Connect with us
DAPA Banner

Crypto World

Aave’s GHO Stablecoin Supply Hits $500M

Published

on

Aave’s GHO Stablecoin Supply Hits $500M
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

ZachXBT Exposes North Korean IT Workers Running $1M/Month Crypto Fraud Network

Published

on

Brian Armstrong's Bold Prediction: AI Agents Will Soon Dominate Global Financial

TLDR:

  • ZachXBT obtained leaked data from 390 accounts on a North Korean internal payment server via infostealer. 
  • Over $3.5M moved through network wallets since late November 2025, with one Tron address frozen by Tether. 
  • Three OFAC-sanctioned companies — Sobaeksu, Saenal, and Songkwang — appeared directly in the breached data. 
  • Workers received IDA Pro cybersecurity training modules, pointing to capabilities beyond basic financial fraud.

A major breach of an internal North Korean payment server has revealed a sophisticated fraud network generating nearly $1 million per month.

On-chain investigator ZachXBT obtained data from an unnamed source, including 390 accounts, chat logs, and crypto transactions.

The leaked data exposed fake identities, forged legal documents, and crypto-to-fiat conversion methods. Since late November 2025, over $3.5 million moved through the network’s payment wallet addresses.

How the Payment Network Operated

The breach originated from a compromised device belonging to a DPRK IT worker infected by an infostealer. Data extracted from the device included IPMsg chat logs, fake identity documents, and browser history.

Investigators traced activity to a site called luckyguys[.]site, described as an internal payment remittance platform. The platform functioned similarly to a messaging app, allowing workers to report payments back to handlers.

Advertisement

Ten users on the platform still had the default password, 123456, unchanged. The user list included roles, Korean names, cities, and coded group names consistent with known DPRK IT worker operations.

Three sanctioned companies appeared in the data: Sobaeksu, Saenal, and Songkwang, all currently under OFAC sanctions.

ZachXBT posted on X that the remittance pattern was consistent across users. Workers transferred crypto from exchanges or services, or converted funds to fiat through Chinese bank accounts via platforms like Payoneer.

An admin account, PC-1234, then confirmed receipt and distributed credentials for various exchanges and fintech platforms.

One user identified as “Rascal” had direct message logs with PC-1234 detailing payment transfers and the use of fraudulent identities from December 2025 through April 2026.

Advertisement

Hong Kong addresses appeared in billing records, though their authenticity could not be confirmed. Two payment addresses were identified: one Ethereum address and one Tron address, the latter frozen by Tether in December 2025.

Using the full dataset, ZachXBT mapped the complete organizational structure of the network, including payment totals per user and group. He published an interactive org chart covering the December 2025 through February 2026 data range.

Training Modules and Broader Threat Context

Beyond financial fraud, the data revealed cybersecurity training activity within the group. According to ZachXBT’s post, the admin sent 43 Hex-Rays and IDA Pro training modules to the group between November 2025 and February 2026.

Topics covered disassembly, decompilation, local and remote debugging, and various cybersecurity subjects. One link sent on November 20 referenced using an IDA debugger to unpack a hostile executable.

Advertisement

A compromised device belonging to a worker identified as “Jerry” showed usage of Astrill VPN and multiple fake personas applying for jobs.

An internal Slack message showed a user named “Nami” sharing a blog post about a DPRK IT worker deepfake job applicant. Another screenshot showed 33 workers communicating on the same network through IPMsg.

Jerry also discussed plans to steal from a project called Arcano, a GalaChain game, with another worker through a Nigerian proxy.

Whether that attack proceeded remains unclear. The investigator noted this cluster is less sophisticated than groups like AppleJeus and TraderTraitor.

Advertisement

ZachXBT stated in a post that DPRK IT workers collectively generate multiple seven figures per month, and this data supports that estimate.

He added that threat actors are missing an opportunity by not targeting these lower-tier DPRK groups, citing minimal competition and low repercussion risk. He confirmed plans to continue publishing findings through his investigation platform.

Advertisement

Source link

Continue Reading

Crypto World

Secret Claude model ‘better than all but the most skilled humans’ at hacking

Published

on

Secret Claude model 'better than all but the most skilled humans' at hacking

Anthropic, the $380 billion AI giant responsible for the Claude tool, has a new AI model called Mythos that could become a crypto hacking nightmare.

Concerned about global panic if it were to release its frontier model too soon, Anthropic handed early “Mythos” access to JPMorgan Chase, Apple, Microsoft, and a few dozen other blue chip tech companies.

Unfortunately, Anthropic didn’t grant guest list access to any crypto company for its paternalistic Project Glasswing.

One Bitcoin developer asked Anthropic directly, “Why not cooperation with bitcoin/crypto projects?” Anthropic declined to reply.

Advertisement

JPMorgan Chase got a head start. Crypto didn’t.

A wing of glass preventing Mythos from hacking crypto

Anthropic’s Glasswing cybersecurity sprint is permitting 50-60 companies early access to its unreleased model that “can find software vulnerabilities better than all but the most skilled humans,” according to the company. 

Advertisement

It is also donating $4 million worth of AI credits and is “committing” up to $100 million in AI credits for Glasswing.

According to Anthropic, which obviously has an incentive to praise the powers of its unreleased model for media and fundraising purposes, Mythos has strong reasoning and coding skills and is considerably more dangerous as a software hacking tool than most human developers.

Anthropic claims Mythos is “very autonomous” and has already found “thousands of high-severity vulnerabilities,” including bugs in “every major operating system and web browser.” 

It withheld details about most of those bugs, except a 27-year-old bug in OpenBSD Unix software and a 16-year-old flaw in FFmpeg video software.

Advertisement

Curiously, Anthropic has published professionally staged and videotaped promotional materials in which Anthropic stakeholders sound alarms about Mythos’ capabilities.

For media purposes, it carefully selected the name “Glasswing,” which refers to the Greta oto butterfly whose transparent wings resemble glass.

Read more: AI just bypassed the Cloudflare protection that DeFi needs

Crypto, excluded from Glasswing, is particularly vulnerable

If Mythos’ threat is real, crypto software is particularly vulnerable to hackers with access to it.

Advertisement

Many implementations of crypto software are mostly or fully immutable, contain tremendous financial value, and have globally distributed deployment and upgrade cycles that prevent a quick defense.

Protos reported in December 2025 that even before Mythos, Anthropic had pitted its AI agents against 405 smart contracts.

Even with backdated knowledge and no internet access, its agents correctly predicted millions of dollars worth of available exploits on smart contracts which had gone live after researchers cut off the AI internet and knowledge access. 

Anthropic’s AI agents also uncovered novel zero-day vulnerabilities in thousands of fresh contracts with no previously known flaws.

Advertisement

Those discoveries were before Mythos. According to Anthropic’s self-aggrandizing claims yesterday, Mythos can dramatically out-codes everything Claude has built previously.

Stifel analyst Adam Borg is convinced. “We read this as having the potential to become the ultimate hacking tool, and one that can elevate any ordinary hacker into a nation-state adversary,” Borg wrote about Mythos.

Anthropic says Glasswing partners will share their findings with the broader industry and patch major bugs prior to the public release of Mythos.

Got a tip? Send us an email securely via Protos Leaks. For more informed news, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Source link

Advertisement
Continue Reading

Crypto World

Bitcoin Spot Demand Rises As $72K May Define Next Move

Published

on

Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis

Bitcoin (BTC) rallied above $72,000 on Tuesday as BTC order book and derivatives data showed buyers returning to the market.

Bitcoin’s recent trading history suggests that holding the $70,000 level is the first task bulls need to master, but previous BTC price rallies were capped by short-term traders selling into the bullish momentum. Will this time be different?

Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis
BTCUSDT on the one-day chart. Source: Cointelegraph/TradingView

Bitcoin spot demand remains positive

Bitcoin held above $71,300 on Wednesday as the spot market demand strengthened over the past few days. The order flow across major exchanges shows a clear shift toward investor accumulation.

The 30-day spot net volume delta for Bitcoin, which tracks the net difference between market buys and sells, has turned positive on both Binance and Coinbase after persistent selling in February.

Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis
Bitcoin’s spot net volume delta on Coinbase and Binance. Source: CryptoQuant

Binance’s 30-day net volume moving average stands at $43.2 million, while Coinbase records $13.88 million. This marks a coordinated shift in behavior across the key crypto exchanges.

The derivatives data adds weight to the move. CryptoQuant data shows Binance’s cumulative volume delta (CVD) has increased to $5.6 billion on Wednesday, up $3.3 billion in April. The CVD measures the aggressive market orders, and the recent rise tracks an increase in taker-buy volume following Bitcoin’s brief drop below $65,000 on March 30.

Advertisement
Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis
BTC: Binance Cumulative Net Taker Volume. Source: CryptoQuant

The current cumulative net taker volume on Binance has reached its highest level since early February, when CVD stood near $74 million. This indicates stronger buyer conviction than the muted activity seen during the previous consolidation phase.

Related: Bitcoin fades three-week highs as BTC price shrugs off Iran war ceasefire

$72,000 is Bitcoin’s line in the sand

Bitcoin’s interaction with $72,000 continues to shape its short-term positioning. The level has acted as a resistance since Feb. 4, with failed attempts to reclaim it on March 4 and March 16. Both rallies were met with sharp selling from the short-term holders, who sold roughly 26,000 BTC and 31,000 BTC, respectively.

Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis
Bitcoin short-term holder P&L to exchanges. Source: CryptoQuant

The current behavior shows a different pattern. After BTC’s rally to $72,000 on Tuesday, data shows short-term holder capitulation of nearly 3,000 BTC. The reduced selling pressure signals less urgency to exit positions at the current levels than in prior attempts.

The profitability metrics are also stabilizing. Bitcoin’s net realized profit/loss seven-day moving average sits at -$109 million, recovering from a low of -$2 billion on Feb. 7. The metric is approaching a positive bias for the first time since Jan. 22, indicating a gradual reduction in realized losses.

Coinbase, Cryptocurrencies, Bitcoin Price, Markets, Cryptocurrency Exchange, Derivatives, Bitcoin Futures, Binance, Price Analysis, Market Analysis
Bitcoin Net Realized Profit/Loss [USD]. Source: CryptoQuant

The reduced selling pressure and rising profitability point to a more balanced market in which buyers are gradually absorbing available supply. For a bullish expansion to occur, the trend needs to continue and the buyers need to defend the $70,000 to $72,000 zone over the next few days. 

Related: Cango sells 2,000 BTC, cuts Bitcoin production cost by 19% in March

Advertisement