Standard Chartered has initiated coverage of Chainlink with a $200 LINK price target for the end of 2030, a roughly 25-fold increase from its current price near $8, as the bank expects tokenization and decentralized finance activity to drive higher demand for Chainlink’s services.

According to Standard Chartered Global Head of Digital Assets Research Geoff Kendrick, LINK could rise to $13 by the end of 2026 before reaching $41, $82 and $133 in the following years and eventually hitting $200 by the end of 2030.

The forecast would put LINK ahead of the bank’s expected returns for Bitcoin and Ethereum over the same period. Standard Chartered has projected Bitcoin at $500,000 and Ethereum at $40,000 by the end of the decade.

LINK was trading around $8.25 at the time of the report, down 0.8% over the previous 24 hours, according to CoinGecko data.

Standard Chartered sees Chainlink fees rising 25-fold

Kendrick’s Chainlink valuation rests partly on the bank’s expectations for tokenized assets and decentralized finance. Standard Chartered expects the value of tokenized assets held on blockchains to increase from roughly $340 billion currently to $4 trillion by the end of 2028.

For DeFi, the bank expects deployed assets to increase 37-fold to $2.7 trillion by 2030. Chainlink could benefit from both markets because its infrastructure supplies blockchain applications with external data and supports transfers between different networks, according to the report.

Based on those projections, Standard Chartered estimated that fees generated by Chainlink could increase about 25 times by 2030. The bank’s LINK valuation assumes the token price will broadly track that increase in fees.

The forecast also depends on Chainlink retaining its position in the oracle market. Standard Chartered estimated that Chainlink currently secures more than $110 billion in value, representing roughly 70% of oracle-dependent DeFi value globally and more than 80% of such value on Ethereum.

Aave V3 alone accounts for about 44% of the value secured by Chainlink, according to the bank.

Kendrick has used the same 37-fold DeFi growth forecast in several recent digital asset research notes. In June, he set a $100 target for Uniswap’s UNI and a $3,500 target for Aave’s AAVE, followed by a $60 target for Morpho in July.

UNI recorded a double-digit gain after Standard Chartered published its coverage, while LINK’s reaction to the latest report has remained more limited.

Institutional clients support the Chainlink thesis

Standard Chartered also based part of its forecast on Chainlink’s work with traditional financial institutions, where the network can provide data needed to operate tokenized funds, bonds and other financial products.

The bank identified Swift, DTCC, Euroclear, JPMorgan, Mastercard, UBS, Fidelity and S&P Global among institutions using Chainlink services. Kendrick expects customers outside crypto-native markets to account for an increasing portion of Chainlink fees as tokenization projects move into production.

Unlike many crypto assets, tokenized financial products can require recurring access to information such as net asset values, interest rates and reserve attestations. Standard Chartered expects those requirements to increase demand for oracle services if more securities and funds move on-chain.

The institutional argument follows several Chainlink projects involving banks and financial market infrastructure.

In June, Chainlink joined Project Pangea alongside FairSquareLab, UniKA and Qivalis to test stablecoin-based foreign exchange settlement between Europe and South Korea. Chainlink said the initiative involves more than 50 banks representing over $10 trillion in assets under management.

The project combines blockchain infrastructure with ISO 20022 messaging and existing Swift systems to test payment-versus-payment settlement using compliant euro and South Korean won stablecoins.

Chainlink CCIP has gained assets from rival bridges

Cross-chain infrastructure forms another part of Standard Chartered’s valuation case, although the bank said Chainlink continues to trail LayerZero in interoperability.

Kendrick reported that more than $7 billion in token value has migrated from legacy bridge infrastructure to Chainlink’s Cross-Chain Interoperability Protocol following a $292 million exploit in April. CCIP quarterly volume reached $4.9 billion during the second quarter, an increase of 353% from a year earlier, according to the note.

Some of those migrations have involved major DeFi protocols and token issuers.

On Aug. 4, BitGo selected Chainlink CCIP as the exclusive cross-chain infrastructure for Wrapped Bitcoin, replacing LayerZero for WBTC transfers. WBTC had a market capitalization of roughly $7.4 billion at the time, making the change one of the largest announced migrations involving Chainlink.

BitGo said it would standardize WBTC deployments around Chainlink’s Cross-Chain Token standard and use CCIP as the default interoperability infrastructure for future digital assets it issues. The structure allows BitGo to retain control over token contracts, transfer limits and operational settings.

Including earlier announcements from Mantle, Lombard, Aave and Kraken, publicly announced migrations from LayerZero to Chainlink infrastructure had reached roughly $14.6 billion after BitGo’s decision.

The migration activity followed the $292 million exploit involving KelpDAO’s LayerZero-powered bridge. KelpDAO blamed LayerZero for the incident and said it planned to rebuild using Chainlink, while LayerZero disputed that characterization.

Aave and stablecoins have expanded Chainlink usage

Chainlink has also added usage through existing DeFi relationships rather than relying only on projects switching infrastructure providers.

In July, Aave expanded its use of CCIP by making it the default cross-chain infrastructure for activity across the Aave App and Stable Vaults. The integration extended an existing setup under which CCIP already handled transfers of Aave’s GHO stablecoin and cross-chain governance messages.

Aave said the expanded deployment allows CCIP to process deposits, withdrawals, vault rebalancing, yield optimization and asset transfers. Stable Vaults use the infrastructure to move deposits between Ethereum, Base and Arbitrum without requiring users to manually bridge assets.

GHO and Savings GHO also use Chainlink’s Cross-Chain Token standard. Aave said GHO was available across eight blockchain networks in July, with CCIP responsible for transfers between supported chains.

United Stables adopted Chainlink infrastructure the same month after its U stablecoin surpassed $1 billion in circulating supply and $2.5 billion in daily trading volume.

Chainlink Data Feeds and Proof of Reserve went live for U, while United Stables said it planned to integrate CCIP for future cross-chain transfers. The company said its Data Feeds support pricing information used across more than 20 lending protocols, while Proof of Reserve lets users and applications verify U’s collateral on-chain.

Standard Chartered’s projections assume deployments of this type continue expanding as tokenized assets and DeFi grow. However, the bank identified several conditions that could prevent LINK from reaching its targets.

Kendrick said institutional tokenization could develop more slowly than the bank expects, while pilot projects may fail to become recurring production workflows. Standard Chartered also identified competition from specialist data and interoperability providers as a risk to Chainlink’s market position.

Technical failures could also damage confidence in Chainlink’s infrastructure, according to the report, particularly as more financial assets depend on its oracle and cross-chain services.

Under Kendrick’s staged forecast, LINK would first need to reach $13 by the end of 2026 before advancing to $41, $82 and $133 on the path to Standard Chartered’s $200 target in 2030.

The crypto market opened the week on a positive note, with bitcoin BTC$64,978.83 up 0.54% since midnight UTC at $65,209 and ether ETH$1,916.58 gaining 0.86% to $1,925 as sentiment stabilized following a turbulent July.

The move was correlated with Nasdaq 100 index futures, which rose by 0.45% since midnight, buoyed by speculation from the Middle East that Iran is ready to strike a deal with Oman to open the Strait of Hormuz.

The altcoin market is delicately poised, waiting to see if bitcoin can drive higher into the $68,000 to $72,000 range before benefiting from capital rotation.

Derivatives positioning

• Long-short ratio flips bullish: The long-short ratio for taker volume in crypto futures has flipped bullish, with longs accounting for 52% of the flow. A taker is an entity that removes liquidity from the order book by trading at available prices.
• BTC OI growth remains elusive: Bitcoin futures market activity remains subdued as BTC attempts to hold above $65,000 amid cooling bets on Federal Reserve rate increases. Open interest (OI) slipped back below 750K BTC. However, annualized funding rates and 24-hour OI-adjusted CVD remain positive, indicating that the limited interest present in the market is leaning bullish.
• ETH OI slides: De-risking continues in ETH futures, with open interest falling to 13.35 million tokens, the lowest level since May 3, and a significant drop from the late-May peak of 15.98 million tokens.
• Activity picks up in SOL futures: Renewed activity is appearing in SOL futures, as open interest rebounds to 64.60 million tokens from a recent low of around 60 million. This points to fresh capital inflows, coinciding with the token’s price recovery from nearly $70 to over $76 and a break above the widely tracked Ichimoku cloud, signaling a potential short-term bullish trend reversal.
• Monero leads OI growth: Privacy-focused coin Monero (XMR) has surged 5% over the past 24 hours, briefly topping $400 for the first time since June 12. The rally appears to have staying power, with futures open interest jumping 6% alongside the price gains. The 24-hour CVD is the most positive among major cryptocurrencies, indicating that buyers are acting more aggressively through market orders rather than passive limit orders. In addition, annualized funding rates stand at the highest level among majors at 28%, underscoring growing demand for upside exposure.
• BVIV hits 2026 lows: Bitcoin’s 30-day implied volatility index, BVIV, fell to a year-to-date low of 35.59% over the weekend. The drop shows expectations for market calm, although some traders warn that put options offering protection from price losses in BTC are still trading at a premium to calls.
• Calls dominate volume: The 24-hour volume ranking in options shows increased investor bias for bitcoin calls at strikes $68,000 and $70,000. Ether options show a similar profile.

Token talk

• Pump.fun PUMP$0.002738 led the altcoin market with a 5.39% gain since midnight UTC, extending a 24-hour run that has pushed its market cap above $1.1 billion.
• Ethena (ENA) rose 4.84% to $0.0907, continuing a steady recovery that has seen it gain ground in most sessions over the past two weeks. Still, it remains more than 90% below its all-time high.
• NEAR protocol gained 3.79% as AI tokens broadly recovered, with FET adding 2.10% after weeks of underperformance against the wider market.
• Lighter (LIT) slipped 0.94%, one of the only notable altcoins in the red as its slide following July’s 200%-plus rally continues to grind lower.
• Woldcoin WLD$0.3399 posted a 13% gain over the past 24 hours but remains in a deep downtrend, down 91% from its record high one year ago.
• CoinMarketCap’s “altcoin season” indicator is at 37/100, down significantly from last week’s peak of 51/100 as investors focus on bitcoin’s potential move higher.

MARA Holdings has sold about 23,093 Bitcoin for roughly $1.63 billion during the first half of 2026, turning a large part of its BTC treasury into cash as it funded operations, investments and liquidity needs.

According to MARA’s Aug. 6 Form 10-Q filing with the U.S. Securities and Exchange Commission, the Bitcoin was sold at an average price of $70,631 during the six months ended June 30. The company said the sales were part of its strategy to fund operations, support growth opportunities and manage liquidity.

The transactions came after MARA changed how it manages its Bitcoin reserves. Having allowed sales of newly mined Bitcoin in 2025, the company expanded the policy in 2026 to permit sales of BTC already held on its balance sheet. MARA can now hold Bitcoin as a long-term investment, sell coins based on market conditions and capital needs, or make opportunistic purchases.

By June 30, MARA still held 35,577 BTC with a fair value of about $2.08 billion, based on a quarter-end Bitcoin price of $58,524. Its holdings had fallen from 53,822 BTC at the end of 2025 and 49,951 BTC a year earlier, though they were slightly higher than the 35,303 BTC reported at the end of March.

MARA Bitcoin sales supplied most of its first-half investing cash

The $1.63 billion raised from Bitcoin became MARA’s largest source of investing cash during the period. Its filing showed net cash provided by investing activities of about $1.47 billion, compared with $337 million of cash used in investing activities during the same period in 2025.

Against the Bitcoin proceeds, MARA spent $94.3 million on property and equipment and $61.1 million, net of cash acquired, on its Exaion and Meerkat acquisitions. The company has been adding infrastructure that can support Bitcoin mining alongside artificial intelligence, high-performance computing and critical IT workloads.

At the same time, operating activities consumed $471.3 million of cash during the first half, up from $378.9 million a year earlier. MARA attributed the increase mainly to lower revenue and higher operating costs.

The Bitcoin sales also took place while MARA reduced debt. Financing activities used about $1.12 billion during the six months, including $912.8 million used for partial repayments of its March 2030 and June 2031 convertible notes and $350 million used to repay a previous credit line. Another $150 million credit facility partly offset those outflows.

MARA said it repurchased approximately $1 billion of its 0% convertible senior notes through privately negotiated transactions during the half, helping reduce total debt from $3.6 billion at Dec. 31 to about $2.4 billion by June 30.

MARA has put more of its remaining Bitcoin to work

Alongside outright sales, MARA has increasingly used its remaining BTC for lending and collateralized borrowing.

At June 30, 4,742 BTC had been loaned to third parties, while another 4,528 BTC were pledged as collateral. That left 26,307 unrestricted BTC with a fair value of about $1.5 billion. MARA reported $10.7 million in interest income from Bitcoin lending during the first six months of the year.

MARA describes Bitcoin as both a treasury asset and a source of liquidity. Under its digital asset management strategy, the company can use portions of its holdings for lending, structured trading and collateralized financing rather than keeping the entire balance inactive.

The strategy became more pronounced after the second quarter. On Aug. 4,MARA pledged 18,750 BTC as initial collateral for new lending arrangements with Coinbase Credit and Two Prime Lending that provided $600 million of incremental borrowing.

Coinbase’s $450 million facility included $300 million of new funding and refinanced MARA’s existing $150 million credit line. The facility carries a floating interest rate equal to the midpoint of the federal funds target range plus 3.875% and matures on Aug. 4, 2028, with an automatic one-year extension unless either side cancels it.

Two Prime separately provided a $300 million term loan carrying a fixed annual rate of 7.65%, with maturity scheduled for Aug. 3, 2028. Both facilities require MARA to maintain collateral ratios, according to the Aug. 9 report, with additional collateral required if the pledged assets fall below contractual margin levels.

Bitcoin treasury fell as MARA absorbed a $1.87 billion first-half loss

The sales occurred during a difficult first half for MARA’s reported earnings. The company generated $349.5 million of revenue during the six months ended June 30, down from $452.4 million in the same period of 2025, while recording a net loss of $1.87 billion compared with net income of $274.8 million a year earlier.

Bitcoin price movements accounted for a large part of the earnings swing. MARA reported that the fair value of its Bitcoin holdings fell by about $1.4 billion during the first six months as the market price declined. For the second quarter alone, the reduction was about $343 million.

MARA nevertheless increased its mining capacity over the year. Energized hashrate reached 70.3 EH/s at June 30 from 57.4 EH/s a year earlier, while miner efficiency improved to 17.3 joules per terahash from 18.3. Total energy capacity increased to 1.9 GW from 1.7 GW.

During the second quarter, MARA produced 2,422 BTC and sold 2,213 BTC at an average price of $73,078, according to its Aug. 7 earnings report. Most of the first-half reduction in its Bitcoin treasury therefore occurred during the first quarter, when the company sold 20,880 BTC for about $1.5 billion.

Long Ridge links MARA’s liquidity strategy to infrastructure expansion

Part of MARA’s latest Bitcoin-backed borrowing may now finance its proposed purchase of Long Ridge Energy & Power in Ohio, connecting its treasury strategy with its expansion into energy and computing infrastructure.

MARA entered an agreement on April 29 to acquire 100% of Long Ridge. The property includes a 485 MW combined-cycle gas power plant in Hannibal, Ohio, which the company expects to increase to 505 MW in the first quarter of 2027, as well as more than 1,600 contiguous acres with water, fiber and rail access. The site sits next to MARA’s existing Hannibal data center operations.

The transaction carries an enterprise value of about $1.5 billion, including up to roughly $900 million of assumed debt, according to MARA’s Aug. 9 financing disclosure. The company has also secured a Barclays commitment for a 364-day senior secured bridge facility of up to $785 million that can serve as backstop financing for part of the acquisition debt.

MARA has pursued another large powered site in Texas as part of the same infrastructure buildout. Under the agreement announced in July, the company is acquiring more than 1,200 acres in Matagorda County, with access to an initial 1 GW of grid capacity expected by October 2027 and up to 2 GW by April 2028.

Working with Starwood Digital Ventures, MARA plans to develop the property for high-performance computing, flexible compute services and Bitcoin mining. Its SEC filing describes the Starwood structure as site-specific joint ventures formed after Starwood secures qualifying tenants, with MARA contributing sites and Starwood supplying capital against the value of those assets before MARA is required to invest additional cash.

On June 30, MARA reported $421.3 million of cash and cash equivalents and about $2.1 billion of Bitcoin, putting the combined value of its cash and digital assets at roughly $2.5 billion. The company also had approximately $1.5 billion of unused capacity under its at-the-market equity program, through which it sold no shares during the first six months of 2026.

With bitcoin’s price stubbornly range-bound, the appetite for “directional optionality,” or bets on big price moves in either direction, has evaporated, he said.

Directional optionality involves traders buying call or put options, or both, to profit from anticipated big moves in the underlying asset, but they aren’t doing that now. The demand for bitcoin options has weakened, and this is reflected in BVIV’s decline.

A call option offers a way of buying an asset on the cheap should the price rise, in return for a small upfront cost. A put option offers insurance against price drops in the underlying asset.

Despite the weaker demand, the supply remains elevated. Although every option contract involves both a buyer and a seller, “high supply” in this context means that investors are increasingly writing (selling) options to market makers. Market makers, who are generally market-neutral and provide liquidity, take the opposite side by buying these options.

“A growing number of market participants, including bitcoin miners and corporate treasuries, are utilizing “systematic overwriting programs,” Sears noted.

These strategies involve writing call options to generate yield on their spot BTC holdings, which effectively suppresses volatility by flooding the market with options supply.

The impact of this systematic selling of options on the BVIV is likely accentuated by the typical midyear lull in prices and a cooling spot market. With fewer traders active during the vacation period, realized volatility (how much the price actually moves) has compressed, putting further downward pressure on implied volatility (how much the market expects it to move), Sears said.

A total solar eclipse is not just an occasion for skygazing, it’s an occasion for science. The most celebrated experiment conducted during an eclipse occurred on May 29, 1919. Four years earlier, in Nov., 1915, Albert Einstein first presented his theory of general relativity, arguing, among other things, that gravity can warp space-time and bend light as it passes around a massive object like the sun. That bending would be slight. Starlight passing by the sun would, Einstein calculated, be diverted by just 1.75 arc seconds, with a single arc second measuring one=3,600th of a degree. It would be impossible to observe that phenomenon in real time, of course, since the brilliant fires of the sun would wash out something as faint as starlight. During an eclipse, however, those fires would be briefly blotted.

To take advantage of that opportunity, two expeditions of astronomers—one from the Greenwich Observatory and one from Cambridge University—set out for Sobral, Brazil and the island of Principe off the west coast of Africa, where the approaching 1919 eclipse would be visible. During the brief minutes of totality, they charted the precise positions of stars near the sun that popped into view when the lights went out. On subsequent evenings, after the sun had set, they mapped the positions of the same stars and found that they indeed differed slightly from the measurements taken during the eclipse.

North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research.

Genians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services.

Kimsuky has built local AI systems for cyberattacks

Running models locally allows operators to make queries without sending potentially sensitive attack information to third-party AI providers. According to the research, the environments also support retrieval-augmented generation, which can connect an AI model with additional information supplied by its operator.

Alongside the three environments, researchers found libraries and frameworks that can embed language models into custom software. Kimsuky had also collected the AI coding assistant Cursor and speech-to-text tools as it assembled its AI infrastructure.

Rather than developing new AI models, the activity examined by Genians centered on putting existing open-source technology to work across malware development, data analysis and attack automation.

The firm assessed that the activity had moved beyond isolated tests because Kimsuky was continuously preparing to incorporate AI into operational attack capabilities. However, its findings did not show that the group was developing proprietary AI models from scratch.

Keeping the models on local infrastructure could also allow the hackers to work with information without submitting it to external cloud systems, according to the report. The collection of supporting software indicates that the AI environments form part of a larger technical setup rather than functioning only as standalone chat tools.

AI-generated phishing documents target crypto firms

Kimsuky has also continued using generative AI to prepare phishing material focused on cryptocurrency, investment strategies and fintech services, according to Genians.

Researchers identified polished documents that closely copied material associated with a Korean AI-powered investment platform. The files used natural language, consistent formatting and professional design elements that the cybersecurity firm associated with AI-generated content.

Such material provides another use for the group’s AI infrastructure beyond coding and data processing. Instead of relying only on poorly written phishing emails, the operators can use generative tools to prepare documents designed around financial subjects relevant to their intended targets.

The findings add Kimsuky to a series of North Korea-linked operations using newer technical and social-engineering methods against the cryptocurrency industry.

In July, cybersecurity firm JUMPSEC reported that BlueNoroff, another North Korea-linked group, was operating fake Zoom and Microsoft Teams meetings that profiled cryptocurrency users before malware was delivered.

JUMPSEC recovered source code from an active phishing kit after its operators accidentally exposed JavaScript source maps. The code contained wallet-scanning functions, operator controls, and separate malware delivery routes for Windows and macOS.

Once a target entered a fake meeting page, the system checked for Ethereum wallet connections and non-EVM wallets, including Solana tools, before sending the results to an operator panel. Windows implants could also identify browser extensions across Chrome, Edge, Brave, Opera, Vivaldi and Firefox variants, allowing operators to check for wallets such as MetaMask.

The attackers could then decide whether to continue the intrusion based on information gathered from the target, JUMPSEC found.

North Korean hackers are combining AI with social engineering

AI also appeared inside BlueNoroff’s fake meeting operation, although in a different role from the local models identified in the Kimsuky research.

According to JUMPSEC, operators combined AI-generated headshots with body movements taken from previous meetings to create convincing participants for fake video calls. Victims could arrive through a Telegram account belonging to a real contact whose account had already been compromised, before receiving a Calendly invitation that redirected them to a fake meeting domain.

During the call, an operator could display a prepared video, send messages about a supposed microphone problem, and trigger a fake Zoom software update. On Windows, the resulting ClickFix process used PowerShell and VBScript, while the macOS route delivered a fake meeting installer alongside information-stealing malware.

Arctic Wolf had previously identified more than 80 lookalike Zoom and Teams domains associated with related operations. About 80% of the targets it identified worked in crypto, blockchain finance or connected investment sectors, while founders and chief executives represented 45% of the identified targets.

North Korean operations have also sought access from inside crypto companies rather than relying solely on phishing or malware.

In July, Consensys temporarily stopped product releases after discovering that a consultant linked to North Korea had gained access to its systems for roughly one month, according to Drop Site News.

The consultant, who operated under the name Tyler Knapp and used the GitHub handle “imyugioh,” contributed to core MetaMask platform code, including components connecting cryptocurrency users with third-party fiat payment providers.

Consensys general counsel Matt Corva said a third-party service provider had introduced the consultant to the company. The company terminated his access after identifying the threat and said its investigation found no stolen assets or data, malicious code or impact on user security.

Separate research from the Ketman Project identified about 100 suspected North Korean IT workers operating under false identities across 53 crypto and Web3 projects. Investigators also traced suspected groups across 11 code repositories where projects had already merged 62 pull requests before the activity was detected.

North Korea stole more than $2 billion in crypto in 2025

The development of AI-assisted attack infrastructure comes after North Korean hacking groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data previously reported by crypto.news.

Most of the year’s losses came from the February 2025 attack against Bybit, where more than 400,000 Ether and staked Ether worth about $1.5 billion were stolen. The FBI attributed the breach to North Korea and identified the actors responsible under its TraderTraitor designation.

Bybit has since taken the dispute into a U.S. federal court. On Aug. 8, the exchange sued the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group in the U.S. District Court for the District of Columbia.

The exchange also obtained a preliminary injunction covering certain stolen assets held by unidentified defendants. The order prevents the identified assets from being transferred, sold or otherwise disposed of while the civil case proceeds, although it does not constitute a final ruling over ownership or liability.

Blockchain tracing became increasingly difficult after the Bybit theft as the attackers converted assets into Bitcoin and dispersed funds across thousands of wallets. By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked.

Researchers have also warned that AI could reduce the time attackers need to identify weaknesses in software. NEAR Protocol co-founder Illia Polosukhin has said AI is increasing hackers’ ability to locate vulnerabilities faster than conventional security processes can patch them.

The $100 million Coldcard Bitcoin hardware wallet exploit has also been suspected of originating from an obscure vulnerability uncovered with AI. Separately, North Korean operators continue to use phishing, fake remote workers and compromised online identities, while the latest Genians research shows Kimsuky preparing local AI models for malware development, data analysis and attack automation.