TLDR:

• North Korea stole $2.02 billion in crypto in 2025—up 51%—using deception, not code exploits.
  
• A fake Ledger Live app passed Apple’s review and drained $424,000 in Bitcoin from one user.
  
• Kraken insiders were recruited via darknet ads for as little as $3,000 to compromise client accounts.
  
• Cryptographic systems remain unbroken, but human access points are now the cheapest attack vector in crypto.

Human error, not code vulnerabilities, drove three major crypto security breaches within thirteen days in April 2025. The incidents collectively resulted in hundreds of millions of dollars in losses.

Each case involved manipulation of people rather than exploitation of blockchain systems. Analysts say the pattern reveals a structural weakness the industry has yet to address.

The binding constraint in digital asset security is no longer cryptographic—it is human.

North Korean Operatives Target Crypto Firms Through Social Engineering

A six-month infiltration campaign led to Drift losing $285 million on April 1, 2025. Attackers posed as business partners, held in-person meetings across multiple countries, and deposited $1 million to build credibility.

Investigators attributed the operation with medium confidence to UNC4736, a North Korean state-sponsored group.

The same group is linked to the $1.5 billion Bybit hack in February 2025. Chainalysis reported North Korea stole $2.02 billion in crypto in 2025 alone.

That figure represents a 51% year-over-year increase, achieved through 74% fewer attacks. The efficiency gain came from more refined deception, not improved technical tools.

As researcher Shanaka Anslem Perera noted, North Korea stopped trying to break cryptographic math in 2023. Instead, they began recruiting the people who sit next to it.

CrowdStrike documented 304 individual North Korean infiltration incidents in 2024. The campaigns are still accelerating into 2025.

Kraken caught a North Korean operative applying for an internal job in May 2025. The company deliberately allowed the interview to continue in order to study the tactics being used. That decision provided rare intelligence into how these operations are structured from the inside.

Fake Wallet App Drains Musician’s Decade of Bitcoin Savings

On April 11, musician G. Love—legally Garrett Dutton—purchased a new MacBook Neo and searched for Ledger Live on Apple’s App Store.

He downloaded a clone that had passed both automated scans and manual review. A fake error screen prompted him to enter his 24-word seed phrase.

Within minutes, 5.92 Bitcoin—worth approximately $424,000—was gone. ZachXBT traced nine transactions to KuCoin deposit addresses.

KuCoin had lost its EU MiCA license in February 2025, raising further concerns about oversight gaps in the sector.

The app bypassed multiple layers of platform security without exploiting any technical flaw. It relied entirely on a convincing interface and a user placed under artificial pressure. The seed phrase, once entered, gave attackers complete and irreversible access.

This type of attack requires no sophisticated code. It requires only a believable replica and one moment of user trust. The Apple App Store review process, widely regarded as rigorous, was not sufficient to catch it.

Darknet Ads Recruit Exchange Insiders for Thousands of Dollars

On April 13, Kraken’s Chief Security Officer disclosed that two support staff members had been recruited by a criminal group. Roughly 2,000 client accounts were accessed, representing 0.02% of total users. No funds were stolen, and no system was technically breached.

The criminals recorded videos of internal support panels. They are now using that footage for extortion. Kraken refused to pay. The access was not obtained through a zero-day exploit—it was obtained through a darknet job listing.

Checkpoint Research and ZeroFox documented the going rate for such access in late 2025. Credentials or panel access at Coinbase, Binance, Kraken, or Gemini were available for $3,000 to $15,000, paid in crypto. That price point is lower than one month’s rent in San Francisco.

The crypto industry has spent fifteen years and hundreds of billions building technically sound infrastructure. SHA-256 remains unbroken.

Elliptic curve signatures remain intact. Yet within thirteen days, human access points bypassed all of it. The more the industry hardens its technical systems, the cheaper the human bypass becomes by comparison.

The cryptocurrency industry is racing toward a future where AI agents handle everything from booking flights to executing trades and making payments, but new research suggests the infrastructure underpinning that shift may not be secure.

McKinsey recently projected that AI agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030.

Coinbase founder Brian Armstrong said on X that “very soon” there will be more AI agents than humans making transactions on the internet. Binance founder Changpeng Zhao was more bold, predicting agents will make one million times more payments than people, all in crypto.

But a group of security academic and crypto researchers have released a paper explaining that a largely overlooked piece of AI infrastructure is already being used to steal credentials and even drain crypto wallets.

The authors of the papers are researchers affiliated with the University of California, Santa Barbara, the University of California, San Diego, blockchain firm Fuzzland and World Liberty Financial.

Powerful attack points

The team found that so-called “LLM routers,” or services that sit between users and AI models, can act as a powerful attack point exploited by malicious actors. These routers are designed to forward requests to models like OpenAI or Anthropic, but they also have full access to everything passing through them, including sensitive data.

“LLM agents have moved beyond conversational assistants into systems that book flights, execute code, and manage infrastructure on behalf of users,” the researchers wrote, highlighting how quickly these tools are taking on real-world financial and operational tasks.

The LLM routers or attack points leave users extremely vulnerable as they assume they are interacting directly with a reputable AI model such as OpenAI, Grok or otherwise, when in reality many requests pass through intermediary services that can see and modify that data, the researchers said.

According to one of the researchers, Chaofan Shou, the problem is no longer theoretical. He wrote on X that “26 LLM routers are secretly injecting malicious tool calls and stealing creds. One drained our client $500k wallet. We also managed to poison routers to forward traffic to us. Within several hours, we can directly take over ~400 hosts.”

“A malicious router can replace a benign command with an attacker-controlled one or silently exfiltrate every credential that passes through it,” the researchers wrote.

The researchers said that because these systems can operate autonomously, including frequently approving and executing actions without human review, a single altered instruction can immediately compromise systems or funds.

For crypto users, the implications are severe as private keys, API credentials and wallet access tokens often pass through these systems in plain text. The researchers found multiple cases where routers simply collected those secrets, the paper reveals. In one instance, a test Ethereum wallet was drained after its private key was exposed.

“Once exposed, credentials like private keys can be copied and reused without the user’s knowledge,” the authors of the paper noted.

Cascading risks

The team also demonstrated how easy it is to expand the attack. By “poisoning” parts of the router ecosystem, essentially tricking services into forwarding traffic, they were able to observe and potentially control hundreds of downstream systems within hours.

“A single malicious router in the chain is enough to compromise the entire system,” the researchers wrote, underscoring what they describe as a weakest-link problem.

That suggests a cascading risk of even if a user trusts their AI provider, the infrastructure in between may not be trustworthy, they stated in their paper.

That creates a potential mismatch as industry leaders increasingly predict AI agents will handle a growing share of crypto activity, while the underlying infrastructure still lacks guarantees that outputs haven’t been tampered with, they added.

TLDR

• Fellowship reported a $300,000 advertising expense for a Georgia congressional race.
• The PAC endorsed Republican candidates in five states through posts on X.
• Fellowship claims over $100 million from crypto-aligned backers.
• Jesse Spiro of Tether chairs the super PAC.
• The Senate Banking Committee has not scheduled a markup for the CLARITY Act.

Fellowship, a crypto-aligned super PAC, has started reporting spending and endorsements ahead of the 2026 US midterms. The group disclosed a $300,000 advertising expense and named several Republican candidates across five states. Its actions follow a filing with the Federal Election Commission and public posts on X.

Fellowship Reports $300,000 Ad Spend and Backs GOP Candidates

Fellowship reported spending $300,000 on advertising for Clay Fuller in Georgia’s 14th Congressional District. The filing showed the disbursement occurred on Tuesday, about a month before the May 19 Republican primary. Fuller won a special election to replace Marjorie Taylor Greene after her resignation. The Federal Election Commission requires super PACs to disclose independent expenditures. The agency states that super PACs may “receive unlimited contributions from individuals, corporations, labor unions and other PACs.”

The group also posted endorsements on X for Republican candidates in five states. It backed Alan Wilson for South Carolina governor and Blake Miguez for Louisiana’s 5th Congressional District. It supported Mike Collins for the US Senate in Georgia and Julia Letlow for the US Senate in Louisiana. It also endorsed Pete Ricketts for the US Senate in Nebraska and Nate Morris for the US Senate in Kentucky. These announcements marked the PAC’s first public endorsements since its 2025 statement of organization.

Crypto Funding Expands Political Activity Before 2026 Midterms

Fellowship announced its launch in September and claimed more than $100 million in funding. The group said undisclosed backers aligned with the crypto industry provided the funds. On April 1, it named Jesse Spiro, head of government affairs at Tether, as chair. The announcement signaled support for candidates with pro-crypto positions. However, the PAC has reported only one expenditure so far.

Crypto-backed political committees increased activity during recent election cycles. In 2024, Fairshake spent over $130 million on media buys in congressional races. Public records show the spending targeted competitive contests, including the US Senate race in Ohio. Federal filings indicate that super PACs operate independently from candidates and campaigns. They may raise and spend unlimited sums on independent political activity under federal rules.

Lawmakers continue to debate federal crypto legislation as PAC activity grows. The US House of Representatives passed the CLARITY Act in July. However, the Senate has delayed action on the bill and has not scheduled a floor vote. Reports indicated that the Senate Banking Committee planned a markup, yet the event did not appear on its calendar. The bill would address regulations affecting crypto markets and banking sectors.

The CLARITY Act has faced questions related to ethics standards and stablecoin yield provisions. Lawmakers have also raised issues concerning tokenized equities and other regulatory details. The Senate Banking Committee must review the bill before any full Senate vote. As of Monday, the committee had not confirmed a markup date.

Michael Saylor’s Strategy (MSTR) added 13,927 bitcoin to its treasury over the past week at an average price of about $71,902 per coin, for a total cost of roughly $1 billion, according to a Monday filing.

The purchase brings the company’s total holdings to 780,897 BTC, acquired for approximately $59.02 billion at an average cost basis of $75,577.

Last week’s acquisitions were entirely funded by $1 billion raised through sales of the company’s preferred stock, Stretch (STRC).

The current price of bitcoin is hovering just below $71,000, while MSTR shares are down more than 2.5% in pre-market trading.

Read More: The one metric investors are overlooking in Michael Saylor’s Strategy

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 1974.81, down 2.9% (-59.17) since 4 p.m. ET on Friday.

All 20 assets are trading lower.

Leaders: NEAR (+0.0%) and AAVE (-0.1%).

Laggards: DOT (-11.5%) and ADA (-6.8%).

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

TLDR

• Lars Kooistra says XRP has shifted from accumulation to distribution on higher time frames.
• XRP price trades near $1.32 and remains below a key supply zone.
• Kooistra targets short positions near resistance with downside toward $1.10.
• ChartNerd warns of a possible drop to $0.70 if resistance holds.
• Other analysts remain divided, with some still forecasting new all-time highs.

XRP price trades near $1.32 as market analyst Lars Kooistra signals a structural shift toward distribution. He states that sellers may be regaining control after a brief upward phase. His latest update outlines potential short opportunities if resistance levels continue to hold.

XRP Price Structure Turns Bearish, Analyst Says

Kooistra reported that XRP previously followed a TCT accumulation model that lifted price levels. However, he said the structure has now shifted toward a higher time frame distribution phase. He explained that this change signals growing seller pressure and weaker upside momentum.

He stated, “The market has transitioned into distribution on a higher time frame.” He added that price compression often leads to a strong move, and he expects that move to be lower. Therefore, he now targets short positions near key supply zones with unfilled orders.

Earlier, on April 10, Kooistra observed an extended accumulation pattern. That move invalidated his earlier short position and forced him to close at breakeven. However, the structure later evolved, and he adjusted his outlook accordingly.

On April 7, he described a “go big or go home” short setup. He partially de-risked that trade after a 20% take-profit at the range low. He expected a deeper bearish move if support failed.

Key Resistance and Downside Targets in Focus

The XRP price currently trades below a supply zone in the mid-$1.30 range. Price briefly moved above $1.40 last week but failed to hold gains. It now hovers around $1.33 while facing resistance pressure.

Kooistra’s chart outlines a possible short-term bounce or consolidation phase. However, he projects a sharp decline if resistance levels remain intact. His downside targets extend toward the $1.20 and $1.10 regions on higher time frames.

He warned that XRP price may not revisit higher supply zones. He said the market could already be deep in distribution. Therefore, traders waiting for higher entries may not get another opportunity.

Other analysts also shared bearish projections. ChartNerd stated that XRP could fall toward $0.70 if it fails to break $1.80 and $2.00 resistance. He maintained this outlook while acknowledging that a breakout would invalidate his scenario.

Casi Trades echoed a similar stance on recent price action. She stated that the rebound has ended and warned of a possible drop toward $0.85. Meanwhile, Dark Defender and Javon Marks continue to predict a new all-time high cycle.

At press time, XRP price is near $1.32 with losses across daily, weekly, and monthly charts. Market participants now monitor whether resistance holds or price regains upward strength.