The AfD won voters away from all its mainstream rivals, winning over 82,000 voters who had previously supported the governing Christian Democratic Union of Germany (CDU). But one of the more striking consequences of the Sept. 6 election in Saxony-Anhalt was that the AfD energized people who had stopped voting, and brought 170,000 of them—around a tenth of the local electorate—back to the ballot box. These are people who had largely given up on politics, and who, for years, have inhabited a parallel universe. Many of these voters regard Germany’s Nazi past as overblown and refuse to draw parallels between then and now. They also see centrist politics as the instrument of a deep state seeking to undermine their values.

While reporting from Saxony-Anhalt, I was reminded of a small incident I witnessed before the pandemic. I was walking along a street in Leipzig, one of the main cities of the former Communist East Germany, with a helpful contact, an intelligent local activist who had once worked for the Greens. As we passed the offices of MDR, the regional public broadcaster, she suddenly shouted, without provocation, “Lügenpresse”—“lying press,” or “fake news.” Startled, I asked what the station had done to earn her ire. “They don’t listen to the likes of me,” was all she could say. The more I pressed her to identify the specific source of her grievance, the more agitated she became.

XRP is drawing fresh attention as Clearpool pushes its institutional lending framework onto the XRP Ledger. The decentralized credit protocol is entering what it calls its next growth phase. This move ties XRP directly to a rising wave of institutional yield products.

Clearpool Expands Institutional Credit on XRP Ledger

Clearpool plans to build its lending infrastructure directly on the XRP Ledger network. The protocol will also migrate its CPOOL token to a new token called CLEAR. New participants will receive CLEAR for added capital, and existing holders will get a 1:1 swap.

The XRP Ledger offers a proven network, and institutional credit remains largely untapped there. Clearpool intends to deliver real-world, institutional-ready lending infrastructure on the chain. This positions XRP as a foundation for a broader credit ecosystem.

Two XRP Ledger standards support this shift: Single Asset Vaults and the Lending Protocol. Clearpool describes these as native, institutional-grade credit rails for XRP-based finance. The RLUSD stablecoin will serve as the regulated settlement asset within this system.

Ripple Backs XRP Ecosystem Growth Through Clearpool

Ripple has committed investment to help launch Clearpool’s yield products for XRP and RLUSD. This funding strengthens the broader push toward institutional-grade credit on the XRP Ledger. Ripple’s involvement signals continued confidence in XRP’s expanding financial use cases.

Earlier, Ripple partnered with Cicada Partners and Clearpool to launch an institutional credit fund. That fund will issue loans backed by real-world assets as collateral. The partnership reflects a coordinated effort to grow XRP-based lending markets.

Together, these moves link Clearpool’s protocol upgrade to Ripple’s wider strategy for XRP. Institutional demand for regulated, blockchain-based credit continues to grow steadily. XRP now sits at the center of that expansion.

CPOOL to CLEAR Migration Reshapes Token Supply

The migration to CLEAR will come with a full treasury recapitalization. Clearpool noted that 99% of CPOOL’s supply is already vested, and reserves are low. Additional resources are needed to fund further development and adoption.

Under the proposed plan, 70% of new CLEAR supply goes to existing token holders. The remaining allocation splits across the ecosystem, treasury, and contributors. Total CLEAR supply will rise from 1 billion to 1.125 billion at migration.

Over three years, circulating CLEAR supply is projected to reach 1.428 billion tokens. A buyback-and-burn mechanism will use half of protocol fees to purchase and destroy CLEAR. Community members now have fourteen days to weigh in before a Snapshot vote decides the outcome.

North Korea appears to be expanding its use of remote IT workers in third countries as part of an increasingly targeted strategy to infiltrate U.S. companies and channel funds toward its weapons programs. NBC News reported on Friday that the scheme involves foreign-based job seekers—often recruited through mainstream platforms—who are then positioned to move contracts and access before being replaced by North Korean operatives.

The details come after a July warning issued by the U.S. government and multiple foreign agencies. The alert said North Korean IT workers actively look for contracts with the intention of remitting salaries back to their parent agencies. It also highlighted their potential as insider threats, citing participation in data exfiltration, cryptocurrency theft, and theft of sensitive information.

Key takeaways

• U.S. and allied agencies have warned that North Korean IT workers seek contracts to funnel pay back to DPRK-linked agencies while posing insider and data-risk threats.
• NBC reports North Korean efforts increasingly rely on third-country remote workers to pass job interviews, then hand over roles to DPRK operatives.
• Recruitment tactics described by NBC include scouting on platforms like LinkedIn and offering cryptocurrency compensation for “interview associate” work.
• Related reporting from earlier this year tied North Korea-linked hacking activity to large crypto losses, suggesting the operational model may be bearing fruit.
• With economic pressure continuing, the scheme underscores why organizations should tighten identity, access, and payment controls for remote hiring.

From direct recruitment to third-country remote access

According to NBC’s report, North Korea’s approach has shifted toward leveraging remote workers outside the DPRK to gain entry into companies that may not otherwise connect the threat to North Korea. Instead of relying solely on traditional infiltration channels, the scheme centers on obtaining legitimate work contracts after successfully navigating hiring processes.

The reported workflow is straightforward but high-risk for employers: third-country IT workers are brought in to secure contracts and, after roles are established, are “usually” replaced by North Korean operatives. The operational logic is clear—create an initial foothold that looks normal from an outside hiring perspective, then transition to the underlying actors with access to systems, credentials, or internal knowledge.

NBC also said some foreign workers were recruited after being scouted on LinkedIn. In other cases, applicants were allegedly offered cryptocurrency payments to perform part-time “interview associate” tasks—work that can help them appear credible in recruitment pipelines while potentially aligning them with a longer-term operational goal.

The July alert and what it implies for corporate defenses

The July alert referenced by NBC is significant because it frames the threat not just as external hacking, but as a multi-stage infiltration risk that includes insider behavior. In that advisory, U.S. government and partner agencies described North Korean IT workers as contract-seekers who intend to remit earnings to DPRK agencies.

Just as importantly, the alert connects the labor recruitment angle to cyber outcomes. It described how these workers can function as insider threats to companies, while also being implicated in data exfiltration and cryptocurrency theft, along with theft of sensitive information. Even without additional details about each case in NBC’s report, the combined message is that the threat model includes both access and monetization.

For companies processing remote hires, this means that hiring risk is inseparable from security risk. Organizations that rely on remote onboarding, contractor access, or permissive internal tooling could be inadvertently enabling a pathway for identity compromise, unauthorized code and data handling, and lateral movement once the “handover” occurs.

Why cryptocurrency appears in the recruitment workflow

NBC’s reporting that some candidates were offered cryptocurrency as part of “interview associate” arrangements matters for two reasons. First, it signals that the recruitment pipeline may be designed to blend into existing work structures while still using mechanisms that are harder to trace than conventional payroll.

Second, it aligns with earlier warnings and reporting that tie North Korea-linked actors to crypto-enabled theft and financial diversion. In May, Cointelegraph reported—citing cybersecurity firm CrowdStrike—that North Korea state-affiliated hackers and threat actors were responsible for more than $2 billion in cryptocurrency losses in 2025, representing a 51% year-on-year increase. While that figure reflects cyber theft broadly rather than the specific “interview associate” step described by NBC, the throughline is consistent: crypto is both a tool and an outcome for DPRK-linked operations.

Sanctions pressure, economic indicators, and persistence

The recruitment strategy also fits a broader pattern of persistent activity despite sanctions. The report notes that the Bank of Korea estimated North Korea’s GDP increased 3.5% in 2025 even with global restrictions in place. That kind of resilience can be read as a reminder that threat actors do not need normalization of trade to sustain operations—alternative channels, including cybercrime and illicit financial routing, can help fill gaps.

For investors and builders in crypto and broader tech ecosystems, the implications extend beyond national security. North Korea-linked tactics reportedly combine labor infiltration with cyber operations and monetization. That combination increases the likelihood that compromised systems, stolen credentials, and exfiltrated data can feed downstream fraud and theft—potentially involving crypto at multiple stages.

As governments and companies tighten controls around known malware and exchange-related abuse, schemes that begin at recruitment and onboarding may become more attractive because they can bypass purely technical perimeter defenses.

What to watch next is whether more enforcement and advisories provide granular indicators—such as specific behaviors during remote hiring, payment patterns, or contract-approval structures—that organizations can use for earlier screening. In the meantime, the core concern is clear: if role handovers from third-country contractors to DPRK operatives are a recurring tactic, security teams should assume that “legitimate” employment pathways can conceal hostile intent.