A total solar eclipse is not just an occasion for skygazing, it’s an occasion for science. The most celebrated experiment conducted during an eclipse occurred on May 29, 1919. Four years earlier, in Nov., 1915, Albert Einstein first presented his theory of general relativity, arguing, among other things, that gravity can warp space-time and bend light as it passes around a massive object like the sun. That bending would be slight. Starlight passing by the sun would, Einstein calculated, be diverted by just 1.75 arc seconds, with a single arc second measuring one=3,600th of a degree. It would be impossible to observe that phenomenon in real time, of course, since the brilliant fires of the sun would wash out something as faint as starlight. During an eclipse, however, those fires would be briefly blotted.

To take advantage of that opportunity, two expeditions of astronomers—one from the Greenwich Observatory and one from Cambridge University—set out for Sobral, Brazil and the island of Principe off the west coast of Africa, where the approaching 1919 eclipse would be visible. During the brief minutes of totality, they charted the precise positions of stars near the sun that popped into view when the lights went out. On subsequent evenings, after the sun had set, they mapped the positions of the same stars and found that they indeed differed slightly from the measurements taken during the eclipse.

North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research.

Genians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services.

Kimsuky has built local AI systems for cyberattacks

Running models locally allows operators to make queries without sending potentially sensitive attack information to third-party AI providers. According to the research, the environments also support retrieval-augmented generation, which can connect an AI model with additional information supplied by its operator.

Alongside the three environments, researchers found libraries and frameworks that can embed language models into custom software. Kimsuky had also collected the AI coding assistant Cursor and speech-to-text tools as it assembled its AI infrastructure.

Rather than developing new AI models, the activity examined by Genians centered on putting existing open-source technology to work across malware development, data analysis and attack automation.

The firm assessed that the activity had moved beyond isolated tests because Kimsuky was continuously preparing to incorporate AI into operational attack capabilities. However, its findings did not show that the group was developing proprietary AI models from scratch.

Keeping the models on local infrastructure could also allow the hackers to work with information without submitting it to external cloud systems, according to the report. The collection of supporting software indicates that the AI environments form part of a larger technical setup rather than functioning only as standalone chat tools.

AI-generated phishing documents target crypto firms

Kimsuky has also continued using generative AI to prepare phishing material focused on cryptocurrency, investment strategies and fintech services, according to Genians.

Researchers identified polished documents that closely copied material associated with a Korean AI-powered investment platform. The files used natural language, consistent formatting and professional design elements that the cybersecurity firm associated with AI-generated content.

Such material provides another use for the group’s AI infrastructure beyond coding and data processing. Instead of relying only on poorly written phishing emails, the operators can use generative tools to prepare documents designed around financial subjects relevant to their intended targets.

The findings add Kimsuky to a series of North Korea-linked operations using newer technical and social-engineering methods against the cryptocurrency industry.

In July, cybersecurity firm JUMPSEC reported that BlueNoroff, another North Korea-linked group, was operating fake Zoom and Microsoft Teams meetings that profiled cryptocurrency users before malware was delivered.

JUMPSEC recovered source code from an active phishing kit after its operators accidentally exposed JavaScript source maps. The code contained wallet-scanning functions, operator controls, and separate malware delivery routes for Windows and macOS.

Once a target entered a fake meeting page, the system checked for Ethereum wallet connections and non-EVM wallets, including Solana tools, before sending the results to an operator panel. Windows implants could also identify browser extensions across Chrome, Edge, Brave, Opera, Vivaldi and Firefox variants, allowing operators to check for wallets such as MetaMask.

The attackers could then decide whether to continue the intrusion based on information gathered from the target, JUMPSEC found.

North Korean hackers are combining AI with social engineering

AI also appeared inside BlueNoroff’s fake meeting operation, although in a different role from the local models identified in the Kimsuky research.

According to JUMPSEC, operators combined AI-generated headshots with body movements taken from previous meetings to create convincing participants for fake video calls. Victims could arrive through a Telegram account belonging to a real contact whose account had already been compromised, before receiving a Calendly invitation that redirected them to a fake meeting domain.

During the call, an operator could display a prepared video, send messages about a supposed microphone problem, and trigger a fake Zoom software update. On Windows, the resulting ClickFix process used PowerShell and VBScript, while the macOS route delivered a fake meeting installer alongside information-stealing malware.

Arctic Wolf had previously identified more than 80 lookalike Zoom and Teams domains associated with related operations. About 80% of the targets it identified worked in crypto, blockchain finance or connected investment sectors, while founders and chief executives represented 45% of the identified targets.

North Korean operations have also sought access from inside crypto companies rather than relying solely on phishing or malware.

In July, Consensys temporarily stopped product releases after discovering that a consultant linked to North Korea had gained access to its systems for roughly one month, according to Drop Site News.

The consultant, who operated under the name Tyler Knapp and used the GitHub handle “imyugioh,” contributed to core MetaMask platform code, including components connecting cryptocurrency users with third-party fiat payment providers.

Consensys general counsel Matt Corva said a third-party service provider had introduced the consultant to the company. The company terminated his access after identifying the threat and said its investigation found no stolen assets or data, malicious code or impact on user security.

Separate research from the Ketman Project identified about 100 suspected North Korean IT workers operating under false identities across 53 crypto and Web3 projects. Investigators also traced suspected groups across 11 code repositories where projects had already merged 62 pull requests before the activity was detected.

North Korea stole more than $2 billion in crypto in 2025

The development of AI-assisted attack infrastructure comes after North Korean hacking groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data previously reported by crypto.news.

Most of the year’s losses came from the February 2025 attack against Bybit, where more than 400,000 Ether and staked Ether worth about $1.5 billion were stolen. The FBI attributed the breach to North Korea and identified the actors responsible under its TraderTraitor designation.

Bybit has since taken the dispute into a U.S. federal court. On Aug. 8, the exchange sued the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group in the U.S. District Court for the District of Columbia.

The exchange also obtained a preliminary injunction covering certain stolen assets held by unidentified defendants. The order prevents the identified assets from being transferred, sold or otherwise disposed of while the civil case proceeds, although it does not constitute a final ruling over ownership or liability.

Blockchain tracing became increasingly difficult after the Bybit theft as the attackers converted assets into Bitcoin and dispersed funds across thousands of wallets. By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked.

Researchers have also warned that AI could reduce the time attackers need to identify weaknesses in software. NEAR Protocol co-founder Illia Polosukhin has said AI is increasing hackers’ ability to locate vulnerabilities faster than conventional security processes can patch them.

The $100 million Coldcard Bitcoin hardware wallet exploit has also been suspected of originating from an obscure vulnerability uncovered with AI. Separately, North Korean operators continue to use phishing, fake remote workers and compromised online identities, while the latest Genians research shows Kimsuky preparing local AI models for malware development, data analysis and attack automation.

ETH investors are increasingly exploring alternatives to holding as market volatility persists, with ASDeFi highlighting cloud mining and automated asset management.

As of August 2026, Ethereum remains a key component of the global cryptocurrency market. With the continued development of blockchain infrastructure, stablecoins, and on-chain financial applications, the investment rationale for ETH is gradually shifting from a focus solely on price fluctuations to the long-term management and practical applications of cryptocurrency assets.

For investors who hold ETH long-term, a rising market can present opportunities for capital appreciation, but when the market enters a period of volatility, relying solely on price movements to generate returns often means a long wait. Against this backdrop, some investors are beginning to explore investment options beyond simply buying and holding ETH, including hashrate services and automated cryptocurrency asset management.

ETH investors are beginning to explore options beyond “holding”

ETH investors typically follow a straightforward investment strategy: buy ETH and wait for the market price to rise. However, the cryptocurrency market has changed. Investors are now focusing on the efficiency of asset utilization, including how to lower the equipment barriers to traditional mining, how to reduce daily operating costs, and how to manage cryptocurrency-related services using automation tools.

ASDeFi cloud mining is a model that has attracted the attention of some market participants amid this trend. Compared to purchasing mining rigs on one’s own, cloud mining centralizes the management of equipment, data centers, power, and operations and maintenance. Users select the appropriate hashrate contracts through the platform, eliminating the need to set up specialized equipment at home.

Why are ETH holders interested in ASDeFi cloud mining?

One key reason is that traditional mining models present a high barrier to entry for individual investors. Participating in mining on one’s own not only requires covering the costs of purchasing mining rigs and electricity, but also involves addressing issues such as the equipment’s operating environment, cooling and maintenance, network and technical management, while also having to contend with the impact of constantly changing mining difficulty.

In contrast, the cloud mining model entrusts the management of complex aspects — such as mining rigs, facilities, electricity, and day-to-day operations — to professional operators, thereby lowering the equipment and operational barriers to entry for individuals wishing to participate in mining. For investors who already hold cryptocurrency assets but do not wish to invest significant capital in purchasing and maintaining mining rigs, this model offers a relatively convenient way to participate.

What is ASDeFi?

Founded in 2020 and headquartered in the United Kingdom, ASDeFi primarily provides AI-powered cloud computing power and cryptocurrency-related services. Through centralized management of computing resources, intelligent scheduling, and automated operations and maintenance, the platform offers users cloud mining services that eliminate the need to purchase mining equipment or build mining farms. Users can manage their accounts and view service status via a web browser or mobile app. Currently, it supports mining for major cryptocurrencies such as ETH, BTC, XRP, SOL, DOGE, BNB, and USDT.

How to Join ASDeFi Cloud Mining?

1. Register for a cloud mining account.

Once registration is complete, the user receives a free $15 bonus that can be used to purchase mining contracts, which yield a daily return of $0.60.

2. Update Account Information

Log in to the account dashboard and add a linked cryptocurrency wallet address to receive earnings.

3. Purchase a Mining Contract

Go to the Contracts page and purchase the $15 Check-in Contract. Users can also choose a mining contract that fits a particular budget and investment plan.

4. Start Mining and Withdraw Earnings

After purchasing the contract, the platform will automatically allocate computing power resources, and the cloud mining contract will begin running. View earnings in real time on the phone, and withdraw mining earnings at any time.

Currently popular mining contracts:

Summary

As the Ethereum ecosystem continues to evolve, the focus of ETH investors has gradually shifted from simply waiting for price increases to more flexible approaches to asset management. Through smart cloud computing power and automated management, ASDeFi offers users who hold ETH long-term an alternative way to participate in the cryptocurrency ecosystem. Some users have reported monthly returns of up to approximately $7,000; however, actual returns are subject to factors such as the amount invested and contract terms, and investors should approach this opportunity with caution.

For more information, visit the official website and download the app.

Australia’s financial crime watchdog has ordered Cryptolink’s Bitcoin ATM network offline for three months, citing unresolved compliance concerns under anti-money laundering rules.

According to the Australian Transaction Reports and Analysis Centre (AUSTRAC), the suspension of Cryptolink’s Virtual Asset Service Provider (VASP) registration—effective for a three-month period starting Sunday—means the company’s crypto ATMs will not be permitted to operate during that time. The move comes as Australian regulators have intensified scrutiny of crypto ATM activity, including alleged misuse by criminals.

Key takeaways

• AUSTRAC suspended Cryptolink’s VASP registration for three months, taking its crypto ATMs out of service during the suspension.
• The regulator cited failures to meet basic reporting obligations, especially threshold transaction reports, and said the company did not respond to information requests.
• AUSTRAC said it remains concerned about the ability to manage “high-risk transactions” through crypto ATMs (CATMs).
• The action follows prior enforcement steps in 2025, including an enforceable undertaking tied to alleged late reporting and risk assessment gaps.

AUSTRAC suspends Cryptolink’s ability to operate

AUSTRAC CEO Brendan Thomas said Monday that Cryptolink’s VASP registration has been suspended for three months, beginning Sunday. In practical terms, the suspension prevents Cryptolink’s Bitcoin ATMs from operating because the company lacks active authorization to provide virtual asset services during the period.

AUSTRAC also pointed to specific compliance shortfalls. The regulator said Cryptolink failed to satisfy core reporting requirements, “particularly threshold transaction reports.” AUSTRAC added that the company did not respond to the regulator’s request for information—an issue that, in AUSTRAC’s framing, compounded the broader monitoring and oversight concerns.

“As part of our continued focus on digital currency as a money laundering risk, AUSTRAC has ongoing concerns about the company’s ability to manage high-risk transactions through its CATMs,” Thomas said.

Why regulators are targeting crypto ATMs

Australia has the highest concentration of crypto ATMs across the Asia-Pacific region, and regulators have been focused on how these machines can be exploited for illicit activity. AUSTRAC’s latest action underscores that the compliance expectations for crypto ATM operators are not merely formalities; they are intended to prevent gaps in reporting and oversight that can enable money laundering.

Late 2024 onward, authorities have increasingly discussed criminal use of crypto ATMs, including cases involving the targeting of vulnerable users. Against that backdrop, the operational suspension of a major ATM operator signals that regulators are willing to use enforcement tools that immediately restrict market access when compliance standards are not met.

Enforcement history: from an undertaking to a paid infringement notice

AUSTRAC’s decision does not arrive in isolation. The suspension follows steps taken in 2025 after issues were identified during Cryptolink’s compliance review process.

In October 2025, Cryptolink entered an enforceable undertaking with AUSTRAC after its Cryptocurrency Taskforce identified alleged breaches. AUSTRAC cited issues including late transaction reporting and shortcomings in Cryptolink’s risk assessments. The undertaking was accompanied by further enforcement: AUSTRAC also issued a $56,340 infringement notice, which Cryptolink paid.

While the October 2025 undertaking and infringement notice reflect earlier remedial and punitive measures, Monday’s suspension indicates AUSTRAC still viewed compliance performance as insufficient—particularly around reporting to AUSTRAC and responsiveness to information requests.

What the suspension means for users and the ATM footprint

Cryptolink operates 96 ATMs in Australia, enabling customers to exchange cash for Bitcoin. The network includes machines in major cities such as Sydney, Melbourne, and Brisbane.

During the three-month suspension window, these ATMs will be prevented from operating because AUSTRAC has removed the company’s ability to run as a VASP under its registration. That restriction affects not just new transactions but also ongoing consumer access to crypto acquisition through ATM channels.

Cointelegraph contacted Cryptolink for comment, but the company’s response was not included in the information provided with AUSTRAC’s announcement.

What to watch next

Crypto ATM operators in Australia—and users who rely on them—will be looking closely at whether Cryptolink can address AUSTRAC’s specific concerns around threshold reporting, high-risk transaction controls, and regulatory engagement. The suspension ends after three months, but the key question is whether the underlying compliance gaps that AUSTRAC described are actually resolved in time to restore authorization.

The pair gained momentum following the release of the US labour market report for July 2026 on 7 August. Non-farm employment fell by 23,000 jobs, compared with a forecast for an increase of 80,000 jobs among economists surveyed by Reuters. Employment data for May and June were also revised downwards, according to the Bureau of Labor Statistics. The dollar responded with broad-based weakness. Earlier, on 30 July, the Bank of England kept its interest rate at 3.75% by a six-to-three vote, with three members of the committee voting for a rate hike. The regulator’s decision also highlighted inflation risks associated with volatility in energy prices.

Technical Analysis of GBP/USD

After a sharp rise from around 1.3280 towards 1.3500 in late July, the pair entered a narrowing range between the upper and lower boundaries of the current profile at 1.3483 and 1.3440, respectively. The two boundaries gradually converged, forming a pattern resembling a contracting triangle. The green impulse candle subsequently broke above the pattern’s upper boundary, while the price is attempting to establish itself above both the trendline and the profile boundary. If the bullish scenario develops, the price could move towards the red resistance level at 1.3555.

If the current breakout from consolidation proves to be false and the price returns inside the profile, the POC at 1.3465 and the lower profile boundary at 1.3440 will regain their importance for market participants. Below these levels lies the green support area at 1.3420. The RSI + MAs indicator shows three readings of 61, 57 and 57. All three values are above the neutral zone, while the moving averages are coloured green. It is also worth noting that vertical volume has declined compared with the late-July impulse.

Summary

The attempt to break above the triangle’s upper boundary could open the way towards a test of the red resistance area at 1.3555, but the sustainability and potential of the move may also depend on the flow of further US economic data.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Crypto markets enter the week with the near-term direction tied to whether easing U.S. inflation can keep the Federal Reserve’s interest-rate policy on hold and take pressure off the dollar into year-end.

Consumer price index data due Wednesday is the first test, but the larger question is whether weaker labor demand is beginning to outweigh price pressures still above the central bank’s target.

ING strategists Chris Turner and Francesco Pesole say they expect a no-increase outcome to create a more supportive cross-asset backdrop.

“If we’re right on the Fed, the dollar should be due a benign decline into year-end in what should be a risk-positive climate,” they wrote in a report. A hotter CPI print would challenge that path and put Treasury yields and the dollar back at the center of crypto trading.

Geopolitical instability will keep on playing a role in crypto prices. As war in the Middle East threatens vital oil passageways, inflation expectations could increase and, along with them, interest-rate-hike expectations.

What to Watch

(All times ET)

• Crypto
  • Aug. 12: AI Financial Corporation says roughly 6.9 billion WLFI tokens covered by its original lock-up arrangements are expected to become fully transferable.
  • Aug. 14: Second-quarter Form 13F filing deadline for U.S. institutional investment managers.
• Macro
  • Aug. 11, 12:30 a.m.: Royal Bank of Australia interest rate decision est. 4.35% (Prev. 4.35%)
  • Aug. 11, 10:00 a.m.: U.S. existing home sales for July est. 4.07M (Prev. 4.09M)
  • Aug. 12, 08:30 a.m.: U.S. CPI YoY for July est. 3.4% (Prev. 3.5%); MoM est. 0.1% (Prev. -0.4%)
  • Aug. 13, 08:30 a.m.: U.S. PPI YoY for July (Prev. 5.5%); Core PPIMoM est. 0.1% (Prev. -0.3%)
  • Aug. 13, 08:30 a.m.: U.S. Initial Jobless Claims for period ending Aug. 8 est. 198K (Prev. 199K)
  • Aug. 13, 8:30 a.m.: U.S. Continuing Jobless Claims for period ending Aug. 1 (Prev. 1801K)
  • Aug. 14, 08:30 a.m.: U.S. Retail Sales MoM for July est. 0.2% (Prev. 0.2%)
  • Aug. 14, 10:00 a.m.: University of Michigan Consumer Sentiment Prel for August (Prev. 54.4); 1-Yr Inflation Expectations (Prev. 4.2%)
  • Aug. 16, 07:50 p.m.: Japan GDP Growth Rate QoQ Prel for Q2 est. 0.5% (Prev. 0.5%)
• Earnings
  • Aug. 10: Trump Media & Technology Group (DJT), post-market
  • Aug. 10: Bitdeer Technology Solutions (BTDR), pre-market, -$0.33
  • Aug. 10: Bakkt (BKKT), post-market, $0.03
  • Aug. 10: Keel Infrastructure Corp. (KEEL), pre-market, $
  • Aug. 10: Sarplink (SBET), pre-market, $0.01
  • Aug. 10: Exodus Movement (EXOD), post-market, -$0.07
  • Aug. 11: CoreWeave (CRWV), post-market, -$1.17
  • Aug. 11: Etoro Group (ETOR), pre-market, $0.6
  • Aug. 12: Twenty One Capital (XXI)
  • Aug. 12: Securitize (SECZ), post-market
  • Aug. 13: Gemini Space Station (GEMI), post-market, -$0.68

Token Events

• Governance Votes & Calls
  • Lido DAO is voting to appoint Bryce Howarth as a director of the Lido Alliance BORG Foundation, replacing Adrian Cachinero Vasiljevic. Voting ends Aug. 10.
  • QuickSwap is voting to temporarily increase the QuickSwap Foundation’s share of protocol revenue from 30% to 80% for three months to fund protocol expansion and new product development. Voting ends Aug. 10.
  • Seamless DAO is voting to permanently wind down operations and revoke all administrative control, transitioning the protocol into a dormant, withdrawal-only state. Voting ends Aug. 11.
  • Decentraland DAO is voting on a non-binding poll to introduce term limits for DAO council members, with a suggested maximum of two consecutive two-year terms. Voting ends Aug. 11.
  • GnosisDAO is voting to overhaul its governance structure by separating powers between a leadership service provider and an independent supervisory board, while introducing a strict 5% voting weight cap to enforce decentralization and comply with MiCA regulations. Voting ends Aug. 13.
  • Lazy Summer DAO is voting to grant guardian roles and set expiration parameters on HyperEVM, enabling emergency pause capabilities for its fleets. Voting ends Aug. 11.
• Unlocks
  • Aug. 12: Pump PUMP$0.002791 to unlock 1.75% of its circulating supply worth $18.93 million.
  • Aug. 15: Connext (CONX) to unlock 1.43% of its circulating supply worth $11.47 million.
  • Aug. 16: YZY YZY$0.2964 to unlock 22.83% of its circulating supply worth $35.73 million.
• Token Launches
  • Aug. 12: AI Financial’s roughly 6.9 billion WLFI tokens covered by the original lock-up arrangements are expected to become fully transferable.

Conferences

Bitcoin (BTC) briefly crossed $65,000 early on Monday, holding its gains over the weekend and reporting an increase of nearly 4% over the past week. Bulls defended key levels during last week’s pullback, but the flagship cryptocurrency remains well below its 100-day EMA at $66,905.

Ethereum (ETH) and Ripple (XRP) are also showing positive signs. ETH is up 3.60% over the past seven days, while XRP held above $1, posting a marginal recovery after a significant 5% decline.

Bitcoin (BTC) Above $65,000

Bitcoin (BTC) closed July with a substantial decline of almost 3% to $62,825. The price rebounded on Sunday (August 2) to reclaim $63,000 but registered another substantial decline on Monday ($62,743) before rebounding to $63,466 as buyers and sellers struggled to exert influence. Buyers gained control on Tuesday, and the flagship cryptocurrency reached $64,891 on Friday (August 7), driven by a weaker-than-expected jobs report that eased concerns about another interest rate hike. CoinGlass data shows Spot Bitcoin ETFs also registered substantial inflows, supporting price action, while whale accumulation provided support.

BTC is currently trading above $65,000, above the 50-day EMA. However, it remains below the 100 and 200-day EMAs, suggesting near-term strength within a larger downtrend. The Relative Strength Index (RSI) sits between 50 and 55, suggesting a slight bullish bias, while the Moving Average Convergence Divergence (MACD) indicates a gradual build-up of buying pressure.

BTC continues to face resistance at the 100 and 200-day EMAs. A close above these levels could suggest the market is entering a long-term bullish trend. On the other hand, if BTC loses the $64,000 level, it could start a deeper correction, taking the price closer to $60,000. A drop below this level could trigger liquidations and spark marketwide panic.

Markets Positive

Ethereum (ETH) and other cryptocurrencies also traded in positive territory, with the exception of Ripple (XRP), which is down 3% over the past week. ETH crossed $1,900 last week, reaching a day high of $1,932 on August 7. The world’s second-largest cryptocurrency is currently trading at $1,925, just above its 100-day EMA of $1,924. A decisive close above this level could fuel a push towards $2,000, a level not seen since May 2026. BNB is up nearly 4% over the past week, while Solana (SOL) is up almost 6% as it continues building momentum. The overall crypto market cap is also positive, up 0.32% to $2.21 trillion, according to data from CoinMarketCap.

Traditional markets also traded in positive territory, with the MSCI All Country World Index rising 0.1%. Japan’s Nikkei and South Korea’s Kospi also recorded substantial gains, while a softer-than-expected jobs report pushed the S&P 500 to record levels. Among chipmakers, Taiwan Semiconductor and SK Hynix also recorded positive movement.

Brent briefly crossed $84 before a marginal decline to $83.60 after US-Iran talks to reopen the Strait of Hormuz bore little fruit. Meanwhile, the US Dollar strengthened against other major global currencies, and the 10-year yield reached 4.66%.

A Closer Look At Ripple (XRP) Price Action

Ripple (XRP) has seen substantial movement over the past week. The altcoin recorded a sharp decline last week, falling over 5%. However, it held above $1 and made a marginal recovery over the weekend. XRP is currently trading around $1.03, well below the 50-day EMA at $1.10, which is acting as the immediate resistance. The RSI is around 39, while the MACD is negative, indicating a near-term bearish bias. XRP has strong support at $1, a level where buyers could step in and stop the downtrend.

A Crucial Week

A wave of market data is due this week, starting with Wednesday’s Consumer Price Report (CPI) data following Friday’s jobs report. The data could help gauge whether the market has withstood geopolitical headwinds after a noticeable improvement in June. CPI fell in June, but the resumption of conflicts in the Middle East could impact the July report. Energy prices have risen again after oil shipments through the State of Hormuz and the Bab el-Mandeb were impacted, pressuring the price of other goods as well.

Producer Price Index (PPI) data is due on Thursday. PPI numbers were higher than expected in May but declined in June. An increase could indicate that prices will rise as businesses pass rising expenses to consumers. Weekly jobless claim data is due Thursday, while retail and consumer sentiment data is expected on Friday.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Hedge funds trading bitcoin BTC$65,148.49 futures on the Chicago Mercantile Exchange have turned net long, according to Ki Young Ju, CEO of blockchain data analytics firm CryptoQuant.

The rare positioning shift suggests professional traders are increasingly betting on bitcoin prices rising.

“Hedge funds on CME have flipped net long on bitcoin futures, a rare shift after years of structural short positioning driven by the basis trade. You cannot run a traditional carry trade with an aggregate net-long futures position. The suits are now betting on bitcoin’s upside,” Ki Young Ju said.

Leveraged funds have historically remained net short CME Bitcoin futures because of the basis trade. In this market-neutral strategy, traders buy spot bitcoin or exchange-traded funds (ETFs) while simultaneously selling futures. Profit comes from the premium between futures and spot prices narrows, rather than from bitcoin moving higher. This activity has kept hedge funds’ reported futures positioning negative for years.

A fake Wasabi Wallet application has appeared on Apple’s App Store and has already been linked to the theft of roughly 6 BTC from one user, according to crypto security monitoring reports.

According to Com Feed monitoring, the malicious application was presented as Wasabi Wallet, with reports circulating on X showing that one victim lost about 6 BTC after encountering the fraudulent software. The listing has also been identified as the 27th crypto wallet clone found on Apple’s App Store so far this year.

Fake Wasabi app on the Apple App store. Source: X/thecomfeed

Details about how the victim interacted with the application, including whether a recovery phrase was entered or another method was used to drain the wallet, have not been disclosed in the initial reports. Com Feed warned users to verify the Wasabi Wallet application carefully before downloading software presented under the wallet’s name.

Fake Wasabi Wallet becomes 27th reported App Store clone

The reported Wasabi Wallet impersonator adds to a series of fraudulent crypto applications that have passed through Apple’s App Store review process in 2026.

According to the monitoring report, 27 wallet clones have now been identified on the App Store since the beginning of the year. The fake Ledger application remains the largest case among the reported clones, with approximately $9.3 million linked to thefts.

Fraudulent wallet applications commonly imitate the branding and interface of established crypto products, making it difficult for users to distinguish them from legitimate software based on appearance alone. In the current case, the initial report specifically identified the application as a fake Wasabi Wallet drainer rather than an official release from the wallet project.

The reported loss of about 6 BTC also places the latest case among the larger individual thefts tied to wallet impersonation apps this year. The exact dollar value depends on Bitcoin’s price when the assets were taken, while the initial monitoring report quantified the victim’s loss in BTC rather than providing a confirmed dollar figure.

No information in the initial report identified the developer behind the application or explained how long the listing had been available through Apple’s marketplace. Details about whether Apple had removed the application were also not included in the information available at the time of the report.

Fake Ledger app previously drained musician’s 5.9 BTC

A similar incident in April showed how fraudulent applications can obtain control of crypto wallets by convincing users to disclose their recovery credentials.

On April 20, American musician Garrett Dutton, known professionally as G. Love, said he had lost 5.9 BTC worth about $420,000 at the time, after downloading software disguised as the Ledger Live manager from Apple’s App Store.

Dutton said he installed the malicious program on a new MacBook Neo and entered his seed phrase after the application prompted him to do so. The attacker subsequently emptied a Bitcoin stash that Dutton said he had accumulated for nearly a decade and intended to use for retirement.

On-chain investigator ZachXBT later tracked the stolen funds and reported that they had been transferred to addresses associated with KuCoin through nine transactions.

KuCoin told crypto.news at the time that it maintained procedures for monitoring and addressing potentially suspicious activity in line with regulatory requirements. The exchange disputed any characterization that it had allowed illicit activity and said the matter was under review, while declining to discuss specific details because of security, privacy and investigative considerations.

The April incident followed earlier cases involving software impersonating hardware wallet companies. In 2023, a fake Ledger application appeared on Microsoft’s store and was linked to nearly $600,000 in losses before Microsoft acknowledged that the program had passed its review process.

Crypto wallet impersonation has extended beyond app stores

Wallet owners have also faced impersonation attempts through physical mail, with scammers using leaked customer information to send letters carrying forged Ledger and Trezor branding.

As previously reported by crypto.news, some letters instructed recipients to complete a supposed mandatory authentication process before a stated deadline. QR codes included in the mail directed users to malicious websites where they were asked to provide 12-word or 24-word recovery phrases.

Once entered, the recovery phrases could give attackers control over the corresponding wallets, allowing them to transfer assets without requiring further authorization from the victim.

The FBI has separately documented rising losses from cryptocurrency-related fraud in the United States. Crypto-related losses reached approximately $11 billion in 2025, compared with about $9 billion a year earlier.

The latest fake Wasabi Wallet report concerns an impersonation application and does not indicate that Wasabi Wallet itself was compromised. The reported theft is instead tied to software presented to users under the wallet’s identity.