Third-party AI routing services are exposing users to significant security flaws that could result in the theft of cryptocurrency and cloud credentials.

According to a paper published on Thursday by University of California researchers, the supply chain for Large Language Models (LLM) contains several vulnerabilities that allow for malicious code injection and credential extraction. 

These intermediaries, which developers use to manage access to providers like Google or OpenAI, essentially act as a “middleman” that terminates secure encryption. 

Because they have full plaintext access to every message sent through them, sensitive data like seed phrases or private keys can be intercepted by unverified infrastructure.

The researchers tested 400 free and 28 paid routers to measure the extent of these risks. Nine of these services actively injected malicious code, while 17 separate routers were caught accessing Amazon Web Services credentials owned by the team. 

During the experiment, one router successfully drained Ether from a decoy wallet after the researchers provided a prefunded private key. 

Although the team kept the balances low to ensure the total loss remained under $50, the result confirmed how easily a compromised intermediary can siphon funds.

“26 LLM routers are secretly injecting malicious tool calls and stealing creds,” co-author Chaofan Shou stated on X.

Identifying a malicious router is a difficult task for the average user. The researchers noted that because these services must read data to forward it, there is no visible difference between legitimate handling and active theft. 

The danger increases when developers enable “YOLO mode,” a setting in many AI frameworks that lets an agent execute commands automatically without a human confirming the action. 

This allows an attacker to send instructions that the user’s system will run instantly, often without the operator’s knowledge.

“The boundary between ‘credential handling’ and ‘credential theft’ is invisible to the client because routers already read secrets in plaintext as part of normal forwarding,” the study explained.

Previously reliable routers can become dangerous if they reuse leaked credentials through weak relays. To prevent these attacks, the research team suggested that developers should never allow private keys or sensitive phrases to pass through an AI agent session. 

A permanent solution would require AI companies to use cryptographic signatures. Such a system would allow an agent to mathematically prove that instructions came from the actual model rather than a tampered third-party source.

“LLM API routers sit on a critical trust boundary that the ecosystem currently treats as transparent transport,” the paper concluded.

Nexus Core Systems has entered into a memorandum of understanding with Moroccan authorities to develop a $1.28 billion artificial intelligence facility.

The agreement was formalized during GITEX Africa 2026, held from April 7 to 9 in Marrakech. It brings together Nexus Core Systems with the Ministry of Digital Transition and Administrative Reform, the Ministry of Investment, Convergence and Public Policy Evaluation, and the Moroccan Agency for Investment and Export Development.

The deal initiates the first phase of the “Nexus AI Factory Platform,” a project positioned as a key step in Morocco’s push to strengthen its role in advanced digital infrastructure.

According to Morocco’s Ministry of Digital Transition, the facility will combine a high-performance computing data center with a Center of Excellence focused on training and skills transfer. It will also house an innovation hub dedicated to next-generation AI applications.

The design will introduce what officials describe as an integrated, sovereign infrastructure capable of supporting both domestic needs and international operations. The broader roadmap also includes plans for a next-generation data center near Casablanca, with long-term ambitions to scale capacity significantly while relying on renewable energy sources.

Phased rollout and investment structure

The project will be deployed in two phases and is expected to generate 125 direct jobs by 2027. The initial phase will see Nexus Core Systems allocate 5 billion dirhams to develop a 16 megawatt facility in the Nouaceur region, marking the operational launch of the platform.

A second phase will follow with an additional 7 billion dirhams investment at a separate site, expanding capacity by 20 megawatts.

Together, these phases form part of a longer-term vision that positions the platform as a foundation for large-scale AI workloads and future expansion.

The initiative aligns with Morocco’s “Digital 2030” program, introduced in 2024, which targets increasing the digital economy’s contribution to gross domestic product to 5%.

The strategy also sets out goals to create 270,000 jobs, support the development of 3,000 startups, and accelerate the digitization of public services. The Nexus AI Factory Platform is expected to contribute to these targets by strengthening infrastructure and fostering innovation-led growth.

Officials highlight strategic and economic impact

Amal El Fallah Seghrouchni, minister of Digital Transition and Administrative Reform, said the project would reinforce Morocco’s technological capabilities.

“The launch of the Nexus AI Factory Platform contributes to the development of digital infrastructure and strengthens Morocco’s capabilities in digital technology and artificial intelligence,” she said.

Nexus Core Systems chief executive Jaap Zuiderveld pointed to Morocco’s investment climate and talent base as key factors behind the decision.

“Morocco offers a combination of political stability, forward-looking leadership and strong talent,” he said, adding that the company is “not only deploying high-performance infrastructure” but building “an integrated ecosystem” that includes a Center of Excellence and an innovation hub to support global operations.

Founded in 2025 in partnership with Lloyds Capital, Nexus Core Systems is pursuing a broader strategy to develop AI factories tailored for high-demand computing workloads worldwide.

The London-based firm relies on advanced technologies from Nvidia and Naver Cloud, positioning its infrastructure to meet rising demand for AI-driven processing capacity across global markets.

A hacker exploited the Polkadot-based cross-chain protocol Hyperbridge, minting 1 billion bridged DOT tokens on Ethereum and ultimately converting a portion into about 108.2 ETH, worth roughly $237,000, after liquidity constraints whittled the proceeds. The incident rekindles questions about the security of bridge infrastructure that underpins cross-chain token transfers.

CertiK researchers traced the minting to a forged message that altered the admin of the Polkadot token contract on Ethereum, enabling the attacker to generate the bridged DOT. However, the liquidity dynamics in Ethereum’s bridged-DOT pool capped the eventual profit, leaving a small fraction of the minted value realized on the open market.

Security researchers pointed to a potential replay vulnerability tied to the protocol’s Merkle Mountain Range (MMR) proofs. Blocksec Falcon described the likely root cause as an MMR proof replay vulnerability stemming from missing proof-to-request binding, though Hyperbridge has not publicly confirmed a final root-cause assessment.

Hyperbridge halted operations to implement an upgrade while investigators assess the breach. Early commentary from contributors suggested the fault may have involved a malicious proof that fooled the protocol’s Merkle-tree verifier, underscoring how cross-chain verification mechanisms can be a weak link in bridge design.

The incident sits alongside other bridge-related disclosures in recent weeks. Aethir disclosed a separate bridge exploit earlier this year, with user losses kept under $90,000, a reminder that multiple bridges remain targets in the nascent cross-chain ecosystem.

Polkadot noted that the incident affected only DOT on Ethereum bridged through Hyperbridge; native DOT tokens and the broader Polkadot ecosystem were not impacted. The DOT price faced pressure but recovered from a dip to about $1.16, with quotes placing it above $1.19 at the time of writing per CoinGecko data.

Key takeaways

• Hyperbridge’s breach involved minting 1 billion bridged DOT on Ethereum, with on-chain data showing approximately 108.2 ETH (about $237,000) recovered after the swap due to liquidity constraints.
• CertiK attributes the mint to a forged message that changed the admin of the Polkadot token contract on Ethereum, enabling the attack.
• Blocksec Falcon’s analysis points to an MMR proof replay vulnerability from missing proof-to-request binding, though a definitive root cause has not been publicly confirmed by Hyperbridge.
• The incident caused no broader DOT disruption beyond the Ethereum-bridged DOT via Hyperbridge; native DOT and the wider Polkadot network remained unaffected.
• Separately, SubQuery Network reported a $130,000 breach due to missing access controls that allowed an attacker to redirect staking withdrawals, highlighting ongoing bridge- and data-indexing-security challenges in DeFi infrastructure.

Hyperbridge breach: what happened and what’s at stake for cross-chain bridges

The attacker executed a single, high-impact operation: minting 1 billion DOT tokens through Hyperbridge by exploiting a forged message that altered the admin rights on the Ethereum-facing Polkadot contract. CertiK’s analysis emphasizes that the forge enabled token creation within the bridged layer, triggering a liquidity-driven liquidation that ultimately yielded about 108.2 ETH—roughly $237,000 at current prices—after the token swap.

Hyperbridge promptly paused its bridge services and initiated an upgrade to address the vulnerability. While the initial assessment suggests a malicious proof manipulated the Merkle-tree verifier, the protocol’s team has not yet released a formal, final root-cause statement. The incident demonstrates how a single forged control instruction in a cross-chain contract can unlock large token minting if the verification mechanism underpins the bridge is compromised.

Root-cause debate and the resilience of proof-based bridges

Industry researchers have highlighted potential weaknesses in the way cross-chain proofs are bound to requests. Blocksec Falcon articulated that an MMR proof replay scenario—driven by missing proof-to-request binding—could enable duplicate or fraudulent validations within a bridge’s verification layer. While this framing aligns with known class of proof-related exploits, confirmation from Hyperbridge regarding the exact cause remains pending, leaving investors and builders awaiting a definitive account and remediation plan.

Beyond the technical specifics, the incident reinforces a broader narrative: even protocols marketed as “full node security” for cross-chain interoperability can face material exploits if the underlying proof systems and admin controls are not airtight. The market’s reaction—at least in the DOT-ETH bridged segment—has been cautious, with liquidity-sensitive outcomes shaping the realized profits for attackers and shaping perceptions of risk around bridge deployments.

Broader ecosystem impact: DOT, SubQuery, and the DeFi security landscape

In parallel to the Hyperbridge incident, the data-indexing protocol SubQuery Network reported a separate breach of roughly $130,000, attributed to insufficient access control that allowed an attacker to designate a malicious contract as the withdrawal target for staking rewards. Security auditors emphasized that legacy code and long-running access-control gaps can create windows for misappropriation even years after initial deployment.

Looking at the broader security landscape, industry trackers note a marked decline in DeFi exploit losses year over year. For Q1 2026, hackers stole about $168 million across 34 protocols, a sharp drop from Q1 2025’s $1.58 billion in total exploits, which included the record $1.4 billion Bybit hack. The figures underline a continuing improvement in some security metrics, even as individual incidents—such as Hyperbridge and SubQuery—illustrate persistent risk at the protocol level.

From Polkadot’s vantage point, the incident underscores a targeted risk around cross-chain bridges rather than a flaw in native assets. Polkadot noted that native DOT and the broader network remained unaffected by the Hyperbridge event, which is an important nuance for users and investors navigating bridged ecosystems. The price reaction has been mixed, with DOT briefly dipping before stabilizing above $1.19 as liquidity responded to the incident and subsequent updates.

What comes next for users, developers, and the market

For users and developers, the episode emphasizes the need for robust admin-control hardening, tighter proof-binding between bridge requests and verifications, and ongoing runtime monitoring of bridge state. The Hyperbridge team’s upgrade path will be crucial to restoring trust in a protocol that positions itself as a secure conduit for cross-chain assets. Practitioners should watch for a published root-cause statement, a detailed remediation plan, and any proofs or audits that quantify the improved security posture.

Regulators and standard-setters are also eyeing cross-chain security as bridging becomes an increasingly common primitive in crypto infrastructure. For traders and investors, the events reinforce a cautious stance toward bridged assets and a need to monitor liquidity conditions that can magnify or shrink the realized value of an exploit. As the ecosystem matures, more robust risk controls, formal verification of cross-chain proofs, and explicit incident disclosure practices will likely shape the next wave of security-focused improvements in bridge design.

Readers should watch for Hyperbridge’s ongoing upgrade trajectory, any formal root-cause disclosures, and correlated developments across other bridge projects as the space seeks to harden its defenses against increasingly sophisticated attack patterns.

Key Takeaways

• SKYQ shares have surged more than 200% in early April, climbing 7.96% to $7.87 in Friday’s premarket session
• The rally correlates with increased strategic value of Sky Quarry’s Foreland Refinery in Nevada amid tightening regional fuel supplies
• President Trump’s remarks regarding Iran and the Strait of Hormuz drove crude oil prices up 2.31% to approximately $100.13 per barrel
• Technical indicators show the stock trading 114% above its 20-day SMA and 155.9% above its 100-day SMA, with RSI at 77.79 indicating overbought conditions
• The company’s financial position remains challenging: EBIT margin of -72.3%, debt-to-equity ratio of 3.57, and cash reserves of only $35,370

Sky Quarry (SKYQ) has emerged as one of April’s most dramatic performers. The shares have skyrocketed more than 200% within days, propelled by geopolitical developments and increasing focus on the company’s refining infrastructure in Nevada.

Sky Quarry Inc., SKYQ

During Friday’s premarket session, SKYQ advanced 7.96%, reaching $7.87.

This explosive rally has been gaining momentum throughout the week, with Friday’s gains extending an already impressive multi-day advance. The movement isn’t attributable to any single trigger — rather, it reflects multiple catalysts aligning simultaneously.

Central to the narrative is Sky Quarry’s Foreland Refinery facility in Nevada. As regional refining capacity has become increasingly constrained, this asset has attracted renewed market attention. The company has previously announced ongoing negotiations with regional crude suppliers focused on expanding production capacity.

These strategic conversations have gained considerably more significance in recent days.

Middle East Tensions Drive Oil Prices Higher

President Trump took to Truth Social on Friday morning with pointed criticism of Iran regarding an alleged agreement concerning the Strait of Hormuz.

“Iran is doing a very poor job, dishonorable some would say, of allowing Oil to go through the Strait of Hormuz,” Trump stated. “That is not the agreement we have.”

The remarks immediately impacted energy markets. Crude oil futures surged 2.31% to approximately $100.13 per barrel during early New York trading hours.

Such geopolitical developments typically provide swift tailwinds for smaller energy-focused companies, and SKYQ has benefited from optimal positioning.

Technical Momentum Contrasts Sharply with Fundamental Reality

Looking at chart patterns, SKYQ displays extreme momentum characteristics. The shares are currently positioned 114% above the 20-day simple moving average and an extraordinary 155.9% above the 100-day SMA.

The Relative Strength Index reached 77.79, entering overbought territory midweek Wednesday. Resistance is positioned at $9.00, while support is identified around $3.50.

However, the underlying financial metrics present a contrasting narrative.

Sky Quarry shows an EBIT margin of -72.3%, with gross margins in negative territory at -24.8%. The company posted net losses totaling $28.65 million while generating merely $281,620 in standalone revenue against substantial operating expenses.

Total assets amount to $19.2 million, offset by liabilities of $16.03 million. Available cash stands at an alarmingly low $35,370.

With a debt-to-equity ratio of 3.57 and a current ratio of just 0.1, the company faces significant near-term liquidity constraints.

Return on equity registers at -37.36%. Operating cash flow remains negative, indicating the company’s ongoing dependence on external capital to sustain operations.

Market analysts maintain a negative outlook on SKYQ. Most industry watchers characterize the current price movement as momentum-driven speculation rather than a fundamental reassessment of company value.

The weekly trading range illustrates this speculative nature: SKYQ began the week at $5.32, reached a peak of $13.49, and experienced daily fluctuations between $4.90 and $12.52.

As of Friday’s premarket trading, SKYQ was changing hands at $7.87, representing a 7.96% gain for the session.

BlockchainFX gains traction as presale nears soft cap, attracting early investor attention.

Timing is everything in crypto, and right now, one project is making serious noise heading into its launch. BlockchainFX has been turning heads across the trading community, and for good reason. 

With its presale closing in on the $15m softcap and the LAUNCH50 bonus code offering 50% extra tokens, the window for getting in early is nearly shut. If finding the best new crypto presale before it pops is the goal, this one deserves full attention.

BlockchainFX is not an average exchange token. It is a full-on trading super app that brings crypto, stocks, forex, ETFs, and commodities under one roof, completely on-chain. The platform has already been awarded “Best New Crypto Trading App of 2025,” and with 23,000+ participants already on board, the early crowd clearly sees something here. Here is the full breakdown.

BlockchainFX: The super app that actually lives up to the name

BlockchainFX is a next-generation decentralized exchange that does something no major platform like Binance or Coinbase currently does: it gives users access to traditional financial markets alongside crypto, all from a single self-custody wallet. No switching between five different apps, no handing over control of assets to a centralized custodian. The platform is already live in beta, licensed and regulated by the Anjouan Offshore Finance Authority (AOFA), and has already processed millions in daily trading volume. That is not a roadmap promise, that is live activity.

The presale has raised over $14.2m against a $15m softcap, with the current token price sitting at $0.035 and a launch price set at $0.05. Analysts tracking the project have floated a $1 post-launch price target, which would represent a massive return from the current entry point. Daily staking rewards in both BFX and USDT are already live, with payouts reaching up to $25,000 USDT, and the BFX Visa Card allows users to spend globally with no limits. This is not a passive hold-and-hope situation.

LAUNCH50: 50% more tokens before the clock runs out

Here is where things get genuinely exciting. To celebrate the final presale stretch before launch, BlockchainFX has released a limited-time bonus code LAUNCH50, which gives buyers 50% extra BFX tokens on any purchase. Take a $5,000 investment at the current price of $0.035, which gets roughly 142,857 BFX tokens normally. With LAUNCH50 applied, that jumps to approximately 214,285 tokens for the exact same spend. At the launch price of $0.05, that stack is already worth $10,714. If the $1 analyst prediction plays out post-launch, that same investment becomes $214,285, which is a return that is hard to ignore at any market condition.

The presale hits its $15m target and BFX launches. Spending $100 or more on BFX also enters buyers into the $500,000 Gleam giveaway, with prizes starting at $250,000 in BFX for first place.

Launch is near, and the presale clock is ticking

The numbers tell one story, but the momentum tells another. BlockchainFX is sitting just $800,000 away from its $15m softcap, and once that is crossed, the presale closes, and exchange listings begin. Anyone waiting for “the right moment” is essentially watching the door close in slow motion. 

This is the best new crypto presale entering its final hours, and the LAUNCH50 code will not be available once the cap is hit. Getting in now at $0.035 before the launch price of $0.05 kicks in means locking in a 43% gain before the token even sees a single exchange. Early is relative, and right now, early still exists.

The Verdict: One opportunity left on the table

Based on the latest research and market activity, the best new crypto presale in April 2026 is BlockchainFX. With real trading infrastructure already running, a licensed and regulated platform, 23,000+ active participants, and a launch imminent, BFX checks every box that serious investors look for at the ground floor. 

The LAUNCH50 bonus code adds 50% more tokens for a limited time, making this the strongest entry point available before the token lists publicly. Visit the BlockchainFX website, apply the code, and secure a position before the next price move makes today’s price look like a distant memory.

For more information, visit the official website, X, and Telegram.

Bitcoin mining runs the risk of becoming more centralized as time goes on, while artificial intelligence could be moving in the opposite direction, according to Galaxy Research head Alex Thorn.

Thorn said that while Bitcoin mining began decentralized, with users mining Bitcoin on their personal computers, it has since become far more centralized, requiring ASIC miners or industrial-scale farms. 

“AI may follow the opposite path,” Thorn said, explaining that AI began in centralized clusters but could decentralize as open-source models close the gap.

“If local models keep getting smaller, cheaper, and more efficient, AI may become increasingly personal and on-device.”

The divergence strikes at the heart of crypto’s core promise: decentralization. If Bitcoin mining were to continue down a path of centralization, it could begin to raise concerns about the network’s long-term resilience.

Edge AI market to grow 300% in the next eight years

Edge AI computing refers to the deployment and running of AI models directly on local devices or “at the edge” of the network, rather than sending all data to centralized cloud servers or massive data centers for processing.

The global AI edge market is anticipated to grow from about $25 billion in 2025 to a projected $119 billion by 2033, according to Grand View Research.

Related: Researchers discover malicious AI agent routers that can steal crypto

The edge market is experiencing significant growth driven by the “rapid expansion of IoT (Internet of Things) and connected devices,” stated GVR. 

This increases the demand for real-time and low-latency data processing, growing the adoption of AI-enabled automation across industries, and “rising focus on data privacy and localized intelligence at the network edge,” GVR added.

Bitcoin mining is decentralizing geographically 

Crypto exchange KuCoin reported on Friday that Bitcoin mining has become increasingly unviable in the United States as the cost to mine a single BTC has surpassed $100,000 in some regions due to surging energy costs. 

This is resulting in a geographic migration with hash rate actively moving toward the “Global South,” with Paraguay and Ethiopia emerging as the leading destinations due to surplus hydroelectric power.

This could help to decentralize mining, at least from a geographical perspective.

“This decentralization of mining power across different continents enhances the security of the network by making it less vulnerable to any single country’s political or environmental shocks,” it stated.

Magazine: Bitcoin quantum-safe without upgrade? CZ’s 2031 crypto vision: Hodler’s Digest