Crypto Crime Roundup: 15,000 BNB Returned, a Hacker Convicted and a SIM-Swapper Jailed

Three crypto crime stories from the past few days: a BNB Chain project got most of its stolen funds back, a US jury convicted the man behind a 2021 decentralised-exchange hack, and a London court jailed a fraudster who hijacked phone numbers to steal crypto. Two small exploits flagged by a security firm round it off.

Spotted via PeckShieldAlert (@PeckShieldAlert) on X and SlowMist (@SlowMist_Team) on X. PeckShield’s dollar figures are its own estimates; the project itself gives amounts only in BNB.

79thVault: 15,000 BNB returned

Confirmed (project statement). The team behind the 79AU token on BNB Chain, which posts as 79thVault, said that on 7 October the project “was hit by a malicious attack stemming from weaknesses in account permission management”. It said the attacker “obtained an operator’s private key” and used it to withdraw tokens, then converted them “on-chain into USDT and further into BNB” [1]. A later post put the incident at “16,249 BNB” [2].

Estimate. The blockchain security firm PeckShield put the haul at “16.249K $BNB (~$12.51M)” on 8 October [3]. Bitquery’s reconstruction, as reported by FinanceFeeds, puts the total at “approximately $14.35 million in USDT removed from the pool” (reported; not a post-mortem) [7].

Confirmed: the return. On 9 October PeckShield said the attacker “has returned 15K $BNB (~$11M) to the team’s designated wallet address” [4], and CertiK reported the same [5]. The project confirmed at 14:28 BST: “We have successfully recovered 15,000 BNB from the attacker”, adding that the funds will go back into the liquidity pool [6]. Its 8 October statement said a “white-hat settlement offer under a bug-bounty framework” had been made [1]; it has not said whether the attacker keeps the remainder. No technical post-mortem has been published.

Uranium Finance hacker convicted

Confirmed (prosecutors’ release). The US Attorney’s Office for the Southern District of New York said on 7 October that Jonathan Spalletta, 36, of Rockville, Maryland, was “convicted on all counts” of computer fraud and money laundering after a six-day jury trial before Judge Jed S. Rakoff [8].

Prosecutors say he hacked Uranium Finance, a decentralised exchange, twice in April 2021. The first hack took “approximately $1.4 million”; the second, on 28 April 2021, obtained “approximately $53.3 million in cryptocurrency”, “causing Uranium to shut down due to lack of funds” [8]. He laundered funds through the mixer Tornado Cash and bought rare trading cards and antique Roman coins, prosecutors say. Crypto worth “approximately $31 million at the time of seizure” was seized in February 2025 [8].

The charges carry maximum sentences of 10 and 20 years; the judge decides the actual sentence [8]. Reported: sentencing is set for 16 February 2027, according to Bloomberg as cited by Crypto Briefing and The Straits Times [9][10]. The SDNY release does not give a date.

London SIM-swap fraudster jailed

Confirmed (police release). City of London Police said Ajay Shinjin, 25, of Marsh Wall, Canary Wharf, was sentenced at Inner London Crown Court on 8 October to two and a half years for helping “steal almost £200,000 worth of cryptocurrency” through SIM-swap fraud [11][12]. He “received more than £44,000 of the stolen funds”, and pleaded guilty on 28 September to conspiracy to commit fraud by false representation and transferring criminal property [11].

SIM swapping means moving a victim’s phone number to a SIM card criminals control, so they receive the one-time passcodes sent by text. Police say BT spotted the unauthorised activity in early November 2021 and its data helped identify suspects [11].

Also flagged: two small DeFi exploits

Reported by SlowMist only; neither project has published a post-mortem. SlowMist put a loss on BitBay’s vault at “~$14K”, about 14,838 DAI on Polygon, caused by a flaw in how the vault paid out withdrawals [13]. It put a loss on EtherVista at “~18.6K” after a calculation bug in a trading pool [14]. SlowMist gives no unit for the EtherVista figure, so TSN does not add one.

What this does not prove

• That 79thVault’s users are made whole. The project has recovered 15,000 of 16,249 BNB by its own figures; how it handles the rest is not stated [2][6].
• That Spalletta’s sentence is decided. Sentencing is still to come; the maximums are not predictions [8].
• That the SlowMist figures are final. They are one firm’s early alerts [13][14].

The Bottom Line

Most of 79thVault’s stolen BNB is back, a 2021 DeFi hack has ended in a conviction, and a SIM-swapper is in prison. Each case is a reminder that crypto theft often leaves a trail.

Related on TSN: What Is DeFi? Decentralised Finance Explained in Plain English

Sources

1. 79AU Core Team (@79thVault), X statement, 8 October 2026, 18:15 BST (read via the X API; project statement). https://x.com/79thVault/status/2108244949963833685
2. 79thVault (@79thVault), X post, 9 October 2026, 11:17 BST (read via the X API; gives “16,249 BNB”). https://x.com/79thVault/status/2108502065899303255
3. PeckShieldAlert (@PeckShieldAlert), X post, 8 October 2026, 10:53 BST (read via the X API; security firm’s estimate). Its “10K $79AU drained” conflicts with other firms’ counts, so TSN does not use it. https://x.com/PeckShieldAlert/status/2108133701448327326
4. PeckShieldAlert (@PeckShieldAlert), X post, 9 October 2026, 14:18 BST (read via the X API; first seen here). Its “~$11M” is the firm’s own conversion. https://x.com/PeckShieldAlert/status/2108547620855750865
5. CertiK Alert (@CertiKAlert), X post, 9 October 2026, 10:57 BST (read via the X API). https://x.com/CertiKAlert/status/2108497100665487361
6. 79thVault (@79thVault), “79VAULT Recovery Update”, X post, 9 October 2026, 14:28 BST (read via the X API; project statement). https://x.com/79thVault/status/2108550265100288418
7. FinanceFeeds, “79thVault loss rises to $14.35M as second 79AU seller emerges” (reports Bitquery’s reconstruction; reported). https://financefeeds.com/79thvault-loss-rises-to-14-35m-as-second-79au-seller-emerges/
8. US Attorney’s Office, SDNY, “Jonathan Spalletta Convicted For Defrauding Crypto Exchange Of Over $50 Million In Hacks”, press release 26-285, 7 October 2026 (read directly). https://www.justice.gov/usao-sdny/pr/jonathan-spalletta-convicted-defrauding-crypto-exchange-over-50-million-hacks-0 ; also on X: https://x.com/SDNYnews/status/2107894427532292158
9. Crypto Briefing, “Jonathan Spalletta convicted in $55 million Uranium Finance theft”, 7 October 2026 (citing Bloomberg; reported). https://cryptobriefing.com/uranium-finance-hacker-spalletta-found-guilty/
10. The Straits Times, “Pokemon collector found guilty in US$55 million crypto hack case” (reported). https://www.straitstimes.com/world/united-states/pokemon-collector-found-guilty-in-us55-million-crypto-hack-case
11. City of London Police, “SIM-swap fraudster who spent stolen crypto cash on gold grills and luxury holidays jailed”, 8 October 2026, 12:15 (read directly). https://www.cityoflondon.police.uk/news/city-of-london/news/2026/october/sim-swap-fraudster-who-spent-stolen-crypto-cash-on-gold-grills-and-luxury-holidays-jailed/
12. City of London Police (@CityPolice), X post, 8 October 2026, 12:28 BST (read via the X API). https://x.com/CityPolice/status/2108157701801046470
13. SlowMist (@SlowMist_Team), X alert on BitBay, 9 October 2026, 04:28 BST (read via the X API; security firm’s report). https://x.com/SlowMist_Team/status/2108399198035202138
14. SlowMist (@SlowMist_Team), X alert on EtherVista, 9 October 2026, 06:20 BST (read via the X API; no unit given for the loss). https://x.com/SlowMist_Team/status/2108427455572918626