Connect with us

NEWS

SEBI Names Claude Mythos, Sets Up cyber-suraksha.ai Task Force

Published

on

India’s markets regulator named a specific frontier AI model in a regulatory circular on May 5, 2026, a first for the country. The Securities and Exchange Board of India called out Anthropic’s Claude Mythos by name, ordered every regulated entity from clearing corporations to merchant bankers to overhaul their cyber defences, and stood up a fresh task force called cyber-suraksha.ai to coordinate the response.

The advisory lands at an awkward moment for the industry. Mythos Preview is currently locked behind defender-only access through Anthropic’s Project Glasswing coalition, yet SEBI is already treating its capability profile as the new floor for adversary modelling. The regulator told brokers, depositories, asset managers and credit-rating agencies to assume that what one AI lab built, another can replicate.

What SEBI Actually Ordered On May 5

SEBI’s circular flags AI-driven vulnerability identification tools, citing Mythos as the example, as a category that introduces “new dimensions of risks for regulated entities.” The language is unusually direct for a financial regulator. The advisory says these tools “may give rise to heightened risk exposure by enabling identification and potential exploitation of existing vulnerabilities using speed and scale.”

The reach is wide. The order covers stock brokers, mutual funds, alternative investment funds, portfolio managers, custodians, KYC registration agencies, research analysts, depositories, and stock exchanges, every class of entity supervised under the SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) circular of August 2024. The new advisory layers on top of that framework rather than replacing it.

SEBI Chairman Tuhin Kanta Pandey had previewed the move on May 4, telling reporters the regulator would issue an “initial advisory” because technology risks “cannot be viewed in isolation at the entity level” in an interconnected market. The circular followed within twenty-four hours.

The Tool Behind The Warning

Claude Mythos Preview is the unreleased frontier model Anthropic disclosed on April 14, 2026. The company’s own Anthropic red team disclosure on Mythos Preview’s offensive capabilities says the model has already surfaced thousands of high-severity zero-day vulnerabilities across every major operating system and every major web browser.

In one demonstration, Mythos Preview chained four separate vulnerabilities into a single browser exploit. It wrote a JIT heap spray that escaped both the renderer sandbox and the operating system sandbox. It then chained a local privilege escalation on Linux by exploiting subtle race conditions and KASLR bypasses on its own.

The independent benchmarks tell the same story. The UK government’s AI Security Institute evaluation of Mythos Preview’s cyber capabilities, published April 14, found the model passes 73% of expert-level offensive tasks that no model could complete a year earlier. It became the first AI to fully solve The Last Ones, a 32-step corporate network attack range AISI estimates would take human red teams roughly twenty hours, doing it three times across ten attempts.

Anthropic has not made Mythos public. Access flows through Anthropic’s Project Glasswing coalition page, which lists Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia and Palo Alto Networks as launch partners, plus around forty additional organisations that build or maintain critical software.

None of those forty are Indian market intermediaries. That gap is the point of SEBI’s circular.

Inside cyber-suraksha.ai

The task force draws representatives from market infrastructure institutions, qualified registrars and transfer agents, qualified regulated entities, and other stakeholders. The coordinating address is project-cyber-suraksha.ai@sebi.gov.in. Its mandate is to study AI-led cyber risks and write a uniform mitigation playbook every regulated entity can plug into.

SEBI has asked the group to push four work streams in parallel:

  • Threat intelligence sharing across MIIs, QRTAs and REs, with priority reporting on cyber incidents, attack vectors and newly discovered vulnerabilities.
  • Vulnerability management playbooks built specifically around AI-driven exploitation patterns rather than legacy threat models.
  • Third-party vendor reviews, including audits of empanelled application service providers used by exchanges and depositories.
  • Response coordination drills built around AI-driven scenarios, not just the conventional ransomware tabletop exercise.

The Patch-And-Lock Order

The operational instructions in the advisory read like a blunt to-do list. Update operating systems and applications immediately. Where vendor patches are not available, use virtual patching as an interim shield. Run vulnerability assessments using both conventional scanners and AI-based tools, and run them more often.

SEBI also pushed harder on perimeter and identity hygiene. Entities have been told to tighten API security with strong authentication, rate limiting and whitelist-based access. They have been told to maintain an updated asset inventory, harden every system, and adopt Zero Trust Network designs to shrink the attack surface. Continuous monitoring through a Security Operations Centre is no longer treated as best practice. It’s the floor.

The numbers explain the urgency:

  • 2.72 billion cyberattacks absorbed by India’s banking sector in the past year, per industry application-security telemetry cited in CERT-In’s April advisory.
  • 73% expert-task pass rate for Mythos Preview, the highest ever recorded by AISI for an offensive cyber benchmark.
  • 32 steps in the corporate attack range Mythos completed end to end without human help.
  • 4 chained vulnerabilities stitched into a single autonomous browser exploit during Anthropic’s internal red-team runs.

Pandey has framed the response as preparedness rather than restriction. “In an interconnected securities market, a single weak link can create wider risks,” he said in his May 4 briefing, telling regulated entities the focus is on faster remediation rather than reactive enforcement.

Why M-SOC Suddenly Matters

The advisory leans hard on the Market Security Operations Centre, the joint platform built by the National Stock Exchange of India and BSE Limited. SEBI calls it a “centralized security platform” delivering 24×7 real-time monitoring and threat detection, and has told eligible entities that have not yet onboarded with M-SOC to do so quickly.

That nudge is significant because most smaller intermediaries, the broker with twelve branches, the regional registrar, the boutique research analyst, do not run a 24×7 SOC of their own. The CSCRF framework was already pushing them toward shared infrastructure. The Mythos advisory turns that push into a deadline conversation.

A Wider Pattern Forming Around Frontier AI

SEBI is not acting alone. The Indian Computer Emergency Response Team published its own high-severity warning on frontier AI agents in late April, telling Indian organisations and MSMEs that “frontier agentic” models can plan, execute and complete multi-step attacks faster than human analysts can triage them. The full text is on the CERT-In national agency portal for cyber incident response.

Cryptographer Bruce Schneier has been blunt about what changes when models like Mythos exist outside the lab. “Every defender now has access to the same scanning tool the attackers will eventually have, and the gap between those two timelines is the only thing that matters,” he wrote in Schneier on Security’s analysis of Mythos Preview and Project Glasswing, published April 24.

Mythos Preview is capable of identifying and then exploiting zero-day vulnerabilities in every major operating system and every major web browser when directed by a user to do so.

That line, taken straight from Anthropic’s own disclosure, is the single sentence circulating among CISOs at Indian brokerages this week. SEBI’s circular is the regulator’s reaction to it. The benchmark race tightened further when OpenAI’s GPT-5.5 was tested by AISI, a story we covered in detail in our analysis of GPT-5.5 reaching cyber parity with Mythos Preview on AISI’s hardest suite.

The strategic question for regulated entities is no longer whether AI-led offensive tools are real. It’s how quickly the defender side of that asymmetry can be built into day-to-day operations. SEBI has answered: now.

Frequently Asked Questions

Does The SEBI Advisory Apply To Retail Investors Or Only To Regulated Entities?

The advisory is addressed to regulated entities, not retail clients. That covers your broker, your depository participant, your mutual fund house, your registrar, and the exchanges themselves. As a retail investor, you don’t have to file anything. But your broker now has a deadline-style obligation to patch faster, monitor harder, and onboard with the Market SOC if eligible. Expect to see updated KYC and login flows over the coming months.

How Do I Check If My Broker Is Onboarded To The Market SOC?

Ask in writing. Email your broker’s compliance officer or use the grievance form on their website and request confirmation of M-SOC onboarding status under the SEBI advisory dated May 5, 2026. Brokers must respond. You can also check the SEBI complaints portal at scores.sebi.gov.in if you don’t get a clear answer within fifteen working days. Confirmation should reference the CSCRF framework explicitly.

Can I Still Use AI Tools For My Own Trading Or Portfolio Research?

Yes. SEBI’s advisory targets AI-driven vulnerability detection and exploitation tools used against market infrastructure, not consumer AI chat tools used for research. Using ChatGPT, Claude or Gemini to summarise an annual report or screen stocks is unaffected. Just remember that none of those tools is a registered investment adviser, and feeding them confidential trading credentials or PAN-linked data carries its own privacy risk independent of this advisory.

What Happens If A Regulated Entity Ignores The May 5 Circular?

SEBI advisories carry the same enforcement weight as a directive under the SEBI Act for regulated entities. Non-compliance can trigger inspections, monetary penalties, and in serious cases suspension of registration. The CSCRF framework already has graded penalty structures, and the cyber-suraksha.ai task force is expected to feed enforcement signals into SEBI’s supervisory cycle. Inspections starting later this year will likely include AI-readiness as a checkpoint.

Is Claude Mythos Available For Anyone To Download Or Use?

No. Mythos Preview is not a public Anthropic product. Access is granted only through Project Glasswing, a defender-side coalition that includes AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, Nvidia, Palo Alto Networks, the Linux Foundation, and roughly forty additional organisations vetted by Anthropic. Indian market intermediaries are not on that list today. That asymmetry is exactly what SEBI’s advisory is trying to plan around.

The Mythos circular is the most specific frontier-AI warning any major financial regulator has issued so far this year, and it sets a template other Indian regulators are likely to follow. The Reserve Bank of India and the Insurance Regulatory and Development Authority have both been watching cyber-suraksha.ai’s formation closely. What SEBI does next, particularly the first set of enforcement actions tied to the advisory, will tell the rest of Indian finance how seriously to take frontier-model risk.

Logan Pierce is a writer and web publisher with over seven years of experience covering consumer technology. He has published work on independent tech blogs and freelance bylines covering Android devices, privacy focused software, and budget gadgets. Logan founded Oton Technology to publish clear, no nonsense tech news and reviews based on real hands on testing. He has personally tested and reviewed dozens of mid range and budget Android phones, written extensively about app privacy, and built and managed multiple WordPress publications over the past decade. Logan holds a bachelor's degree in English and studied digital marketing at a certificate level.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

CRYPTO

Britain Sanctions HTX Crypto Exchange Over Kremlin Money Network

Published

on

Britain sanctioned HTX on May 26, placing the exchange formerly known as Huobi Global on a list of 18 entities accused of helping Russia fund its war in Ukraine. The U.K. Foreign, Commonwealth and Development Office named Huobi Global S.A., a Panama-registered company, as suspected of channeling $1.5 billion to the Kremlin through two Russian financial networks: A7 Limited Liability Company, a Kremlin-backed cross-border settlement platform, and Garantex Europe OU, a Moscow-based crypto exchange already sanctioned by U.S. authorities.

For Justin Sun, the Tron blockchain founder who serves on the exchange’s global advisory board, the designation lands at the worst possible moment. Sun spent roughly $200 million building political proximity in Washington through Trump-family crypto investments, watched the U.S. Securities and Exchange Commission (SEC) settle a yearslong fraud case against him for $10 million in March, then sued the Trump family’s flagship crypto venture for alleged fraud in April. London paid none of that any mind.

A New Class of Crypto Sanction

The May 26 action represents something qualitatively different from earlier regulatory moves against the exchange. Blockchain analytics firm Elliptic confirmed that Britain applied Regulation 17A of the Russia (Sanctions) (EU Exit) Regulations 2019, marking the first time the U.K. has used those provisions against a crypto exchange. The May 26 Russia sanctions designations on GOV.UK took effect immediately upon publication.

The scope of the measures is broad. Under the designation, the platform faces:

  • A full asset freeze on all funds held within U.K. jurisdiction
  • A ban on correspondent banking relationships with U.K. financial institutions
  • Prohibition on payment processing for any transaction connected to the exchange
  • Director disqualification sanctions barring executives from serving on U.K. company boards
  • Internet services sanctions, requiring U.K.-based internet service providers, app stores, and social media platforms to restrict access to the exchange’s services
  • Trust services restrictions preventing U.K. firms from providing company formation or management services

Elliptic noted a further complication. The prohibition extends beyond direct transactions: any on-chain transfer that passed through the platform at any point in its history could now be treated as a prohibited transaction by U.K. counterparties, putting correspondent banks and payment processors in an awkward position even if they were not directly dealing with the exchange themselves.

The inclusion of Eurasian Savings Bank alongside crypto platforms in the same package sends a secondary signal. Britain is treating exchanges and traditional banks as equivalent nodes in the same enforcement network, not as separate regulatory categories requiring separate legal frameworks.

The Kremlin’s Crypto Pipeline

A7 and the Russian Relay Network

The A7 network occupies the center of the U.K.’s case against the exchange. The Foreign Office describes A7 as a Kremlin-backed system designed to bypass Western sanctions, finance military procurement, and process funds from the sale of Russian oil. British officials claim A7 moved more than $90 billion last year, a figure that London calculates as roughly half of Russia’s annual military expenditure. To move funds within Russia’s financial orbit, the network uses the A7A5 stablecoin, a ruble-pegged digital asset, and routes money through Kyrgyzstan’s banking system. According to the Foreign Office, A7-linked entities channeled an estimated $1.5 billion back into Russia through a Kyrgyz bank and one major crypto exchange platform.

Garantex carries a longer enforcement history. The exchange, originally registered in Estonia but operating from Moscow since 2019, was first sanctioned by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) in April 2022 for facilitating money laundering by ransomware groups and darknet markets. It continued operating despite that designation, cycling through wallet addresses daily to evade compliance screening. A coordinated international operation in March 2025, led by the U.S. Department of Justice alongside German and Finnish authorities, seized Garantex’s primary domains and froze more than $26 million in cryptocurrency. The Justice Department’s Garantex disruption operation also unsealed indictments against two of its administrators. The exchange subsequently rebranded as Grinex, drew a re-designation from OFAC in August 2025, and then halted operations last month after what its operators described as a $13 million state-backed hack.

HTX’s Bridge Function

Britain’s formal statement of reasons says U.K. authorities have “reasonable grounds to suspect” that Huobi Global S.A. provided financial services, funds, economic resources, or technology to A7, “which is carrying on business in a sector of strategic significance to the Government of Russia.” Tom Robinson, an analyst at Elliptic, confirmed to AFP that the $1.5 billion figure specifically concerns the platform, describing it as “the only global crypto exchange added to their sanctions list today.”

Three entities sit at the core of the U.K.’s network allegation, mapped below.

Entity Role in the Network Sanctions Status
A7 LLC Cross-border settlement platform; operator of the ruble-pegged A7A5 stablecoin; processes oil export proceeds for Russian military procurement U.S. OFAC (August 2025), EU (April 2026), UK (May 2026)
Grinex (rebranded from prior Moscow exchange) Primary money-laundering node; processed over $96 billion since 2019; rebranded after international law enforcement action U.S. OFAC (April 2022, re-designated August 2025), EU, UK (May 2026)
Huobi Global S.A. (operator of HTX) Global crypto exchange; alleged to have channeled $1.5 billion to Kremlin-linked networks via Russia-facing flows UK (May 2026)

What the On-Chain Numbers Show

Huobi issued public statements in 2022 saying it was winding down Russia-facing activity following the full-scale invasion of Ukraine. Blockchain data compiled by TRM Labs, whose researchers analyzed on-chain flows connected to the May 26 designations, tells a different story. Flows to sanctioned Russian entities did not taper after the stated wind-down. They accelerated sharply after the March 2025 international takedown of the Moscow exchange, precisely the moment when the network most needed a functioning global bridge.

  • $4.9 billion in total direct on-chain transfers from Huobi to U.K.-sanctioned Russian entities and A7-network platforms since 2021
  • $1.95 billion sent to the sanctioned Moscow exchange in 2022, and $1.18 billion in 2023, the latter after Huobi’s stated Russia wind-down was supposedly in effect
  • $838 million sent to A7 in 2025 alone, a 193-fold increase from the period before the March 2025 takedown
  • Combined flows to successor platforms, including Rapira, Aifory Pro, Grinex, ABCex, and A7-linked entities, grew roughly 10-fold in the 14 months after the international enforcement operation

Sun’s Shrinking Political Cover

Sun built his U.S. regulatory exposure into a feature rather than a liability by becoming one of the most visible investors in the Trump family’s crypto ventures. According to court filings and media reports, Sun committed $75 million to World Liberty Financial (WLF), a crypto decentralized-finance project co-founded by President Donald Trump and his sons, and spent another $100 million acquiring the $TRUMP presidential memecoin, putting his total outlay into Trump-family crypto at roughly $200 million. While U.S. Treasury targeted Russia-linked crypto infrastructure through successive OFAC actions, Sun was positioning himself as a key financial backer of the most politically connected crypto project in Washington.

The calculus appeared to work inside the United States. The SEC had sued Sun and his companies, including Tron Foundation and BitTorrent Foundation, in March 2023, alleging market manipulation, artificially inflated trading volume, and concealed payments to celebrity promoters. After Trump returned to the White House in early 2025, the SEC put the case on hold and moved toward settlement. By March 2026, Sun agreed to pay $10 million to resolve the civil fraud case; neither he nor his companies admitted or denied wrongdoing. Senator Elizabeth Warren, the ranking Democrat on the Senate Banking Committee, called the deal an embarrassment and accused the SEC of becoming “a lap dog for Trump’s billionaire buddies.”

That relationship has since unraveled publicly. WLF froze Sun’s token holdings in September 2025, and the value of those holdings declined by more than $80 million according to blockchain tracking by Bubblemaps. Sun sued WLF in a California federal court in late April 2026, alleging breach of contract and fraud, claiming the company had secretly installed tools to prevent him from selling his tokens. WLF countersued in Florida state court in May, accusing the crypto entrepreneur of defamation during what it called a “scorched-earth pressure campaign.” The U.K. designation does not name Sun personally. The sanctioned entity is the corporate operator, Huobi Global S.A., and his listed role is global advisory board member.

The FCA’s Escalating Pressure

The Russia sanctions did not emerge from nowhere. The U.K. Financial Conduct Authority (FCA) placed the exchange on its consumer warning list months before the Foreign Office acted, explicitly cautioning retail investors that they had no regulatory protection when using the platform. In February 2026, the FCA escalated by launching High Court proceedings over alleged illegal promotion of crypto asset services to British consumers without FCA authorization, describing the action as historic – one of the first times it had taken a major exchange to the High Court rather than issuing fines or warnings.

Those promotions appeared across TikTok, X, Instagram, YouTube, and Facebook. Alongside the legal filing, the FCA asked Apple, Google, and major social media platforms to block the exchange’s applications and accounts from reaching U.K.-based users. By May 26, a national security designation under the Russia Sanctions Regulations had superseded the consumer protection track entirely.

If the Kremlin thinks it can evade our sanctions by hiding behind crypto networks and shadow financial systems, it is gravely mistaken.

Yvette Cooper, U.K. Foreign Secretary, made that statement in the announcement accompanying the May 26 package. The Foreign Office added separately that it was “tracking down and shutting off the financial lifelines that sustain Putin’s war machine.” The FCA’s High Court proceedings run on a separate legal track and continue regardless of Tuesday’s action.

Britain has imposed sanctions on more than 3,300 individuals and entities since Russia’s full-scale invasion of Ukraine, and U.K. authorities estimate those measures have inflicted roughly $450 billion in losses on Russia’s wartime economy. Tuesday’s package is framed as a continuation of that effort, but with a meaningful shift in approach: crypto exchanges treated as equivalent to traditional banks in the enforcement network, not as a distinct and slower-moving regulatory category.

The Fallout Across the Exchange’s Operations

The immediate legal position for anyone in the U.K. is straightforward: any financial institution, payment processor, or crypto firm with a U.K. nexus is now prohibited from maintaining any relationship with the platform. Banking partners outside the U.K. face a softer but real choice. When a major Western economy applies national security sanctions to a financial entity, correspondent banks and payment processors in third countries typically begin distancing themselves preemptively, regardless of their formal legal obligations, to avoid secondary exposure and reputational risk.

An HTX spokesperson told The Block that “regulatory compliance remains our absolute top priority at HTX. We proactively monitor and strictly adhere to regulatory frameworks in all jurisdictions where we operate globally, including the UK.” No broader statement from the exchange had been published by the time of this article.

Rival platforms including Binance, OKX, and Bybit stand to absorb trading volume from users who migrate away in response to the designation. Tom Robinson of Elliptic confirmed the platform was the only globally operating tier-one exchange in Tuesday’s package. That distinction matters: if the measure holds through legal challenge and banking partners treat it as a permanent condition rather than a temporary compliance event, the exchange’s access to Western financial infrastructure narrows in ways that no compliance statement will easily reverse.

Disclaimer: This article is for informational purposes only and does not constitute investment or financial advice. Regulatory sanctions can affect the value and accessibility of digital assets held on or connected to sanctioned platforms. Readers should consult a qualified financial or legal professional before making any decisions. All figures cited are accurate as of publication on May 27, 2026.

Continue Reading

CRYPTO

Government Imposter Scams Are Targeting Prior Crypto Fraud Victims

Published

on

A surge in government imposter scams targeting prior cryptocurrency fraud victims prompted the Commodity Futures Trading Commission (CFTC, the U.S. derivatives and digital commodity markets regulator) to issue a consumer alert in May 2025. The pitch follows the same script each time: a caller impersonating a federal inspector claims the victim’s missing funds have been located in a foreign bank account, then requests a processing fee, payable in digital assets, to release them. Neither exists.

Five federal agencies are now running a coordinated public education campaign to disrupt it, and the numbers explain why the response spans more than one regulator. In 2025, these scams generated more than 1 million complaints and $3.5 billion in reported losses, a 40% jump in complaint volume from the year before.

A Warning Built for People Already Burned

The CFTC’s official consumer alert, issued May 14, 2025 as Release 9075-25, identified the specific impersonation pattern: scammers were contacting financial fraud victims and falsely claiming to represent the CFTC Office of Inspector General (OIG). The OIG, they told victims, had already located missing funds sitting in foreign bank accounts. A fee was required to release them. The actual OIG will never make such contact.

According to the agency’s Beware Imposters advisory, the commission does not maintain cryptocurrency wallets, does not collect fees from consumers, does not issue cryptocurrency trading licenses, does not audit digital asset wallets or request private key access, and does not contact victims directly to offer fund recovery. Enforcement communications are issued only in writing, following completed investigations, never by an unsolicited call or email to a fraud victim.

Fraudsters gain their short-term credibility through document forgery. They copy logos, seals, and signature images from official government websites to produce fake letterhead and spoofed email headers, then look up real employee names to forge on fraudulent correspondence. One reliable technical checkpoint the commission has stated explicitly: all legitimate CFTC correspondence arrives from a @cftc.gov email address. Contact from any other domain, including look-alike addresses mimicking the official one, is fraud on its face.

How Crypto’s Prior Victims Became a Scammer’s Best Asset

The Losses Behind the Target Pool

The scale of the underlying investment fraud problem explains why recovery scammers have such a large population to work from. In 2025, the FTC received 3 million fraud reports and consumers reported $15.9 billion in total losses, up from $12 billion the prior year, according to FTC testimony before the Joint Economic Committee in March 2026. Investment scams were the single largest category by aggregate dollars lost.

  • $15.9 billion in total reported consumer fraud losses in 2025, up from $12 billion in 2024
  • $7.9 billion from investment scams specifically, the top category by aggregate loss, with an average individual loss exceeding $10,000
  • $3.5 billion from imposter scams, crossing 1 million complaints for the year
  • 40% increase in government imposter scam reports compared with 2024

Desperation as the Targeting Signal

Someone who lost a significant sum in a pig butchering scam (cryptocurrency investment fraud where criminals build a fake online relationship before steering the victim toward a fraudulent trading platform) carries a specific profile that recovery scammers have learned to exploit deliberately. That person is financially damaged, searching for any credible path back, and already conditioned to trust an authority figure promising results. Recovery pitches are engineered from the ground up to look like the answer to exactly that desperation, which is what separates this fraud category from ordinary phishing: the scammer is not casting a wide net. They are going to a known address.

Where the Target Lists Come From

The CFTC warning raises a question the advisory does not fully answer: if scammers specifically seek prior fraud victims, how do they find them? According to NASAA’s crypto recovery room scams advisory (NASAA, the North American Securities Administrators Association, is the network of state-level securities regulators across the United States and Canada), several overlapping sourcing channels operate at the same time.

  • Darknet marketplaces trade victim lists containing contact information, loss amounts, and scam type. A crypto fraud victim’s data can be available for purchase within days of the original fraud concluding.
  • Complaint board monitoring: scammers scan consumer complaint forums and social media platforms for users posting about recent financial losses, then approach them directly via private message.
  • Fake recovery websites with fabricated five-star reviews and testimonials are seeded into search results via press release syndication, harvesting contact details from visitors who believe they are reaching a legitimate service.
  • Some fake portals masquerade as government fraud-reporting pages, collecting personal information from victims who believe they are filing a real complaint with an agency.
  • In documented cases, the second-wave recovery operation is run by the same operators behind the original scheme, recycling victim contact data months after the first extraction concluded.

NASAA’s advisory also notes that AI (artificial intelligence, software capable of generating text, video, and audio at scale) is now being used to produce multilingual caller scripts, fabricated client video testimonials, and spoofed email signatures designed to make the offer look credible for longer than a basic template would. The CFTC’s own guidance on recovery fraud notes that some fraudulent recovery sites embed links to real agency advisory pages, borrowing the CFTC’s own branding to lend false legitimacy to a con built around impersonating it.

The FBI’s Operation Level Up program, which proactively identifies and notifies cryptocurrency investment fraud victims before further losses occur, has contacted more than 8,100 people and estimates it helped prevent roughly $511 million in additional losses. Among those contacted, 77% were still unaware they were being scammed at the time of the FBI’s outreach, which means the window between the original fraud concluding and a recovery scam making contact is often very short.

Five Agencies, One Coordinated Push

The CFTC joined four other federal bodies in a public education initiative, with awareness campaigns launched on social media in early March 2026 and scheduled to continue through the end of the year. The table below maps each agency’s jurisdiction and role in the joint effort.

Agency Core Jurisdiction Campaign Role
CFTC Derivatives markets and digital commodity fraud Issued the May 2025 imposter alert; operates the Learn and Protect consumer hub at cftc.gov
FTC Broad consumer protection; enforces the Impersonation Rule Accepts government impersonation complaints; shut down 13 impersonator websites since April 2024
IRS Federal tax administration Reinforces that the IRS never demands cryptocurrency payment or contacts taxpayers via personal email
US Postal Inspection Service Mail fraud and financial crimes Investigates physical mail components used in imposter schemes
SSA Office of Inspector General Social Security fraud Addresses SSA impersonation, a tactic frequently paired with CFTC impersonation in multi-agency fraud schemes

The FTC’s Government and Business Impersonation Rule, which took effect in April 2024, provides the enforcement layer behind the education messaging. The rule gives the commission authority to seek civil penalties and consumer redress directly from violators. Since it went into effect, the FTC has brought five enforcement cases involving alleged violations and shut down 13 websites that were illegally using the commission’s own branding to deceive consumers. “The billions of dollars American consumers lose at the hands of impersonators is staggering,” said Chris Mufarrige, director of the FTC’s Bureau of Consumer Protection, in a statement accompanying the April 2025 enforcement update.

The coordinated messaging across all five agencies carries a consistent core: no government agency will contact you unsolicited to offer fund recovery services, demand cryptocurrency payments, or pressure you to act on a deadline. Any contact claiming otherwise, regardless of how official the branding appears, is fraud.

Fraudsters are using sophisticated techniques to steal Americans’ hard-earned money. When investment scams conclude, victims are left bankrupt. The CFTC is working to change this by warning Americans about scams and teaching them tools to protect themselves.

Jorge Herrada, acting director of the CFTC’s Office of Consumer Education and Outreach, made those remarks at the agency’s World Investor Week participation announcement in September 2025, one of several public education events the commission runs to reach retail investors before they encounter a scam rather than after.

Spotting the Script Before It Costs You

Recovery scam scripts follow a narrow set of identifiable patterns. Recognizing any single one of them is sufficient reason to end the interaction before any money or personal information changes hands.

  1. Unsolicited contact citing prior loss details. If someone contacts you with accurate information about a previous scam, that does not confirm access to official case files. It likely means they purchased a victim list, monitored a public complaint forum, or ran the original fraud themselves.
  2. A claim that your funds have already been located or seized. No legitimate government agency holds recovered funds pending a fee payment from the victim. Any recovery pitch built around an existing frozen balance is scripted fiction.
  3. Any payment request in cryptocurrency, gift cards, or wire transfer. The CFTC, FTC, IRS, US Postal Inspection Service, and SSA do not accept cryptocurrency from consumers under any circumstances. A crypto payment request is a categorical disqualifier, no matter how official the surrounding paperwork looks.
  4. Urgency and pressure to act before you can verify anything. Legitimate agencies do not enforce deadline-based compliance over the phone or through unsolicited email. Manufactured deadlines are a tell.
  5. Contact from a non-governmental email domain. CFTC correspondence comes exclusively from @cftc.gov addresses. IRS correspondence comes from @irs.gov. Any message arriving from a web-based service or a variation of an official domain name is fraudulent.

If any of these elements appear, write down as much identifying information as possible, end the interaction without sharing any personal details, account numbers, Social Security numbers, or digital wallet information, then call the agency directly using a phone number from its official website. The CFTC accepts fraud reports through its Beware Imposters guidance and complaint submissions page. The FTC takes reports at ReportFraud.ftc.gov. The FBI accepts reports through its Internet Crime Complaint Center at ic3.gov.

When the joint campaign converts even a fraction of those million-plus annual imposter complaints into timely reports before a second payment clears, it will do something enforcement actions alone cannot: shrink the gap between a victim’s first loss and the moment they stop being a viable target for the follow-on. If it does not, the secondary market that formed around crypto’s first-wave losses will keep running for as long as new victims keep entering the pipeline on the front end.

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. Readers who believe they have been targeted by a government imposter scam should contact the relevant federal agency directly through its official website and consider consulting a qualified legal professional. Statistics and agency guidance cited are accurate as of the date of publication.

Continue Reading

CRYPTO

Hoskinson’s $250 Million Wyoming Clinic Closes, 20,000 Patients Without a Provider

Published

on

Charles Hoskinson, co-founder of Ethereum and CEO of Input Output Global, the development firm behind the Cardano blockchain, invested nearly $250 million into a medical facility in Gillette, Wyoming, that he called the “Mayo Clinic of the West.” On May 22, leaders of the Hoskinson Health and Wellness Clinic confirmed it will close permanently on July 31, 2026, ending the most ambitiously funded private rural healthcare project in recent Wyoming memory and leaving between 18,000 and 20,000 patients to find new providers before August.

The bill was already visible four months before it arrived. When the clinic cut 40 positions in January and acknowledged it had grown at an “unsustainable rate,” the trajectory was written. Declining Medicaid and Medicare reimbursements, high specialist salaries, and an unfavorable payer mix (the proportion of patients covered by government programs or carrying no insurance at all) were cited as the core causes. The family simply could not fix any of them fast enough.

A Billionaire’s Medical Blueprint

The clinic opened in 2022 at a rented location on Lakeway Road in Gillette, Campbell County’s coal-and-mining hub in northeast Wyoming. William Hoskinson, a physician and co-founder of the facility alongside his parents Patty and Mark Hoskinson, had told his brother Charles what it would take to bring him back to medicine: a clinic where doctors could “be physicians again,” where quality of care came before billing quotas. Charles funded the vision without apparent ceiling.

The family relocated to a purpose-built campus on Highway 50 and began recruiting specialists that Gillette had never had access to locally. Cardiologist Dr. Dan Davidovich, who had been preparing to retire from medicine entirely out of frustration with private equity’s reach into hospitals, joined after learning about the project. Other recruits came from across the country and abroad. The technology budget matched the ambition: the clinic secured the second Vector unit in the United States, a 95-camera system that scans a patient’s entire skin surface in 30 seconds and uses software analysis to flag potential cancers. The first Vector went to the actual Mayo Clinic in Rochester, Minnesota.

Plans went further still. A surgery center connected to the main building by an underground tunnel, a detail the real Mayo Clinic has, was drawn up and publicly discussed. The family’s stated goal was a 100,000-square-foot campus that would eventually operate without any infusion of personal capital. From the start, the clinic accepted patients on Medicaid, Medicare, and no insurance at all. It never applied for government grants. According to William Hoskinson’s January public statement, the local Gillette hospital received roughly $18 million per year in taxpayer funding, while the clinic operated on reimbursements alone. That funding asymmetry would prove decisive.

By 2025, the clinic had introduced specialties that had not previously been available locally in Gillette:

  • Rheumatology services
  • Board-certified allergy and immunology care
  • Ophthalmology
  • Cardiology, including the recruited specialist from Washington state
  • Full-body dermatological screening via the 95-camera Vector device
  • Infusion services for chemotherapy drugs and related treatments

From Layoffs to Closure: The Collapse in Three Acts

The failure was not sudden. It unfolded in stages across four months, each episode announced as a correction before the next revealed a deeper problem underneath it.

December 2025: Construction Companies Fold

Hoskinson Contracting and Hoskinson Concrete, two firms the family had built specifically to control construction costs on the clinic campus, laid off a combined 136 workers in December 2025. Hoskinson Concrete was permanently closed. Wyoming Governor Mark Gordon called the event “one of the most significant layoffs Wyoming has ever seen.” Company executives framed it as the end of a building phase, but the scale of the cuts, and the speed, signaled something broader about the entire enterprise’s financial health. The 260-worker Hoskinson Contracting shrank to a maintenance-only operation, bidding out future construction to local Wyoming contractors.

January 2026: The Clinic Cuts Forty Jobs

Six weeks later, the clinic itself announced 40 additional layoffs and formally admitted it could not continue at its current pace. William Hoskinson posted publicly on the clinic’s Facebook page, accepting responsibility directly:

The blame for growing too fast falls on the Hoskinson family. We moved too quickly because we wanted to say yes to every request for help.

He noted that Charles had spent nearly $250 million in Campbell County on infrastructure, salaries, and investment without recovering a single penny of reimbursement for it. The surgery center connected by underground tunnel was quietly shelved. Unprofitable services were eliminated. The family insisted the clinic would survive in leaner form.

May 2026: Closure Confirmed

The January restructuring did not stabilize operations. On May 22, clinic leadership announced the closure, calling it “the most difficult decision in the history of this organization.” The final date is July 31. Patients who need copies of their medical records are advised to request them before July 17; the records will be preserved for at least 10 years as Wyoming law requires.

Hoskinson Venture in Gillette Launched Peak Staffing Current Status
Hoskinson Health and Wellness Clinic 2022 ~290 employees Closing July 31, 2026
Hoskinson Contracting 2022 ~260 workers 136 layoffs Dec 2025; maintenance-only operations
Hoskinson Concrete 2022 Part of above Permanently closed Dec 2025

Why Medicaid Reimbursements Broke the Model

The clinic’s public explanation for its closure cited three interlocking causes: declining insurance reimbursement rates, high provider salaries, and an unfavorable payer mix. A clinic that accepts Medicaid, Medicare, and uninsured patients collects less revenue per service than one that limits itself to commercially insured patients. In Wyoming, a state that has not expanded Medicaid eligibility under the Affordable Care Act, those reimbursement rates sit near the bottom of any national comparison. The gap between what specialists cost and what government programs pay is simply too wide to bridge through volume when the patient base skews heavily toward lower-reimbursement coverage.

William Hoskinson made the economics explicit in January, noting the clinic accepted Medicaid and Medicare patients because “reimbursement rates are abysmal” and that many private practices in Wyoming cannot afford to do the same. The family also created compound problems beyond that structural gap. Hoskinson Contracting, built to cut construction costs, never generated a profit and became, in William’s words, “a massive cost center that diverted our attention away from managing the clinic.” Real estate purchases intended to house staff, including two motels that turned out to be structurally unsound, absorbed resources that reimbursement revenue could never replenish.

The backdrop is not specific to Gillette or to this clinic. According to Wyoming Public Media’s reporting from the state’s 2026 legislative session, a recent assessment found six of Wyoming’s 30 hospitals in immediate jeopardy of closing, with three more on the verge. Bills to raise Medicaid reimbursement rates for maternal services and skilled nursing failed during that same session. Sixteen emergency medical services organizations across Wyoming have shut down over the past decade. The Hoskinson clinic was not an outlier; it was the loudest example of a statewide arithmetic problem.

Wyoming’s state government and federal programs are attempting partial remedies. The state’s Medicaid program and related rural health infrastructure received $205 million from the federal Rural Health Transformation Program for its first year of allocation. Whether that funding reaches surviving rural providers in time to stabilize them, given the pace of recent closures, is an open question that the state legislature did not fully resolve before adjourning this spring.

18,000 Patients, One Departing Provider

The immediate human consequence of the closure is a gap that Campbell County cannot quickly fill. Between 18,000 and 20,000 patients need to establish care elsewhere by August, in a region where specialty care already requires a long drive under ordinary circumstances.

Amanda Teppo, executive director of the Wyoming Health Resources Network, said in January that the clinic had been “a key source of care for Gillette and surrounding communities.” She warned that reductions, even at that earlier stage, “could mean longer wait times, fewer care options, and increased strain on patients, providers, and emergency services,” adding that the situation reflected “the broader struggle to sustain reliable, accessible health care in rural and frontier communities throughout Wyoming.”

The specialties the clinic introduced to Gillette, rheumatology, allergy and immunology, ophthalmology, cardiology, do not transfer automatically when a practice closes. Specialists in rural markets take years to recruit and rarely stay once their employer shuts down. The Vector skin-scanning device is clinic property, not community property. Patients who relied on any of those services now face the same distance problem the clinic was built to solve.

  • $250 million invested across the clinic and related Gillette construction ventures, with zero government grants accepted
  • 176+ combined layoffs across the clinic (40) and Hoskinson construction businesses (136) in a four-month window
  • 18,000-20,000 patients without their Hoskinson clinic provider ahead of the July 31 close
  • 6 of 30 Wyoming hospitals currently at immediate risk of closure, per the state’s 2026 legislative assessment

Hoskinson Refocuses on Cardano, Fights on Two Fronts

The Cardano founder described the clinic closure as one of the worst weeks of his life and posted on his verified X account that he is now “100% focused on Cardano and Midnight” with no plans to pursue further outside ventures. The pivot back to blockchain work comes while both projects are under sustained pressure.

ADA (Cardano’s native cryptocurrency) was trading near $0.25 as of late May 2026, down sharply from year-ago levels. NIGHT, the native token of Midnight (a privacy-focused blockchain built as a partner chain within the Cardano ecosystem), was trading around $0.033, also well below prior highs. In February, speaking from a live broadcast in Tokyo, Hoskinson disclosed that his personal unrealized losses on crypto holdings exceed $3 billion, a figure he attributed to ADA’s sustained decline from its peak. He stated he had not liquidated his position and had no plans to do so.

Governance pressure adds another front. Input Output Global (IOG), the development company he leads, submitted a research funding proposal to Cardano’s decentralized governance system requesting approximately 33 million ADA for the network’s 2026 roadmap, covering the Leios consensus upgrade and post-quantum security research. DReps (delegated representatives, community figures who vote on how Cardano’s treasury is allocated) have shown significant resistance, with voting open until June 8. Hoskinson warned publicly that a failed vote would mean “Cardano will lose its scientists, and our lab will be forced to close.” Midnight, for its part, has named MoneyGram, Vodafone, and eToro as network operators since launching on mainnet, though those partnerships have not reversed NIGHT’s price slide.

Two institutions now face structurally similar questions about the same month. In Gillette, former clinic patients find out by August whether another provider steps into the void. In the Cardano governance system, the June 8 DRep vote tells Hoskinson whether the community he built will fund the research that defines what Cardano claims to be. Both answers hinge on whether ambition, at scale and without adequate financial backing, can survive the economics it was built to transcend.

Continue Reading

Trending