Romanian and Dutch Police Investigations Into Crypto-Enabled Online Crime
Romanian authorities, acting on a request from the UK, investigated two Romanian nationals suspected of operating a hitman-for-hire marketplace designed to conceal identities and payments. Prosecutors said the platform relied exclusively on cryptocurrency, held user funds in escrow until “jobs” were completed, and was structured to make financial flows difficult to trace; searches in Bucharest and Ramnicu Valcea reportedly resulted in the seizure of electronic storage devices, approximately $650,000 in cryptocurrency, and significant cash holdings. Potential charges cited include forming an organized criminal group, incitement to murder, attempted murder, and money laundering.
Separately, police in Zeeland, the Netherlands arrested four suspects following a tip linking them to the theft of 169 NFTs valued at roughly €1.4 million; the operation included seizure of data carriers, money, vehicles, and a residence, though the suspects were later released after interrogation as the investigation continued. The case highlights how blockchain-based assets (including NFTs) remain attractive targets for theft and fraud, with common access vectors including phishing, social engineering, malware, and seed phrase theft, and underscores the evidentiary role of seized digital media in crypto-asset investigations.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Romanian authorities seize devices, cryptocurrency, and cash
During the searches tied to the alleged murder-for-hire marketplace, authorities seized electronic storage devices, cryptocurrency, and significant amounts of cash. Prosecutors said the suspects could face charges including organized crime, incitement to murder, attempted murder, bodily harm offenses, and money laundering.
Romanian police search properties in alleged hitman-for-hire case
At the request of British authorities, Romanian police carried out three searches in Bucharest and Ramnicu Valcea targeting two Romanian nationals suspected of operating a hitman-for-hire website. Investigators alleged the platform used cryptocurrency-only payments and an escrow-like mechanism to obscure users and financial flows.
Dutch investigators seize assets in ongoing NFT heist probe
As part of the Netherlands NFT theft investigation, authorities seized data carriers, cash, three vehicles, and the raided house. The seized materials were described as part of an ongoing effort to build evidence for possible future prosecution.
Dutch police arrest four suspects over €1.4 million NFT theft
Police in Zeeland, the Netherlands arrested four suspects—three from Axel and one from Terneuzen—after a tip linked them to the theft of 169 NFTs valued at about €1.4 million. The suspects were questioned and later released as the investigation continued.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
Romania probes two suspects over alleged hitman-for-hire website | The Record from Recorded Future News
therecord.media
Open sourceFour arrested following $1.6 million NFT heist in the Netherlands - data carriers, cash, cars, and house also seized as part of ongoing investigation | Tom's Hardware
tomshardware.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European and U.S. Law Enforcement Actions Against Cyber-Enabled Crime
Multiple law-enforcement actions were reported across Europe and the U.S. targeting **cyber-enabled criminal activity**, including online intimidation, financial malware operations, and crypto/NFT theft. In Hungary, police working with Romanian authorities detained four young suspects accused of **swatting** and **doxing** tied to disputes initiated via *Discord*, including false bomb and violence threats that triggered significant emergency response deployments. Separately, U.S. authorities convicted two Venezuelan nationals for a multi-state **ATM jackpotting** operation in which they physically accessed older ATMs, connected a laptop, and deployed **malware** to force cash dispensing, resulting in hundreds of thousands of dollars in losses and restitution orders. In Romania, two suspects were investigated at the request of UK authorities over an alleged **hitman-for-hire** marketplace designed to conceal identities and payments via **cryptocurrency escrow**, with police seizing storage devices, crypto valued around **$650,000**, and significant cash. In the Netherlands, Zeeland police arrested four suspects linked to the theft of **169 NFTs** valued at roughly **€1.4 million**, seizing data carriers, cash, vehicles, and a house during raids as the investigation continued.
Mar 21, 2026
US Law Enforcement Actions Targeting Crypto-Enabled Crime and Illicit Marketplaces
US authorities reported multiple enforcement actions tied to **crypto-enabled crime**. In the Empire Market case, prosecutors said co-creators **Raheim Hamilton** and **Thomas Pavey** designed the dark web marketplace to help users evade law enforcement and launder proceeds; the market allegedly facilitated about **$430M** in transactions (drugs, stolen payment data, counterfeit currency) before disappearing in 2020 in what investigators described as an exit scam that stole an estimated **$30M** in bitcoin. Hamilton pleaded guilty to federal drug conspiracy charges and agreed to forfeit roughly **1,230 BTC** plus **24.4 ETH** and real estate; Pavey previously pleaded guilty and agreed to forfeit about **1,584 BTC** and other assets. Separately, reporting highlighted alleged misuse and laundering of digital assets in other contexts. On-chain investigator **ZachXBT** traced movements from wallets associated with **US-seized crypto** (held under U.S. Marshals Service custodianship) to wallets allegedly linked to **John Daghita**, the son of a federal contractor executive, with claims of roughly **$23M** in diverted cryptocurrency and another wallet holding about **$36M** in Ethereum; ZachXBT said he alerted the **U.S. Marshals Service**. In another DOJ case, **Jingliang Su** (a Chinese national) was sentenced to **46 months** for laundering proceeds from a cryptocurrency investment fraud that authorities said victimized **174** people for **$36.9M**, using social engineering via social media/dating platforms and counterfeit trading sites, with **$26.9M** restitution ordered and multiple US agencies involved in tracing funds and dismantling the network.
Mar 21, 2026
Major International Law Enforcement Actions Against Cybercrime and Financial Fraud Networks
Law enforcement agencies across multiple countries have conducted significant operations targeting cybercriminal groups responsible for large-scale financial fraud, data breaches, and cryptocurrency theft. In Spain, police arrested a 19-year-old hacker accused of stealing and attempting to sell 64 million personal data records from nine companies, while Ukrainian authorities apprehended a separate data broker who used custom malware to compromise accounts and sell access on hacker forums. In California, a member of the so-called "Social Engineering Enterprise" pleaded guilty to laundering millions in cryptocurrency stolen through sophisticated social engineering attacks, with the group responsible for a $263 million heist and extravagant spending of the proceeds. Meanwhile, Russian police dismantled a gang that used NFCGate-based malware to steal millions from bank customers by tricking victims into installing fake banking apps and harvesting card credentials for remote theft. A major international operation led by Europol and Eurojust dismantled a €700 million cryptocurrency scam network in Europe that used deepfake videos and aggressive marketing to lure victims into fake investment schemes. The network operated numerous fraudulent platforms, laundered funds through complex channels, and was taken down in coordinated raids across several countries, resulting in arrests and the seizure of cash, cryptocurrencies, and luxury items. These actions highlight the growing sophistication of cyber-enabled financial crime and the increasing collaboration between law enforcement agencies to disrupt such operations on a global scale.
Mar 21, 2026