A roundup of security items that did not warrant standalone coverage today, with verification status noted for each.
South Korea: Crypto Flowed From a Terror Group, Not Just To It
South Korean police have charged four Uzbek nationals with terrorism financing in a case prosecutors describe as the first involving cryptocurrency flowing out of a designated terrorist organization and returning as physical goods.
The Gwangju Metropolitan Police Agency's security investigation division arrested the four in April under the Act on the Prohibition of the Financing of Terrorism and disclosed the case Tuesday, as reported by Decrypt and Korea's JoongAng Daily. The alleged ringleader — who police say was wanted on an Interpol Red Notice — has been indicted, detained and is on trial, while the other three remain under investigation without detention.
Between August 2024 and April 2025, police allege the ringleader sent 4,267 USDT across seven transfers to Katibat Tawhid wal Jihad, a Syria-based group designated by the United Nations and the United States. Prosecutors also accuse him of receiving cryptocurrency from the group and using it to purchase 11 used cars and two excavators — roughly $121,000 worth — that were shipped to Syria.
The defendant denied the main charges at his first hearing in June, according to JoongAng Daily. Verification: two independent outlets, both citing official police statements. (Attribution: alleged throughout.)
Coldcard: Galaxy Research Puts Losses at 1,789 BTC, 87% Unmoved
Galaxy Research's updated tally attributes 1,789 BTC in losses to the Coldcard seed-generation vulnerability disclosed in August, with 87% of the stolen funds still unmoved across 221 victim reports. More than half of those reports involved individual losses exceeding 1 BTC.
The unmoved majority matters for recovery prospects: dormant stolen Bitcoin typically reflects an attacker waiting out blockchain surveillance rather than lost keys. Verification: Galaxy Research's on-chain analysis, covered by Cointelegraph. TrustGrade's coverage of the original firmware flaw and its implications for hardware-wallet supply chains ran Aug. 31.
Chainalysis: Operation Lighthouse Flags 7,700 Accounts
A Chainalysis-led investigation dubbed Operation Lighthouse generated 14,300 investigative leads across 11 crypto exchanges and payment services and flagged more than 7,700 suspect accounts in a child sexual abuse materials probe, Cointelegraph reported Aug. 25, citing the firm.
The operation's scale illustrates how transaction analysis has become infrastructure for law enforcement beyond financial crime. Verification: Chainalysis as primary source with single-outlet coverage; figures are the firm's own and not independently audited.