A total solar eclipse is not just an occasion for skygazing, it’s an occasion for science. The most celebrated experiment conducted during an eclipse occurred on May 29, 1919. Four years earlier, in Nov., 1915, Albert Einstein first presented his theory of general relativity, arguing, among other things, that gravity can warp space-time and bend light as it passes around a massive object like the sun. That bending would be slight. Starlight passing by the sun would, Einstein calculated, be diverted by just 1.75 arc seconds, with a single arc second measuring one=3,600th of a degree. It would be impossible to observe that phenomenon in real time, of course, since the brilliant fires of the sun would wash out something as faint as starlight. During an eclipse, however, those fires would be briefly blotted.

To take advantage of that opportunity, two expeditions of astronomers—one from the Greenwich Observatory and one from Cambridge University—set out for Sobral, Brazil and the island of Principe off the west coast of Africa, where the approaching 1919 eclipse would be visible. During the brief minutes of totality, they charted the precise positions of stars near the sun that popped into view when the lights went out. On subsequent evenings, after the sun had set, they mapped the positions of the same stars and found that they indeed differed slightly from the measurements taken during the eclipse.

North Korea-linked hacking group Kimsuky has built three local AI environments as part of preparations for cyberattacks targeting cryptocurrency and financial companies, according to new cybersecurity research.

Genians, a South Korean cybersecurity firm, said in a report released Monday that it found evidence of Kimsuky operating local large language model environments through Ollama, GPT4All and Msty, giving the group access to AI tools that can run without relying on external cloud services.

Kimsuky has built local AI systems for cyberattacks

Running models locally allows operators to make queries without sending potentially sensitive attack information to third-party AI providers. According to the research, the environments also support retrieval-augmented generation, which can connect an AI model with additional information supplied by its operator.

Alongside the three environments, researchers found libraries and frameworks that can embed language models into custom software. Kimsuky had also collected the AI coding assistant Cursor and speech-to-text tools as it assembled its AI infrastructure.

Rather than developing new AI models, the activity examined by Genians centered on putting existing open-source technology to work across malware development, data analysis and attack automation.

The firm assessed that the activity had moved beyond isolated tests because Kimsuky was continuously preparing to incorporate AI into operational attack capabilities. However, its findings did not show that the group was developing proprietary AI models from scratch.

Keeping the models on local infrastructure could also allow the hackers to work with information without submitting it to external cloud systems, according to the report. The collection of supporting software indicates that the AI environments form part of a larger technical setup rather than functioning only as standalone chat tools.

AI-generated phishing documents target crypto firms

Kimsuky has also continued using generative AI to prepare phishing material focused on cryptocurrency, investment strategies and fintech services, according to Genians.

Researchers identified polished documents that closely copied material associated with a Korean AI-powered investment platform. The files used natural language, consistent formatting and professional design elements that the cybersecurity firm associated with AI-generated content.

Such material provides another use for the group’s AI infrastructure beyond coding and data processing. Instead of relying only on poorly written phishing emails, the operators can use generative tools to prepare documents designed around financial subjects relevant to their intended targets.

The findings add Kimsuky to a series of North Korea-linked operations using newer technical and social-engineering methods against the cryptocurrency industry.

In July, cybersecurity firm JUMPSEC reported that BlueNoroff, another North Korea-linked group, was operating fake Zoom and Microsoft Teams meetings that profiled cryptocurrency users before malware was delivered.

JUMPSEC recovered source code from an active phishing kit after its operators accidentally exposed JavaScript source maps. The code contained wallet-scanning functions, operator controls, and separate malware delivery routes for Windows and macOS.

Once a target entered a fake meeting page, the system checked for Ethereum wallet connections and non-EVM wallets, including Solana tools, before sending the results to an operator panel. Windows implants could also identify browser extensions across Chrome, Edge, Brave, Opera, Vivaldi and Firefox variants, allowing operators to check for wallets such as MetaMask.

The attackers could then decide whether to continue the intrusion based on information gathered from the target, JUMPSEC found.

North Korean hackers are combining AI with social engineering

AI also appeared inside BlueNoroff’s fake meeting operation, although in a different role from the local models identified in the Kimsuky research.

According to JUMPSEC, operators combined AI-generated headshots with body movements taken from previous meetings to create convincing participants for fake video calls. Victims could arrive through a Telegram account belonging to a real contact whose account had already been compromised, before receiving a Calendly invitation that redirected them to a fake meeting domain.

During the call, an operator could display a prepared video, send messages about a supposed microphone problem, and trigger a fake Zoom software update. On Windows, the resulting ClickFix process used PowerShell and VBScript, while the macOS route delivered a fake meeting installer alongside information-stealing malware.

Arctic Wolf had previously identified more than 80 lookalike Zoom and Teams domains associated with related operations. About 80% of the targets it identified worked in crypto, blockchain finance or connected investment sectors, while founders and chief executives represented 45% of the identified targets.

North Korean operations have also sought access from inside crypto companies rather than relying solely on phishing or malware.

In July, Consensys temporarily stopped product releases after discovering that a consultant linked to North Korea had gained access to its systems for roughly one month, according to Drop Site News.

The consultant, who operated under the name Tyler Knapp and used the GitHub handle “imyugioh,” contributed to core MetaMask platform code, including components connecting cryptocurrency users with third-party fiat payment providers.

Consensys general counsel Matt Corva said a third-party service provider had introduced the consultant to the company. The company terminated his access after identifying the threat and said its investigation found no stolen assets or data, malicious code or impact on user security.

Separate research from the Ketman Project identified about 100 suspected North Korean IT workers operating under false identities across 53 crypto and Web3 projects. Investigators also traced suspected groups across 11 code repositories where projects had already merged 62 pull requests before the activity was detected.

North Korea stole more than $2 billion in crypto in 2025

The development of AI-assisted attack infrastructure comes after North Korean hacking groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data previously reported by crypto.news.

Most of the year’s losses came from the February 2025 attack against Bybit, where more than 400,000 Ether and staked Ether worth about $1.5 billion were stolen. The FBI attributed the breach to North Korea and identified the actors responsible under its TraderTraitor designation.

Bybit has since taken the dispute into a U.S. federal court. On Aug. 8, the exchange sued the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency and the Lazarus Group in the U.S. District Court for the District of Columbia.

The exchange also obtained a preliminary injunction covering certain stolen assets held by unidentified defendants. The order prevents the identified assets from being transferred, sold or otherwise disposed of while the civil case proceeds, although it does not constitute a final ruling over ownership or liability.

Blockchain tracing became increasingly difficult after the Bybit theft as the attackers converted assets into Bitcoin and dispersed funds across thousands of wallets. By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked.

Researchers have also warned that AI could reduce the time attackers need to identify weaknesses in software. NEAR Protocol co-founder Illia Polosukhin has said AI is increasing hackers’ ability to locate vulnerabilities faster than conventional security processes can patch them.

The $100 million Coldcard Bitcoin hardware wallet exploit has also been suspected of originating from an obscure vulnerability uncovered with AI. Separately, North Korean operators continue to use phishing, fake remote workers and compromised online identities, while the latest Genians research shows Kimsuky preparing local AI models for malware development, data analysis and attack automation.

ETH investors are increasingly exploring alternatives to holding as market volatility persists, with ASDeFi highlighting cloud mining and automated asset management.

As of August 2026, Ethereum remains a key component of the global cryptocurrency market. With the continued development of blockchain infrastructure, stablecoins, and on-chain financial applications, the investment rationale for ETH is gradually shifting from a focus solely on price fluctuations to the long-term management and practical applications of cryptocurrency assets.

For investors who hold ETH long-term, a rising market can present opportunities for capital appreciation, but when the market enters a period of volatility, relying solely on price movements to generate returns often means a long wait. Against this backdrop, some investors are beginning to explore investment options beyond simply buying and holding ETH, including hashrate services and automated cryptocurrency asset management.

ETH investors are beginning to explore options beyond “holding”

ETH investors typically follow a straightforward investment strategy: buy ETH and wait for the market price to rise. However, the cryptocurrency market has changed. Investors are now focusing on the efficiency of asset utilization, including how to lower the equipment barriers to traditional mining, how to reduce daily operating costs, and how to manage cryptocurrency-related services using automation tools.

ASDeFi cloud mining is a model that has attracted the attention of some market participants amid this trend. Compared to purchasing mining rigs on one’s own, cloud mining centralizes the management of equipment, data centers, power, and operations and maintenance. Users select the appropriate hashrate contracts through the platform, eliminating the need to set up specialized equipment at home.

Why are ETH holders interested in ASDeFi cloud mining?

One key reason is that traditional mining models present a high barrier to entry for individual investors. Participating in mining on one’s own not only requires covering the costs of purchasing mining rigs and electricity, but also involves addressing issues such as the equipment’s operating environment, cooling and maintenance, network and technical management, while also having to contend with the impact of constantly changing mining difficulty.

In contrast, the cloud mining model entrusts the management of complex aspects — such as mining rigs, facilities, electricity, and day-to-day operations — to professional operators, thereby lowering the equipment and operational barriers to entry for individuals wishing to participate in mining. For investors who already hold cryptocurrency assets but do not wish to invest significant capital in purchasing and maintaining mining rigs, this model offers a relatively convenient way to participate.

What is ASDeFi?

Founded in 2020 and headquartered in the United Kingdom, ASDeFi primarily provides AI-powered cloud computing power and cryptocurrency-related services. Through centralized management of computing resources, intelligent scheduling, and automated operations and maintenance, the platform offers users cloud mining services that eliminate the need to purchase mining equipment or build mining farms. Users can manage their accounts and view service status via a web browser or mobile app. Currently, it supports mining for major cryptocurrencies such as ETH, BTC, XRP, SOL, DOGE, BNB, and USDT.

How to Join ASDeFi Cloud Mining?

1. Register for a cloud mining account.

Once registration is complete, the user receives a free $15 bonus that can be used to purchase mining contracts, which yield a daily return of $0.60.

2. Update Account Information

Log in to the account dashboard and add a linked cryptocurrency wallet address to receive earnings.

3. Purchase a Mining Contract

Go to the Contracts page and purchase the $15 Check-in Contract. Users can also choose a mining contract that fits a particular budget and investment plan.

4. Start Mining and Withdraw Earnings

After purchasing the contract, the platform will automatically allocate computing power resources, and the cloud mining contract will begin running. View earnings in real time on the phone, and withdraw mining earnings at any time.

Currently popular mining contracts:

Summary

As the Ethereum ecosystem continues to evolve, the focus of ETH investors has gradually shifted from simply waiting for price increases to more flexible approaches to asset management. Through smart cloud computing power and automated management, ASDeFi offers users who hold ETH long-term an alternative way to participate in the cryptocurrency ecosystem. Some users have reported monthly returns of up to approximately $7,000; however, actual returns are subject to factors such as the amount invested and contract terms, and investors should approach this opportunity with caution.

For more information, visit the official website and download the app.