September 18, 2026 has brought several important crypto security stories into focus. The cases cover fake giveaways, account takeovers, DeFi exploits, customer data theft, sanctions issues and the wider use of artificial intelligence in crypto fraud.
One of the biggest stories today comes from the Cardano ecosystem. Input Output Group, also known as IOG, warned users after its YouTube channel appeared to fall under unauthorized control. The channel showed a suspected AI-made video of Cardano founder Charles Hoskinson and promoted a fake crypto offer that promised to double a user’s wealth.
Another major story concerns Nostra, a DeFi protocol on Starknet. A reported price oracle attack allowed an attacker to use an inflated NSTR price as collateral and borrow about $3.5 million in other crypto assets. The protocol paused its affected market while it looked into the case. The incident itself was reported as a September 17 event, while fresh details appeared on September 18.
The day also brings fresh attention to a Revolut customer data breach. Reports say about 680 crypto customers were affected. The case did not involve a direct loss of customer funds, but sensitive personal and financial data may have reached criminals. A separate story concerns BitBank, an Iranian crypto exchange that the United States sanctioned over allegations tied to sanctions evasion and payments linked to the Strait of Hormuz.
These cases show that crypto fraud is not limited to one type of attack. A scam can use a fake celebrity video, a stolen account, a weak DeFi price feed, leaked personal data or a crypto exchange tied to an alleged illegal finance network.
Cardano YouTube Channel Faces Fake Giveaway Scam
The most direct scam alert today comes from the Cardano ecosystem. Input Output Group warned users to stay away from its YouTube channel after the account appeared to be compromised.
The channel showed a suspected AI-manipulated video of Charles Hoskinson, the founder of Cardano. The video looked like a Project Catalyst town hall. Project Catalyst is a real Cardano community fund and grant program, so the use of its name gave the fake broadcast a more official look.
The video also showed a QR code and promised viewers that they could double their wealth. This is a classic crypto giveaway scam format. The basic trick is simple. A person sees a trusted name, believes the offer is real and sends crypto to an address supplied by the scammer. The victim then expects to receive a larger amount but gets nothing back.
IOG told users not to interact with the channel until further notice. The company also warned people not to click links, send funds or share personal information in response to material on the channel.
At the time of the reports, there was no confirmed public figure for the amount of crypto lost through this specific incident. IOG had also not confirmed how the attacker gained control of the YouTube account.
That point matters. The existence of a fake video does not prove that viewers lost money. The scam was real as a threat, but a verified loss total for the September 18 incident was not available in the sources reviewed.
Why the Fake Hoskinson Video Looked Dangerous
The scam used trust as its main tool.
Charles Hoskinson is one of the best-known people in the Cardano ecosystem. A video that appears to show him can make a fake offer seem much more believable than a random message from an unknown account.
The suspected use of AI adds another layer to the problem. A fake video can copy the face and voice of a known person. A viewer may see a familiar face and hear a familiar voice and assume that the message must be genuine.
The video also used Project Catalyst branding. That made the offer look connected to a real Cardano program. Reports said the fake broadcast was presented as a Catalyst town hall and remained live for close to two hours at the time of the initial report.
The important point is that a real account can carry false information after an account takeover. A blue check, a large follower count, an official channel name or a familiar face cannot prove that a crypto payment request is genuine.
Cardano has warned about fake giveaway schemes for years. Such scams often use videos or images of Hoskinson and other known figures. The basic promise is usually the same: send crypto first and receive more crypto later.
A genuine crypto project does not need a user to send money first in order to receive a promised reward. Once a crypto transfer reaches a scam wallet, recovery can be very difficult because blockchain transactions are normally irreversible.
Nostra Reports a $3.5 Million DeFi Exploit
Another major security story tied to today’s crypto news concerns Nostra, a DeFi protocol on Starknet.
The reported attack used a price oracle. An oracle supplies price information to a blockchain application. DeFi platforms can use this information to decide how much collateral a user has and how much the user can borrow.
In the Nostra case, a reported attacker manipulated the price used for NSTR. The inflated value made NSTR appear worth much more than its real market value.
The attacker then used the inflated token value as collateral and borrowed other crypto assets from the protocol. The reported amount was about $3.5 million.
Nostra paused its affected Starknet money market while the team examined the incident. A separate security report said about $1.92 million had been moved to Ethereum. The final loss and any recovery amount were not confirmed at the time of the report.
The reported incident date was September 17, 2026. However, the incident record and additional crypto news reports appeared on September 18. That difference is important for anyone who wants a strict daily news record.
The case also shows why DeFi security can be complex. The blockchain itself may work as designed, while a separate price source creates a weakness. If the price data is wrong, a lending system may make decisions based on false information.
What an Oracle Attack Means in Simple Terms
An oracle can be compared to a price information service for a DeFi application.
Suppose a platform believes one token is worth $10. It may allow a user to deposit $10,000 worth of that token and borrow $7,000 in another asset.
If an attacker somehow makes the platform believe that the same token is worth $100, the system may think the collateral is worth $100,000. The attacker can then borrow far more than the real value of the collateral.
That is the basic danger behind an oracle manipulation attack.
The Nostra case is therefore different from the Cardano giveaway. The Cardano case used social trust and deception. The Nostra case involved a technical weakness in a DeFi system.
Both cases can still lead to the same result: users or protocols can lose crypto when a trusted system gives false information or when criminals exploit trust.
Revolut Crypto Customer Data Comes Under Threat
Another major crypto-related security story concerns Revolut customers.
Reports published around September 18 say that hackers obtained personal information related to about 680 crypto customers. The attackers reportedly used an impersonation scam involving a legitimate government email domain to obtain private customer information.
The data may have included sensitive details such as addresses, identity documents, account information and crypto transaction records.
Revolut has said that customer funds and its internal systems were not compromised. The company also said it contacted affected customers and authorities. Reports say the attackers later threatened to release the stolen information unless a ransom was paid. One report put the alleged demand at $3 million in Monero.
The ransom figure should be treated with care. The Guardian reported that hackers were allegedly demanding $3 million, while Revolut said it had not received a direct ransom demand. This means the existence and exact form of the demand remain part of the reported claims rather than a confirmed payment by Revolut.
The case is especially important for crypto users because personal data can create risks even when no coins are stolen at first.
A criminal who knows a person’s name, home address, identity details and crypto activity may have enough information to attempt another attack. That could take the form of phishing, fake customer support, account impersonation or even direct threats.
The lesson is simple. Crypto security does not stop at the wallet. Personal information can also have a high value for criminals.
BitBank Faces US Sanctions Over Crypto Finance Claims
Another crypto story reported on September 18 concerns BitBank, an Iranian cryptocurrency exchange.
The United States announced sanctions against BitBank and accused the exchange of helping move hundreds of millions of dollars through a digital asset network linked to Iran.
The US Treasury said BitBank was controlled by Iranian financier Babak Zanjani. It also alleged that the exchange routed hundreds of millions of dollars to the Islamic Revolutionary Guard Corps, or IRGC.
Treasury further alleged that BitBank processed payments connected to ships that sought safe passage through the Strait of Hormuz. The claims formed part of a wider US effort called Operation Economic Outcast.
The US also sanctioned Pishtaz Simorgh Electronic Trade Company, which it identified as the software developer behind BitBank. Three associates of Zanjani were also named in the sanctions action.
The exact nature of this case is different from a normal crypto scam. There is no report here that BitBank ran a fake giveaway or stole coins from ordinary users. Instead, the US action concerns alleged sanctions evasion and illicit finance.
That distinction is important when the term “crypto crime” is used. The crypto sector can face many forms of unlawful activity, and they do not all involve the same victims or methods.
The US claims are allegations by the government and should be understood as such. Sanctions are an official legal action, but the underlying allegations remain claims made by US authorities.
AI Is Becoming a Bigger Part of Crypto Fraud
The Cardano case also points to a wider issue: artificial intelligence can make old crypto scams look more believable.
Fake giveaway schemes are not new. What has changed is the quality of the material that criminals can create.
A scammer can use synthetic voices, fake video, edited images and automated text to create content that appears to come from a real person. This can reduce the obvious signs that once helped users spot fraud.
Crypto is a natural target for this type of crime because transactions can move fast and may be hard to reverse.
A fake video can reach thousands of people. If even a small number of viewers trust the message, the scam can produce a large payout.
The Cardano incident shows why users should not judge a crypto offer by appearance alone. A video can look real and still be fake. A famous person can appear on screen and still have no connection to the offer. A real company account can also be compromised.
Why September 18 Matters for Crypto Security
The major cases linked to today’s reports show several different risks at once.
The Cardano case is about identity and trust. The Nostra case is about DeFi technology and price data. The Revolut case is about customer information and impersonation. The BitBank case is about alleged use of digital assets for sanctions evasion.
These cases have one common feature: trust plays a central role.
Crypto users trust public figures, websites, exchanges, smart contracts, price feeds and official communication channels. Criminals try to attack that trust.
The most useful response is not to assume that every crypto service is unsafe. It is to check information before money or personal data leaves your control.
A sudden giveaway should receive extra scrutiny. A request for a wallet transfer should be checked through a separate official source. A video should not be treated as proof that a person approved an offer. A DeFi protocol should not be assumed to be safe simply because it has a large user base.
What Users Should Take From Today’s Reports
The September 18 reports show that crypto scams can look very different.
One attack can arrive as a fake YouTube broadcast. Another can exploit a technical weakness in a DeFi protocol. A third can target private customer information instead of crypto itself. A fourth can involve an exchange and alleged illegal financial activity.
This makes basic security habits more important.
Users should never send crypto because a video promises double returns. They should avoid QR codes from unverified crypto promotions. They should not share passwords, private keys, seed phrases or sensitive identity documents because a person claims to represent an exchange or crypto project.
It is also useful to check announcements through more than one official channel. If a major project really launches a giveaway or asks users to take a major action, there should normally be confirmation through its official website or another trusted channel.
For DeFi users, the lesson is slightly different. A smart contract can have a technical weakness even when the project appears established. Price oracles, bridges and lending systems can all create risks that ordinary users may not see.
Final Word
September 18, 2026 has brought a clear reminder that crypto crime is not one single problem.
The Cardano YouTube incident shows how criminals can use a trusted name, a fake video and a simple promise of quick profit. The Nostra case shows how a weakness in price data can create a large financial loss. The Revolut case shows that personal data can be just as valuable to criminals as crypto itself. The BitBank sanctions case shows how digital assets can also form part of wider financial networks that governments target.
The reported numbers are significant. The Nostra exploit involved about $3.5 million in reported borrowing. The Revolut case affected about 680 customers, with a reported $3 million ransom claim that Revolut has not confirmed as a direct demand. The BitBank case involves US allegations of hundreds of millions of dollars in crypto transfers. The Cardano case has no verified loss figure at the time of the reports.
For everyday crypto users, the simplest lesson is also the most useful: never send crypto just because a familiar face tells you to do so.
A real-looking video is not proof. A trusted channel can be compromised. A QR code can lead to a scam wallet. A promise to double your crypto is one of the clearest warning signs.
As AI tools become more capable, the difference between real and fake content may become harder to see. That makes independent verification more important than ever.
ALSO READ: 10 ETF Shocks on Sept. 18, 2026: The Moves Investors Missed
