of tokenised assets.

Allman became widely associated with the idea that blockchain technology could modernise capital markets through around-the-clock settlement and easier global access to financial products.

Under his leadership, Ondo Finance established relationships with institutions including JPMorgan Chase, Franklin Templeton, Broadridge Financial Solutions, and BlackRock.

Ondo Finance has become one of the biggest names in the tokenised treasury market over the past two years.

The platform currently holds more than $2.67 billion in total value locked, placing it among the leading projects focused on bringing traditional financial products onto blockchain networks.

Allman played a central role in that growth. Before launching Ondo Finance in 2021, he worked on Goldman Sachs’ digital assets team and previously had experience in private credit investing. He later built Ondo into one of the most recognised real-world asset platforms in the crypto sector.

The company’s products include OUSG, which offers tokenised exposure to short-term US Treasuries, and USDY, a yield-bearing digital dollar product backed by treasury assets.

Ondo also expanded into tokenised equities infrastructure through Ondo Global Markets.

Ian De Bode named Ondo Finance CEO

Ondo Finance moved quickly to address leadership concerns by naming Ian De Bode as the company’s new CEO.

It is with profound sadness that we announce the unexpected passing of Nathan Allman, Ondo’s founder. Our hearts are with his family and loved ones.

Nate’s brilliance, humility, and drive shaped every part of what Ondo is today. His belief in the power of technology to create a…

— Ondo Finance (@OndoFinance) May 25, 2026

De Bode previously served as Ondo’s president and had already been overseeing strategy, product development, and operations for more than two years before the transition.

His background includes work at McKinsey’s digital assets division, giving him direct experience in institutional blockchain adoption and financial infrastructure.

The company stated that its long-term roadmap would continue without changes despite the leadership shift.

That message appeared aimed at calming investors and institutional partners following the sudden news.

What to expect in the coming days

Despite the sharp emotional reaction from the community, ONDO’s price movement remained relatively controlled compared to previous major crypto leadership events.

The coming days will likely focus on whether ONDO can maintain support above the $0.40 range as markets digest the leadership transition.

Short-term volatility may continue because the news arrived during a period of strong upward momentum for the token.

ONDO had already risen nearly 9% over the past seven days before the latest decline, suggesting traders were actively positioning around the broader real-world asset narrative.

Much of the market’s attention will now shift toward how Ian De Bode handles Ondo’s institutional partnerships and ongoing expansion plans.

The post ONDO price drops 4% as community mourns Nathan Allman’s death appeared first on CoinJournal.

• The malware spread through npm, PyPI, and Rust packages in coordinated waves.
• It steals crypto wallets, SSH keys, and cloud developer credentials.
• AI coding tools were also targeted through malicious config files.

A coordinated malware campaign known as TrapDoor has hit software ecosystems widely used by crypto and blockchain developers.

Security researchers identified dozens of malicious packages spread across major open-source repositories, all designed to steal sensitive developer data such as wallet keys, cloud credentials, and source code access tokens.

Instead of a single malicious upload, attackers deployed multiple packages in waves using different accounts.

This approach made the activity harder to detect at the early stages and allowed the malware to blend into routine dependency updates.

Coordinated attack across major developer ecosystems

The TrapDoor operation affected at least three major package ecosystems: npm, PyPI, and Crates.io.

Together, researchers identified more than 30 malicious packages and over 300 affected versions distributed within a short window.

The activity reportedly began around May 22, 2026, although GitHub reported unauthorized access to internal repositories on May 20. It then escalated quickly over the following days.

The packages were not isolated incidents. Instead, they appeared to be part of a coordinated release strategy involving multiple developer accounts.

This structure suggests planning rather than opportunistic abuse. Each package carried similar behavior patterns and pointed to a shared malicious framework used by the attackers.

How the TrapDoor malware operates inside developer systems

Once installed, TrapDoor packages execute automatically through standard build and installation processes used in modern development environments.

In JavaScript packages, malicious code is triggered through post-install scripts, which run immediately after a dependency is added.

In Python packages, the malware can activate during import, allowing it to execute without any explicit function call.

Rust packages use build scripts to achieve the same result during compilation.

After execution, the malware scans local systems for valuable data. This includes SSH keys, API tokens, and configuration files commonly used in cloud and blockchain development workflows.

It also targets browser-stored credentials and environment variables, which often contain sensitive authentication data.

Stolen information is then sent to external servers controlled by the attackers.

In some cases, the malware attempts to maintain persistence by modifying startup processes or inserting malicious hooks into development tools.

Crypto-focused targeting and high-value data theft

What makes this campaign particularly concerning is its focus on crypto-related development environments.

The malware specifically searches for crypto wallet-related files and credentials linked to platforms such as Coinbase, MetaMask, Binance, and Solana-based tools.

It also targets cloud infrastructure credentials from providers like AWS and GitHub access tokens.

These are especially valuable because they can provide attackers with direct access to private repositories, deployment pipelines, and backend systems.

In addition, the malware attempts to collect SSH keys that could allow remote access to developer machines or production servers.

This combination of targets gives attackers a wide range of entry points into both personal and enterprise systems.

AI development tools also under pressure

One of the more unusual elements of the TrapDoor campaign is its interaction with AI-assisted development environments.

Some malicious packages include configuration files designed to influence coding assistants and automated development tools.

Files such as .cursorrules and CLAUDE.md were reportedly used to manipulate AI coding assistants into performing actions that could expose sensitive information.

Instead of directly hacking systems, the attackers attempted to exploit how AI tools interpret project instructions.

This approach reflects a shift in attack methods.

Rather than targeting only code execution, the campaign also attempts to influence developer workflows that rely on AI-generated suggestions and automated analysis.

The post TrapDoor attack targets crypto wallets, AWS keys and GitHub tokens appeared first on CoinJournal.