Hyperliquid co-founder Jeff Yan has warned that crypto’s failure to attract enough top entrepreneurs has become one of the industry’s biggest obstacles as young talent moves toward artificial intelligence.

The VALR podcast featured Yan’s comments on how the AI boom and the social status attached to the technology have influenced career choices among young founders. According to Yan, many talented people remain unsure which field would allow them to create the most value, leaving relatively few to pursue work in cryptocurrency and fintech.

Yan argued that rebuilding the financial system from first principles offers young entrepreneurs a chance to solve difficult real-world problems. In his view, the work involves turning academic ideas into market designs that can operate reliably at scale.

Rather than judging industries by their surface appeal, Yan urged prospective founders to study the problems each sector is trying to solve. He identified on-chain finance as an area where entrepreneurs can help develop new financial systems and market structures.

AI is drawing young founders away from crypto

Yan’s concern comes as Chinese AI developers gain attention for their progress in global model rankings. China’s Kimi K3 recently reached first place on the Frontend Code Arena, a result that prompted former White House crypto czar David Sacks to raise concerns about America’s position in the AI race.

Sacks described Kimi K3’s performance as troubling because the model also ranked close to leading systems across several other evaluations. He argued that rules covering data centers, state-level requirements and proposed federal reviews could slow US developers while Chinese companies continue improving their models.

“This is how you lose the AI race,” Sacks wrote.

Drawing a comparison with the early internet, Sacks argued that the United States became a technology leader by allowing companies to build products without first seeking government permission. He called for Washington to take a similar approach to AI while using focused regulations to address specific safety concerns.

The competition described by Sacks helps explain why AI has become attractive to ambitious young developers and founders. Yan, however, believes crypto still offers meaningful technical work because building on-chain financial markets requires both entrepreneurial judgment and knowledge of economic design.

Heavy AI spending carries a separate market risk

While AI companies compete for talent and capital, former Fidelity fund manager George Noble has warned that the investment boom could create severe financial risks. Noble estimated that an AI bubble collapse could cause 17 times more damage than the dot-com crash, which erased about $5 trillion from the Nasdaq.

Noble linked that forecast to the large amount of money being directed toward AI infrastructure. If those investments fail to produce the returns expected by investors, he argued, the losses could spread beyond technology companies and affect other parts of the financial system.

“The fallout from this could really be much more significant,” Noble said while discussing the rise in AI capital spending.

Yan did not frame AI’s expansion only as a financial threat to crypto. His warning focused on the people entering the sector, with the Hyperliquid co-founder arguing that on-chain finance will need more capable entrepreneurs if it is to turn complex theories into financial markets that can serve users at scale.

A TrustedVolumes attacker has returned 1,122 ETH worth about $2 million while keeping another $2 million as a self-declared bounty.

According to Com Feed monitoring, the Ethereum transfer represents a partial recovery from the May exploit, which initially drained about $5.87 million from a contract controlled by the liquidity provider. The attacker has retained roughly the same dollar amount as the returned funds, labeling it a bounty.

At the time of writing, TrustedVolumes had not formally confirmed that it had accepted the attacker’s bounty terms.

Partial repayment recovers only part of the stolen funds

TrustedVolumes disclosed in May that the total loss had reached roughly $6.7 million, exceeding the initial estimate reported by security researchers. The company said at that time the stolen assets were held across three addresses containing approximately $3 million, $3 million, and $700,000.

Seeking to recover the assets, TrustedVolumes offered to discuss a vulnerability bounty and what it called a mutually acceptable solution. The liquidity provider also invited the attacker to begin constructive communication, though its statement did not specify a proposed bounty rate.

Before the stolen tokens were consolidated, Blockaid identified 1,291.16 WETH, 206,282 USDT, 16.939 WBTC, and 1.27 million USDC among the drained assets. PeckShield later reported that the attacker exchanged the tokens and gathered the proceeds into about 2,513 ETH.

The returned 1,122 ETH was worth about $2 million at the time of writing, while Com Feed valued the attacker’s retained bounty at a similar amount. The combined dollar value is lower than the original loss because ETH has fallen since the May exploit, when the stolen assets were converted into the cryptocurrency.

Custom TrustedVolumes proxy caused the security breach

As previously reported by crypto.news, Blockaid traced the May 7 attack to a custom request-for-quote swap proxy operated by TrustedVolumes. According to the security firm, the attacker targeted the company’s Ethereum resolver setup rather than a regular 1inch swap route.

TrustedVolumes used the RFQ system to quote token prices and complete signed trades from its inventory. Verichains found that a public function lacked access controls, allowing the attacker to register an address as an approved order signer and create transactions that appeared valid to the proxy.

During the same transaction, the attacker directed the proxy to pull WETH, WBTC, USDT, and USDC from the TrustedVolumes inventory vault. Verichains also identified a mismatch between the address checked for authorization and the address supplying the tokens, while faulty replay protection failed to record orders correctly.

Although the affected market maker supplied liquidity through 1inch, the attack did not compromise 1inch’s core aggregation contracts or standard user routes, according to 1inch’s account of the incident. Blockaid linked the wallet to the March 2025 Fusion V1 exploit but reported that the May attack used a different flaw tied to TrustedVolumes’ custom proxy.

OKX Europe has opened a one-way conversion route across 30 EU and EEA countries, allowing customers to deposit USDT and exchange it for MiCA-compliant USDC.

According to an OKX announcement, eligible customers can send Tether’s USDT to their OKX Europe accounts before converting the tokens into Circle-issued USDC. OKX also promoted an 8% deposit bonus for customers moving funds to the platform.

Unlike automatic conversion programs introduced by some platforms, OKX said its service allows users to decide when to exchange their holdings. The company positioned the feature as an option for customers whose current platforms have stopped accepting USDT or plan to convert remaining balances after a deadline.

Operating under a Markets in Crypto-Assets license, OKX Europe currently serves customers across 30 countries in the European Union and European Economic Area. The authorization allows the exchange to offer regulated crypto services throughout those markets under the EU framework.

MiCA restrictions push USDT holders toward USDC

European platforms have reduced support for USDT because Tether has not secured authorization to issue the stablecoin under MiCA. Since the regulation’s final transition period ended on July 1, exchanges have restricted deposits, removed trading pairs and directed customers toward approved alternatives.

Circle’s USDC has become one of the main options available to those users because it operates under the EU framework. OKX’s new tool supports deposits only in USDT and conversions only into USDC, meaning customers cannot use the feature to exchange USDC back into USDT.

Despite the European restrictions, DefiLlama data shows that USDT remains the world’s largest stablecoin. Tether controls about 59% of the nearly $310 billion stablecoin market, with USDT holding roughly $184 billion in market value, compared with around $73 billion for USDC.

Revolut has also announced plans to stop supporting USDT for customers in the EEA and Switzerland. According to the digital banking platform, users have until Aug. 31 to sell or withdraw their holdings before Revolut converts any remaining tokens into each customer’s base currency.

Tether holds its ground as Binance retreats

Tether CEO Paolo Ardoino has repeatedly defended the company’s decision not to seek MiCA approval, arguing that the framework’s reserve rules could expose stablecoin issuers to additional risks. MiCA requires issuers to hold part of their reserves with European credit institutions.

During an earlier interview, Ardoino described the rules as “very dangerous when it comes to stablecoins,” while acknowledging that refusing authorization could reduce USDT’s availability on European exchanges.

Tether maintained the same position in July 2025, when Ardoino wrote on X that the company would reconsider an application only “when MiCA becomes safer for consumers and stablecoin issuers.”

Tether was not the only major crypto company affected by the EU framework. Binance, the world’s largest crypto exchange by trading volume, withdrew its MiCA license application in Greece after failing to secure approval and began suspending services in several EU countries when the 18-month transition period ended.

Binance’s retreat has left Coinbase, OKX and other MiCA-licensed exchanges competing for European customers as regulated platforms take a larger role in the region. For OKX, the USDT-to-USDC route gives affected holders a voluntary conversion option while European support for Tether’s stablecoin continues to decline.

Consensys has temporarily halted product releases after a North Korea-linked consultant gained access to its systems for about one month.

Drop Site News reported that the developer joined the Ethereum software company under the alias “Tyler Knapp” and used the GitHub handle “imyugioh.” Public GitHub records reviewed by the outlet showed that the consultant began contributing code on March 9 before his access ended in April.

Internal messages obtained by Drop Site showed that Knapp worked on core MetaMask platform code, including sections used to connect crypto users with third-party fiat payment providers. Consensys suspended product releases during its investigation and instructed staff to avoid contact with the consultant, according to the report.

Consensys general counsel Matt Corva told Drop Site that an established third-party service provider introduced Knapp to the company. Corva stressed that Consensys treated him as a consultant rather than a direct employee.

“Very quickly after being introduced, we discovered the threat, followed our security protocols, immediately terminated any access and launched a comprehensive investigation that confirmed there was no misappropriation of assets or data, no malicious code deployed, and no impact to user safety and security.”

Although Consensys disclosed no financial losses, Corva said in a statement that the company would reassess how it outsources engineering and development work. The firm also notified law enforcement and provided information about the incident, according to internal communications reviewed by Drop Site.

Consensys found no loss of user assets

Consensys’ investigation found no evidence that the consultant stole company data or digital assets, inserted harmful code, or compromised users, according to Corva. The company did not publicly explain how it established the developer’s alleged ties to the Democratic People’s Republic of Korea.

Even without a confirmed loss, developer access can expose sensitive infrastructure. According to TRM Labs, developer environments have become one of the quickest paths for attackers seeking access to systems that hold private keys or approve crypto withdrawals.

A six-month investigation supported by the Ethereum Foundation’s ETH Rangers Program shows that the hiring threat extends beyond Consensys. The Ketman Project identified about 100 suspected North Korean IT workers using false identities across 53 crypto and Web3 projects, according to an ETH Rangers recap published in April.

Ketman investigators also traced at least three suspected groups across 11 code repositories, where projects had merged 62 pull requests before detecting the activity. The project reported that some applicants used generated profile pictures, forged identity documents and false Japanese identities to pass screening checks.

North Korea remains crypto’s largest hacking threat

North Korea-linked groups have repeatedly used fake identities and remote engineering jobs to gain entry to technology companies. As crypto.news reported in November, Opsek founder and Security Alliance member Pablo Sabbatella warned at Devconnect Buenos Aires that North Korean workers could be embedded in as many as one-fifth of crypto companies.

Sabbatella also estimated that North Korean applicants account for roughly 30% to 40% of job applications received by crypto firms, suggesting that employment fraud is not limited to isolated cases.

Crypto companies face added risk because employees and contractors can receive access to code, wallets and transaction systems. TRM Labs estimated that North Korea was responsible for 64% of the value stolen in crypto hacks during 2025, when total losses exceeded $2.7 billion. TRM Labs

One attack accounted for much of the damage. The FBI attributed the February 2025 theft of about $1.5 billion from Bybit to North Korea’s TraderTraitor group, which dispersed the assets across thousands of blockchain addresses. FBI

TRM Labs reported that more than 30 exchanges and decentralized finance protocols now share rapid alerts through its Beacon Network when North Korea-linked funds reach participating platforms. For Consensys, the consultant’s removal prevented any known user loss, but the incident has prompted a review of the company’s third-party hiring controls.

A macOS information-stealing malware can compromise cryptocurrency holdings by hijacking Telegram Desktop sessions and extracting wallet data, according to blockchain security firm SlowMist. The attack is notable because it focuses on taking over already-authenticated local sessions and stealing sensitive credentials, rather than relying solely on intercepting new logins.

SlowMist says the malware harvests data from multiple sources on an affected Mac, including Apple’s Keychain, Safari cookies, Apple Notes, Telegram Desktop and wallet databases tied to more than a dozen crypto wallets. After collecting credentials and authenticated session material, attackers can use the stolen information to access wallets and potentially execute account takeovers.

Key takeaways

• SlowMist reports a macOS malware chain that combines credential theft, browser/session harvesting, and wallet database extraction.
• Telegram two-step verification may not stop the attack because the malware reuses an existing authenticated Telegram Desktop session on the device.
• The malware targets both software wallets (such as Exodus, Atomic, Electrum, Wasabi, and Monero) and hardware wallet companion apps (Ledger Live and Trezor Suite).
• Defenders’ best near-term steps include terminating Telegram sessions, re-authenticating on a trusted device, and rotating wallet recovery phrases and assets to new addresses.

How the Telegram session hijack works

SlowMist’s assessment centers on the malware’s ability to work through already-established authentication. Rather than forcing a new Telegram login flow—which would typically require re-entering a phone number, verification code, and two-step verification password—the malware appears to leverage the authenticated session stored locally by Telegram Desktop.

In its reproduced testing, SlowMist says researchers restored stolen Telegram Desktop session data on another Mac without needing to repeat the normal verification steps, including entering a phone number or two-step verification password. That means even users who believe their Telegram protections are strong may still face risk if their device has already been compromised.

For crypto users who rely on Telegram to manage accounts, coordinate transfers, or receive wallet-related approvals, this matters: a session takeover can enable attackers to impersonate the user, obtain access to conversations and any linked operational details, and facilitate subsequent wallet-focused actions.

What data the malware harvests on macOS

SlowMist reports that the malware gathers a range of sensitive information from the compromised system. The company specifically points to macOS Keychain data, Safari cookies, Apple Notes, and Telegram Desktop. It also looks for cryptocurrency wallet data stored on the device.

Beyond user credentials and browser artifacts, the malware also targets stored wallet databases and related wallet extension data. SlowMist says that after collection, attackers copy authenticated session data, wallet databases, and browser wallet extension information—creating multiple paths for wallet access depending on the wallet type and local storage structure.

The combined approach is important because it increases the odds of success. Instead of betting on a single weakness, the malware can pursue credential-based decryption and offline wallet database recovery, or it can aim at social engineering and application replacement—two methods that can operate even if one fails.

Wallet targets: from desktop software to hardware app companions

According to SlowMist, the malware targets both common software wallets and applications associated with hardware wallets. On the software side, it names Exodus, Atomic, Electrum, Wasabi and Monero. On the hardware side, it includes Ledger Live and Trezor Suite—suggesting the malware aims to compromise not only keys stored by desktop apps, but also the companion software environments used to interact with hardware wallets.

SlowMist also says the malware searches for wallet data stored by full-node clients. It lists Bitcoin Core, Litecoin Core, Dash Core, and Dogecoin Core as examples, implying that systems running these services may contain wallet-related data that the attacker can harvest.

This breadth means affected users may not realize they are at risk simply because they don’t use one of the “headline” wallets. Anyone who stores wallet data locally, uses wallet-related companion apps, or keeps backups and recovery material on the same device could be exposed depending on what the malware detects and copies.

Two ways attackers can turn stolen data into theft

SlowMist describes two primary endgame strategies after the data theft phase.

First, attackers can attempt to decrypt stolen wallet databases offline using passwords taken from the infected device. If the malware successfully extracts the credentials needed to unlock local wallet storage, offline decryption reduces the attacker’s dependence on live access or additional compromise steps.

Second, SlowMist says attackers may replace legitimate Ledger and Trezor applications with fake versions designed to trick users into entering recovery phrases. This shifts the attack from purely technical compromise to user deception, leveraging the fact that many users will naturally follow prompts in trusted-looking wallet software.

SlowMist states that it reproduced the full attack chain in an isolated environment, supporting the firm’s characterization of how the different components can work together—from data collection through to potential wallet manipulation.

What users should do if they suspect compromise

SlowMist urged users who suspect their devices have been compromised to take immediate containment steps. The firm recommends terminating existing Telegram Desktop sessions, establishing a new trusted login, and then changing both the Telegram two-step verification password and the Telegram Desktop Passcode.

For wallet security, SlowMist advises users to generate a new recovery phrase on a clean device and move all assets to new addresses. The underlying logic is straightforward: if a recovery phrase or wallet database may be recoverable by an attacker, treating existing addresses as potentially compromised helps reduce the chance of future unauthorized access.

Given the malware’s emphasis on authenticated sessions and local credential harvesting, the safest remediation tends to focus on “breaking the chain” on the infected device—re-authenticating critical services and rebuilding wallet access from a clean environment rather than attempting to patch individual components.

Going forward, investors and everyday users alike should watch for signs of Telegram session abnormality (unexpected activity, sudden device prompts, or account behavior) and treat any macOS security incident as potentially wallet-relevant. The key uncertainty remains how widely such malware campaigns are deployed in the wild—but SlowMist’s findings offer a clear blueprint for why device compromise, not just exchange security, can determine the outcome of a crypto theft attempt.