{"id":197854,"date":"2026-03-21T00:08:00","date_gmt":"2026-03-21T04:08:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/21\/thai-crypto-billionaire-on-the-run-fbi-tokens-and-other-cybersecurity-highlights\/"},"modified":"2026-03-21T00:20:29","modified_gmt":"2026-03-21T04:20:29","slug":"thai-crypto-billionaire-on-the-run-fbi-tokens-and-other-cybersecurity-highlights","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/03\/21\/thai-crypto-billionaire-on-the-run-fbi-tokens-and-other-cybersecurity-highlights\/","title":{"rendered":"Thai crypto billionaire on the run, \u2018FBI\u2019 tokens and other cybersecurity highlights"},"content":{"rendered":"

Thai crypto billionaire on the run, \u2018FBI\u2019 tokens and other cybersecurity highlights<\/a><\/p>\n

https:\/\/forklog.com\/en\/thai-crypto-billionaire-on-the-run-fbi-tokens-and-other-cybersecurity-highlights\/<\/a><\/p>\n

Publish Date: 2026-03-21 00:08:00<\/a><\/p>\n

Source Domain: forklog.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points. <\/p>\n

This week\u2019s top cybersecurity: 1000X scandal, FBI seizures, Nordstrom scam, fake \u2018FBI\u2019 tokens.<\/p>\n

\t\t\t We have gathered the week\u2019s most important cybersecurity news.<\/p>\n

Thai investors accused the head of 1000X of a $42m fraud.
\nCo-founder of a $1m crypto pyramid scheme detained in Kyiv.
\nThe FBI seized Iranian hackers\u2019 websites after a large-scale attack on the healthcare sector.
\nNordstrom customers targeted by a crypto scam.<\/p>\n

Thai investors accuse 1000X boss of $42m fraud
\nThai law enforcers are searching for billionaire and crypto-industry pioneer Worawat Narknawdee, Thai PBS reports.
\nA case was opened after users of the crypto platform 1000X went to the police. The damage is estimated at roughly 1.39bn baht (~$42m at the time of writing).
\nIn March 2023, SEC filed a complaint with the Cyber Crime Investigation Bureau, accusing Narknawdee of running 1000X without a licence. According to media reports, before launching his crypto venture he was the lead singer of the rock band DoubleDeep, whose members were active investors. He later founded the Traderist community, where he offered free public education on handling cryptocurrencies.
\nThrough investments since 2012, the trader amassed about 11,000 BTC. His company ACET became one of the industry\u2019s fastest-growing.
\nWorawat Narknawdee listed among Thailand\u2019s top five forex traders. Source: Traders Union.
\nHowever, data from the Department of Business Development revealed another side of his activities. According to Creden Data, Narknawdee owns two companies: Bitnance Company (a loss of ~30m baht) and Great Begins Company (a debt of ~5.8m baht).
\nPolice say the billionaire fled to the UAE, where he owns property, a hotel business and other assets.
\nCo-founder of $1m crypto pyramid detained in Kyiv
\nUkrainian law enforcement uncovered a ring that appropriated funds under the guise of crypto investments. One of the scheme\u2019s co-founders was detained in Kyiv, reported the Cyber Police.
\nAccording to investigators, since 2022 the group built a network of financial pyramids across Ukraine. They urged citizens to invest in their own token, promising steady returns. In practice, payouts came from new investors and were distributed via pyramid or binary commission schemes.
\nThe founder and his spouse promoted the project on Instagram, with other bloggers amplifying the ads. Losses totalled about $1m.
\nPolice searched suspects\u2019 residences in Khmelnytskyi, Odesa, Chernihiv and Poltava regions, seizing computer equipment, notes and a car.
\nOne participant was notified of suspicion of fraud, an offence punishable by up to eight years in prison.
\nFBI seizes Iranian hackers\u2019 websites after major attack on the healthcare sector
\nThe FBI seized two websites used by the hacktivist group Handala after a destructive cyberattack on medtech giant Stryker, reports BleepingComputer.
\nThere has been no official statement from law enforcement about the seizures. However, the domains\u2019 DNS servers were switched to those the FBI typically uses when taking sites offline.
\nFBI \u2018splash page\u2019 on one of Handala\u2019s sites. Source: BleepingComputer.
\nMedia say Handala (also known as Handala Hack Team, Hatef, Hamsa) is an Iran-linked hacktivist group that emerged in December 2023. Its operations are associated with the country\u2019s Ministry of Intelligence and Security. It has targeted Israeli organisations using wiper malware for Windows and Linux.
\nThe takedowns followed a mass attack by Handala on March 11th 2026. The hackers compromised a Windows domain administrator account and factory-reset about 80,000 devices, including employees\u2019 PCs and mobile phones. The attackers claimed to have stolen 50 terabytes of data before wiping.
\nAfter the incident, CISA urged US organisations to follow Microsoft\u2019s updated guidance to harden defences.
\nNordstrom customers hit by crypto scam
\nIn the US, customers of high-end fashion department store chain Nordstrom received scam emails offering to double their crypto-wallet balances, reports BleepingComputer.
\nEmails promised a 200% return on any cryptocurrency sent to a listed bitcoin address. Victims were given two hours to decide \u2014 a ploy to create urgency.
\nThe messages appeared to originate from an official sender the company uses for marketing, indicating a security breach. Some customers said the email reached an address that had never been disclosed or leaked online.
\nAs of March 18th, more than $5,600 had been sent to the scammers in cryptocurrency. According to a blockchain explorer, on March 20th the wallet held just 0.00001386 BTC.
\nScammers airdropped TRC-20 tokens posing as the FBI
\nOn March 19th the FBI warned crypto investors about a new phishing scheme in which scammers, posing as the agency, distributed fake tokens.<\/p>\n

FBI New York encourages users of the Tron blockchain network to exercise caution if they encounter a token purported to be from the FBI. If you receive a token from an account with the details below, do not provide any identifying information to any website associated with such\u2026 pic.twitter.com\/VF03sjM4VW
\n\u2014 FBI New York (@NewYorkFBI) March 19, 2026<\/p>\n

Unknown TRC-20 tokens labelled \u201cFBI tokens\u201d landed in users\u2019 wallets, followed by ultimatum messages. The scammers alleged the owner was suspected of money laundering and threatened to freeze assets. To \u201cavoid a block,\u201d victims were told to visit a third-party site for an AML check and to disclose personal data.
\nThe number of victims is being determined.
\nAlso on ForkLog:<\/p>\n

Average losses from hacks in the crypto industry hit $25m.
\nHype around OpenClaw sparked a wave of phishing attacks on crypto wallets.
\nThe Lazarus group is suspected of attacking the Bitrefill service.
\nVenus Protocol lost $2m due to manipulation of the THE token.<\/p>\n

What to read this weekend?
\nIn a new feature, ForkLog explains why it is perfectly fine to stay away from gadgets and the internet.<\/p>\n

\t\t\t\t\u041f\u043e\u0434\u043f\u0438\u0441\u044b\u0432\u0430\u0439\u0442\u0435\u0441\u044c \u043d\u0430 ForkLog \u0432 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u044f\u0445<\/p>\n

Found a mistake? Select it and press CTRL+ENTER<\/p>\n

\t\t\t\t\u0420\u0430\u0441\u0441\u044b\u043b\u043a\u0438 ForkLog: \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u0440\u0443\u043a\u0443 \u043d\u0430 \u043f\u0443\u043b\u044c\u0441\u0435 \u0431\u0438\u0442\u043a\u043e\u0438\u043d-\u0438\u043d\u0434\u0443\u0441\u0442\u0440\u0438\u0438!<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Thai crypto billionaire on the run, \u2018FBI\u2019 tokens and other cybersecurity highlights https:\/\/forklog.com\/en\/thai-crypto-billionaire-on-the-run-fbi-tokens-and-other-cybersecurity-highlights\/ Publish Date:…<\/p>\n","protected":false},"author":1,"featured_media":197855,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/forklog.com\/wp-content\/uploads\/img-162813c4779cb0c2-4082025297322405.webp","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[30,24,32,25],"class_list":["post-197854","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-breach","tag-cybersecurity","tag-malware","tag-phishing"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197854"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=197854"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197854\/revisions"}],"predecessor-version":[{"id":197856,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/197854\/revisions\/197856"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/197855"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=197854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=197854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=197854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}