Crypto24

Quiet since April 20, 2026
43 victims named on the leak site
0 in the last 30 days
21 in the last 12 months
Apr 2025 first victim we recorded
Apr 20, 2026 most recent victim posted
2 leak sites tracked

Data as of August 16, 2026.

Credential exposure before the attack

30.2% of Crypto24 victims whose domain we can identify (13 of 43) had employee credentials leak in the 12 months before Crypto24 named them as a victim.

We don't know whether any of these credentials were how Crypto24 gained initial access.

What industries Crypto24 targets

Sector identified for 30 of 43 victims.

Manufacturing9
Financial Services5
Healthcare4
Legal3
Technology3
Education2
Automotive2
Telecommunications1

Where the victims are located

Country identified for 32 of 43 victims.

United States5
Malaysia3
United Kingdom2
Argentina2
Spain2
Germany2
Vietnam2
Indonesia2

Most recent Crypto24 victims

VictimSectorCountryPosted
Qatar Biomedical Research Institute hbku.edu.qaHealthcareNot identifiedApr 20, 2026
Industrias Guerra iguerra.comManufacturingSpainApr 6, 2026
Katcon Global katcon.comAutomotiveMexicoApr 6, 2026
ActionPower actionpower.krManufacturingSouth KoreaMar 27, 2026
Estudio O’Farrell estudio-ofarrell.comLegalArgentinaMar 25, 2026
Comprehensive Orthopaedics comprehensiveorthopaedics.comHealthcareUnited StatesMar 10, 2026
Invacare Clinical Support invaccs.comHealthcareUnited StatesMar 10, 2026
Rowad Modern Engineering rowad-rme.comManufacturingSaudi ArabiaMar 6, 2026
Putnam Precision Manufacturing putnamprecision.comManufacturingUnited StatesFeb 10, 2026
University College London ucl.ac.ukEducationUnited KingdomJan 26, 2026
ExamRoom.AI examroom.aiEducationUnited StatesDec 26, 2025
SASP sasp.frManufacturingFranceDec 18, 2025
Hollysys hollysys.comManufacturingNot identifiedDec 1, 2025
Asahi Kasei Microdevices akm.comManufacturingJapanNov 13, 2025
Bayu Buana Travel bayubuanatravel.comNot identifiedIndonesiaOct 27, 2025
Meinhardt Group meinhardtgroup.comNot identifiedSingaporeOct 27, 2025
U.S. Vanadium usvanadium.comNot identifiedUnited StatesOct 22, 2025
Banco Hipotecario del Uruguay bhu.netTechnologyNot identifiedOct 6, 2025
Palmgold Management palmgold-mgmt.comFinancial ServicesMalaysiaAug 19, 2025
CMS Legal Services cms.lawLegalGermanyAug 18, 2025

Showing the 20 most recent of 43. Browse recent data breaches for more.

Crypto24 leak sites

Addresses we've seen Crypto24 publish victims from. Any .onion address needs the Tor Browser.

  • j5o5y2feotmhvr7cbcp2j2ewayv5mn5zenl3joqwx67gtfchhezjznad.onion
  • d26nwzgwylb3no3ar3rt3si3e3ujzndhp5wryxxlr76wba5snhap3tyd.onion

Crypto24 questions

Is Crypto24 still active?

It's gone quiet. The last victim we recorded was April 20, 2026, and nothing has appeared since. Groups do go quiet and come back, so we're still watching.

How many victims has Crypto24 claimed?

Crypto24 has named 43 victims on its leak site since we started tracking it. That counts organizations, not leaked files. A single victim often accounts for thousands of published files. 21 of them were posted in the last 12 months.

When did Crypto24 first appear?

The first victim we recorded for Crypto24 was posted on April 10, 2025. That's when the group entered our collection, which isn't necessarily when it started operating.

Which sectors does Crypto24 target?

Manufacturing accounts for the most victims we can classify, with 9. Financial Services follows at 5. We could identify a sector for 30 of 43 victims, so treat this as the shape of the targeting rather than a full census.

Has Crypto24 already got your credentials?

Check whether your employees' logins have leaked on the dark web before they're exploited.

Check your exposure →

Continuous dark web monitoring alerts you when your company's data shows up, whether that's employee credentials or files published after an attack.