InvestMacro

By Nolan Fahrenkopf, University at Albany, State University of New York 

Two years after Hamas attacked Israel on Oct. 7, 2023, families of the victims filed suit against Binance, a major cryptocurrency platform that has been plagued by scandals.

In a Nov. 24, 2025, filing by representatives of more than 300 victims and family members, Binance and its former CEO – recently pardoned Changpeng Zhao – were accused of willfully ignoring anti-money-laundering and so-called “know your customer” controls that require financial institutions to identify who is engaging in transactions.

In so doing, the suit alleged that Binance and Zhao – who in 2023 pleaded guilty to money laundering violations – allowed U.S.-designated terrorist entities such as Hamas and Hezbollah to launder US$1 billion. Binance has declined to comment on the case but issued a statement saying it complies “fully with internationally recognized sanctions laws.”

The problem the Binance lawsuit touches upon goes beyond U.S.-designated terrorist groups.

As an expert in countering the proliferation of weapons technology, I believe the Binance-Hamas allegations could represent the tip of the iceberg in how cryptocurrency is being leveraged to undermine global security and, in some instances, U.S. national security.

Cryptocurrency is aiding countries such as North Korea, Iran and Russia, and various terror- and drug-related groups in funding and purchasing billions of dollars worth of technology for illicit weapons programs.

Though some enforcement actions continue, I believe the Trump administration’s embrace of cryptocurrency might compromise the U.S.’s ability to counter the illicit financing of military technology.

In fact, experts such as professor Yesha Yadav, professor Hilary J. Allen and Graham Steele, anti-corruption advocacy group Transparency International and even the U.S. Treasury itself warn it and other legislative loopholes could further risk American national security.

A tool to evade sanctions

For the past 13 years, the Project on International Security, Commerce, and Economic Statecraft, where I serve as a research fellow, has conducted research and led industry and government outreach to help countries counter the proliferation of dangerous weapons technology, including the use of cryptocurrency in weapons fundraising and money laundering.

Over that time, we have seen an increase in cryptocurrency being used to launder and raise funds for weapons programs and as an innovative tool to evade sanctions.

Efforts by state actors in Iran, North Korea and Russia rely on enforcement gaps, loopholes and the nebulous nature of cryptocurrency to launder and raise money for purchasing weapons technology. For example, in 2024 it was thought that around 50% of North Korea’s foreign currency came from crypto raised in cyberattacks.

A digital bank heist

In February 2025, North Korea stole over $1.5 billion worth of cryptocurrency from Bybit, a cryptocurrency exchange based in the United Arab Emirates. Such attacks can be thought of as a form of digital bank heist. Bybit was executing regular transfers of cryptocurrency from cold offline wallets – like a safe in your home – to “warm wallets” that are online but require human verification for transactions.

North Korean agents duped a developer working at a service used by Bybit to install malware that granted them access to bypass the multifactor authentication. This allowed North Korea to reroute the crypto transfers to itself. The funds were moved to North Korean-controlled wallets but then washed repeatedly through mixers and multiple other crypto currencies and wallets that serve to hide the origin and end location of the funds.

While some funds have been recovered, many have disappeared.

The FBI eventually linked the attack to the North Korean cyber group TraderTraitor, one of many intelligence and cyber units engaging in cyberattacks.

Lagging behind on security

Cryptocurrency is attractive because of the ease with which it can be acquired and transferred between accounts and various digital and government-issued currencies, with little to no requirements to identify oneself.

And as countries such as Russia, Iran and North Korea have become constricted by international sanctions, they have turned to cryptocurrency to both raise funds and purchase materials for weapons programs.

Even stablecoins, promoted by the Trump administration as safer and backed by hard currency such as the U.S. dollar, suffer from extensive misuse linked to funding illicit weapons programs and other activities.

Traditional financial networks, while not immune from money laundering, have well-established safeguards to help prevent money being used to fund illicit weapons programs.

But recent analysis shows that despite enforcement efforts, the cryptocurrency industry continues to lag behind when it comes to enforcing anti-money-laundering safeguards. In at least some cases this is willful, as some crypto firms may attempt to circumvent controls for profit motives, ideological reasons or policy disputes over whether platforms can be held accountable for the actions of individual users.

It isn’t only the raising of these funds by rogue nations and terrorist groups that poses a threat, though that is often what makes headlines. A more pressing concern is the ability to quietly launder funds between front companies. This helps actors avoid the scrutiny of traditional financial networks as they seek to move funds from other fundraising efforts or firms they use to purchase equipment and technology.

The incredible number of crypto transactions, the large number of centralized and decentralized exchanges and brokers, and limited regulatory efforts have made crypto incredibly useful for laundering funds for weapons programs.

This process benefits from a lack of safeguards and “know your customer” controls that banks are required to follow to prevent financial crimes. These should, I believe, and often do apply to entities large and small that help move, store or transfer cryptocurrency known as virtual asset service providers, or VASPs. However, enforcement has proven difficult as there are an incredibly large number of VASPs across numerous jurisdictions. And jurisdictions have fluctuating capacity or willingness to implement controls.

The cryptocurrency industry, though supposedly subject to many of these safeguards, often fails to implement the rules, or it evades detection due to its decentralized nature.

Digital funds, real risk

The rewards for rogue nations and organizations such as North Korea can be great.

Ever the savvy sanctions evader, North Korea has benefited the most from its early vision on the promise of crypto. The reclusive country has established an extensive cyber program to evade sanctions that relies heavily on cryptocurrency. It is not known how much money North Korea has raised or laundered in total for its weapons program using crypto, but in the past 21 months it has stolen at least $2.8 billion in crypto.

Iran has also begun relying on cryptocurrency to aid in the sale of oil linked to weapons programs – both for itself and proxy forces such as the Houthis and Hezbollah. These efforts are fueled in part by Iran’s own crypto exchange, Nobitex.

Russia has been documented going beyond the use of crypto as a fundraising and laundering tool and has begun using its own crypto to purchase weapons material and technology that fuel its war against Ukraine.

A threat to national security

Despite these serious and escalating risks, the U.S. government is pulling back enforcement.

The controversial pardon of Binance founder Changpeng Zhao raised eyebrows for the signal it sends regarding U.S. commitment to enforcing sanctions related to the cryptocurrency industry. Other actions such as deregulating the banking industry’s use of crypto and shuttering the Department of Justice’s crypto fraud unit have done serious damage to the U.S.’s ability to interdict and prevent efforts to utilize cryptocurrencies to fund weapons programs.

The U.S. has also committed to ending “regulation by prosecution” and has withdrawn numerous investigations related to failing to enforce regulations meant to prevent tactics used by entities such as North Korea. This includes abandoning an admittedly complicated legal case regarding sanctions against a “mixer” allegedly used by North Korea.

These actions, I believe, send the wrong message. At this very moment, cryptocurrency is being illicitly used to fund weapons programs that threaten American security. It’s a real problem that deserves to be taken seriously.

And while some enforcement actions do continue, failing to implement and enforce safeguards up front means that crypto will continue to be used to fund weapons programs. Cryptocurrency has legitimate uses, but ignoring the laundering and sanctions-evasion risks will damage American national interests and global security.

About the Author:

Nolan Fahrenkopf, Research Fellow at Project on International Security, Commerce and Economic Statecraft, University at Albany, State University of New York

This article is republished from The Conversation under a Creative Commons license. Read the original article.

By João Marinotti, Indiana University 

In late October 2025, as much as US$2 billion vanished from a digital marketplace. This wasn’t a hack or a bubble bursting. It happened because one company, Valve, changed the rules for its video game Counter-Strike 2, a popular first-person shooter with a global player base of nearly 30 million monthly users.

For years, its players have bought, sold and traded digital cosmetic items, known as “skins.” Some rare items, particularly knives and gloves, commanded high prices in real-world money – up to $1.5 million – leading some gamers to treat the market like an investment portfolio. As a result, many investment-style analytics websites charge monthly fees for financial insight, trends and transaction data from this digital marketplace.

In one fell swoop, Valve unilaterally changed the game. It expanded the “trade up contract,” allowing players to exchange – or “trade up” – a number of their common assets into knives or gloves.

By flipping this switch, Valve instantly upended digital scarcity. The market was flooded with new supply, and the value of existing high-end items collapsed. Prices plummeted, initially erasing half the market’s total value, which exceeded $6 billion before the recent crash. Although a partial recovery brought the net loss to roughly 25%, significant volatility continues, leaving investors unsure whether the bottom has truly fallen out.

Many of those who saw their digital fortunes evaporate immediately wondered whether there was anything they could do to get their money back. Speaking as a law professor and a gamer myself, the answer isn’t what they want to hear: no. In fact, the existing legal structure largely protects Valve’s ability to engage in this sort of digital market manipulation. Players and investors were simply out of luck.

The Counter-Strike 2 crash reveals a troubling reality that extends far beyond video games: Corporations have built exchange-scale investment markets governed primarily by private terms-of-service agreements, rather than the robust set of public regulations that oversee traditional financial and consumer markets. These digital economies occupy a legal blind spot, lacking the fundamental guardrails of property rights, meaningful consumer protection or even securities regulation.

Your digital ‘property’ isn’t really yours

If you spend real money on a digital item, it may feel like you should own it. Legally, you don’t.

The digital economy is built on a crucial distinction between ownership and licensing. When users sign up for Steam, Valve’s platform, they agree to the Steam subscriber agreement. Buried in that contract is a critical piece of legalese stating that all digital assets and services provided by Valve, including the Counter-Strike 2 skins, are merely “licensed, not sold.” The license granted to users “confers no title or ownership” at all. This isn’t meaningless corporate jargon; it’s a legal standard routinely affirmed by U.S. courts.

The legal implication is clear: Because players only license their skins, they have no property rights over them. When Valve changed the game’s mechanics in a way that collapsed the items’ market value, it didn’t steal, damage or destroy anyone’s “property.” In the eyes of the law, Valve simply altered the conditions of a license, something that its terms-of-service agreement allows it to do unilaterally, at any time, for any reason.

Consumer protection laws don’t apply

While the Counter-Strike 2 crash may seem like a violation of consumer rights, current laws are ill-equipped to handle this type of corporate behavior.

Lawmakers have begun addressing concerns about digital goods, primarily focusing on instances where purchased movies or games disappear entirely from user libraries. For example, California recently enacted AB 2426. This law requires transparency, prohibiting terms like “buy” or “purchase” unless the consumer confirms that they understand they will receive only a revocable license.

As commendable as this law is, it protects only against confusion and loss of access, not loss of market value when platforms rebalance virtual economies. Valve can comply with consumer transparency laws and still adjust the supply of digital items, rendering them valueless overnight. Ultimately, current consumer protection laws are designed to ensure users know what they are licensing. They do not, however, create ownership interests or protect the speculative value of those digital items.

Game items are treated like unregulated stocks

Perhaps the most significant legal vacuum is the absence of financial regulation. The Counter-Strike 2 economy, a multibillion-dollar ecosystem with dedicated investors and third-party cash markets, looks and behaves like a traditional financial market. Yet, it remains outside the purview of any financial regulator, such as the U.S. Securities and Exchange Commission.

Under U.S. law, the primary standard for determining whether an asset should be governed as a security is the Howey test. According to this Supreme Court precedent, an asset is a security if it meets four criteria. Securities involve an “investment of money” in a “common enterprise” with a reasonable expectation of “profits” derived from the “efforts of others.”

Counter-Strike 2 skins arguably meet all of these criteria. Participants invest real money in a common enterprise – Valve’s platform – with an expectation of profit. Crucially, that profit depends on the “efforts of others.” The SEC notes this prong is met when a promoter provides “essential managerial efforts” that affect the enterprise’s success. Valve controls the game’s development, manages the platform and – as the recent update proves – dictates item supply and scarcity.

If a publicly traded company unilaterally changed its rules in a way that predictably tanked the price of its own shares, regulators would immediately investigate for market manipulation. So how can Valve get away with this? Three things cut against the skins’ status as securities.

First is their “consumptive intent” – skins are primarily game cosmetics. Second, there’s no way to convert the skins into dollars within Valve’s own ecosystem. In other words, third-party markets allow users to cash out, but these markets operate outside Valve’s own immediate control. And finally, the Howey test generally governs assets, such as stocks and bonds, that grant investors enforceable rights. Valve’s licensing scheme attempts to circumvent this by ensuring players hold nothing but a revocable license.

In my view, the $2 billion crash is a wake-up call. As digital economies grow in financial significance, society must decide: Will these markets continue to be governed solely by private corporate contracts? Or will they require integration into more robust legal frameworks, such as securities regulation, consumer protection and property law?

About the Author:

João Marinotti, Associate Professor of Law, Indiana University

This article is republished from The Conversation under a Creative Commons license. Read the original article.

By Rahul Telang, Carnegie Mellon University 

Scams are nothing new – fraud has existed as long as human greed. What changes are the tools.

Scammers thrive on exploiting vulnerable, uninformed users, and they adapt to whatever technologies or trends dominate the moment. In 2025, that means AI, cryptocurrencies and stolen personal data are their weapons of choice.

And, as always, the duty, fear and hope of their targets provide openings. Today, duty often means following instructions from bosses or co-workers, who scammers can impersonate. Fear is that a loved one, who scammers also can impersonate, is in danger. And hope is often for an investment scheme or job opportunity to pay off.

AI-powered scams and deepfakes

Artificial intelligence is no longer niche – it’s cheap, accessible and effective. While businesses use AI for advertising and customer support, scammers exploit the same tools to mimic reality, with disturbing precision.

Criminals are using AI-generated audio or video to impersonate CEOs, managers or even family members in distress. Employees have been tricked into transferring money or leaking sensitive data. Over 105,000 such deepfake attacks were recorded in the U.S. in 2024, costing more than US$200 million in the first quarter of 2025 alone. Victims often cannot distinguish synthetic voices or faces from real ones.

Fraudsters are also using emotional manipulation. The scammers make phone calls or send convincing AI-written texts posing as relatives or friends in distress. Elderly victims in particular fall prey when they believe a grandchild or other family member is in urgent trouble. The Federal Trade Commission has outlined how scammers use fake emergencies to pose as relatives.

Cryptocurrency scams

Crypto remains the Wild West of finance — fast, unregulated and ripe for exploitation.

Pump-and-dump scammers artificially inflate the price of a cryptocurrency through hype on social media to lure investors with promises of huge returns – the pump – and then sell off their holdings – the dump – leaving victims with worthless tokens.

Pig butchering is a hybrid of romance scams and crypto fraud. Scammers build trust over weeks or months before persuading victims to invest in fake crypto platforms. Once the scammers have extracted enough money from the victim, they vanish.

Scammers also use cryptocurrencies as a means of extracting money from people in impersonation scams and other forms of fraud. For example, scammers direct victims to bitcoin ATMs to deposit large sums of cash and convert it to the untraceable cryptocurrency as payment for fictitious fines.

Phishing, smishing, tech support and jobs

Old scams don’t die; they evolve.

Phishing and smishing have been around for years. Victims are tricked into clicking links in emails or text messages, leading to malware downloads, credential theft or ransomware attacks. AI has made these lures eerily realistic, mimicking corporate tone, grammar and even video content.

Tech support scams often start with pop-ups on computer screens that warn of viruses or identity theft, urging users to call a number. Sometimes they begin with a direct cold call to the victim. Once the victim is on a call with the fake tech support, the scammers convince victims to grant remote access to their supposedly compromised computers. Once inside, scammers install malware, steal data, demand payment or all three.

Fake websites and listings are another current type of scam. Fraudulent sites impersonating universities or ticket sellers trick victims into paying for fake admissions, concerts or goods.

One example is when a website for “Southeastern Michigan University” came online and started offering details about admission. There is no such university. Eastern Michigan University filed a complaint that Southeastern Michigan University was copying its website and defrauding unsuspecting victims.

The rise of remote and gig work has opened new fraud avenues.

Victims are offered fake jobs with promises of high pay and flexible hours. In reality, scammers extract “placement fees” or harvest sensitive personal data such as Social Security numbers and bank details, which are later used for identity theft.

How you can protect yourself

Technology has changed, but the basic principles remain the same: Never click on suspicious links or download attachments from unknown senders, and enter personal information only if you are sure that the website is legitimate. Avoid using third-party apps or links. Legitimate businesses have apps or real websites of their own.

Enable two-factor authentication wherever possible. It provides security against stolen passwords. Keep software updated to patch security holes. Most software allows for automatic update or warns about applying a patch.

Remember that a legitimate business will never ask for personal information or a money transfer. Such requests are a red flag.

Relationships are a trickier matter. The state of California provides details on how people can avoid being victims of pig butchering.

Technology has supercharged age-old fraud. AI makes deception virtually indistinguishable from reality, crypto enables anonymous theft, and the remote-work era expands opportunities to trick people. The constant: Scammers prey on trust, urgency and ignorance. Awareness and skepticism remain your best defense.

About the Author:

Rahul Telang, Professor of Information Systems, Carnegie Mellon University

This article is republished from The Conversation under a Creative Commons license. Read the original article.

By Mingyi Liu, Georgia Institute of Technology 

When the first cryptocurrency, Bitcoin, was proposed in 2008, the goal was simple: to create a digital currency free from banks and governments. Over time, that idea evolved into something much bigger: “decentralized finance,” or “DeFi.”

With decentralized finance, people trade, borrow and earn interest on crypto assets without relying on traditional intermediaries. DeFi services run on blockchains, which are essentially digital ledgers, and use “smart contracts” − self-executing code that automates financial transactions. Tens of billions of dollars have poured into the DeFi market.

But with innovation comes risks. The lack of centralized oversight has made crypto, including decentralized finance, a prime target for hackers and scammers. In 2024 alone, people lost nearly US$1.5 billion due to security exploits and fraud. And unlike traditional finance, there’s usually no way to recover stolen crypto.

As a computer scientist, I wanted to better understand how people perceive and respond to these risks. So my colleagues and I first conducted in-depth interviews with 14 crypto investors, then surveyed nearly 500 others to validate our findings.

Our study found that people often made the same mistakes, driven by recurring misconceptions and gaps in security awareness. Here are some of the most important.

Mistake 1: Thinking the blockchain guarantees security

Many people told us they thought decentralized finance was secure – but their reasoning wasn’t very convincing. Some seemed to confuse decentralized finance with blockchain technology itself, which is designed to ensure transactions are tamper-resistant through so-called “consensus mechanisms.” One told us that DeFi is secure “because a hacker would have to override an entire blockchain” to steal funds.

But services on the blockchain are still vulnerable to implementation and design flaws. These include smart contract breaches, in which bad guys exploit bugs in a service’s code, and front-end attacks, where a user interface is altered to redirect funds into a hacker’s wallet. A front-end attack was reportedly to blame for a recent $1.5 billion crypto heist.

Mistake 2: Thinking safe keys mean safe funds

Another common misconception is that DeFi is secure if private keys are well stored. A private key is a secret code that allows someone to access their crypto assets. It’s true that in DeFi – unlike in centralized crypto finance where an exchange holds private keys – users have full control over their own private keys.

But even with perfect private key management, users can still lose funds by interacting with compromised DeFi platforms. That’s because safeguarding private keys can prevent only direct attacks targeting private key access, such as phishing attempts.

The people we spoke with also failed to follow best practices for securing their private keys. Using a hardware wallet – a physical device that stores private keys offline – is one of the most secure options for protecting keys from online threats. However, our study found that only a handful of participants actually used hardware wallets.

Mistake 3: Thinking 2-factor authentication is a silver bullet

Two-factor authentication, or 2FA, is a standard security mechanism in which two forms of verification are required to access an account. Think being texted a one-time code before you can log into your bank account.

To prevent account breaches, centralized crypto exchanges such as Binance and Coinbase use two-factor authentication for logins, account recovery and withdrawal confirmations. But while 2FA is crucial to security in the traditional and centralized crypto finance system, it plays a much smaller role in decentralized finance.

DeFi wallets give users access based on private key ownership rather than identity verification, which means traditional 2FA can’t be used. Instead, only 2FA-like mechanisms are available in DeFi. For instance, multisignature wallets require approval from multiple private key holders. However, if your private key is compromised, attackers can perform wallet operations on your behalf without any additional verification. In addition, even users who adopt 2FA-like measures can’t prevent the security breaches on the DeFi services’ end.

Unfortunately, our participants were overly confident regarding the effectiveness of 2FA, with one saying, “Two-factor authentication has been one of the best solutions for keeping wallets safe.” In our survey, 57.1% of users relied on 2FA as their only technical countermeasure against rug pulls – scams where project creators suddenly withdraw funds – and 49.3% did so for smart contract exploits. This misplaced trust could lead them to ignore more effective security strategies.

Mistake 4: Not managing token approvals

One such effective strategy is revoking token approvals. In DeFi, tokens are digital assets on a blockchain that represent value or rights, and users often need to approve smart contracts to access or spend them. But if you leave these approvals open, a malicious contract – or one that’s been hacked – can drain your wallet. So it’s crucial to routinely check all token approvals you’ve granted to prevent losses caused by fraudulent or hacked DeFi services. Specifically, you should limit spending allowances instead of using the default “unlimited” option, and revoke approvals for apps you no longer use or trust.

Worryingly, we found that only 10.8% and 16.3% of participants regularly checked and revoked token approvals to protect against rug pulls and smart contract exploits, respectively. In light of this, we recommend that wallet providers introduce a reminder feature to prompt users to review their token approvals periodically.

Mistake 5: Not learning from past incidents

Even after they’re hacked or scammed, people often don’t do anything to improve their security practices, we found. Just 17.6% of those who reported being victims of a DeFi scam regularly checked token approvals afterward. Worse, 26% took no action at all after a scam, and 16.4% doubled down by investing even more in other DeFi services.

Surprisingly, more than half of the victims said their belief in DeFi either stayed the same or grew stronger after the incident. One user who lost $4,700 due to a rug-pull incident said, “My belief in cryptocurrency has grown stronger after that because I made good money from it.” That person added, “An opportunity to make money is something I believe in.” This suggests that DeFi users’ financial motivations can sometimes outweigh their security concerns – and, perhaps, their better judgment.

There’s no one-size-fits-all solution to DeFi security. But awareness is the first step. To stay safe, crypto investors should use hardware wallets, revoke unused token approvals and continually learn new techniques to protect themselves from evolving threats. Most importantly, they should stay rational and not let the allure of profits cloud their security practices.

About the Author:

Mingyi Liu, Ph.D. student in Computer Science, Georgia Institute of Technology

This article is republished from The Conversation under a Creative Commons license. Read the original article.