We have watched the alternative play out before. When regulators told websites to obtain consent, they specified the goal and not the method, and the market answered with the cookie banner, the pop-up you dismiss a hundred times a week without reading. Crypto built its own version: upload your ID to everyone. A passport copy in a hundred databases, protecting almost no one and enriching whoever breaches the weakest of them.

And this is only the rehearsal. The internet is being rebuilt around software that acts on our behalf, and the familiar sorting of traffic into “bot” or “human” is already breaking down. A third category is emerging: verified agents transacting, with permission, for real people. Those agents will move money, and they will have to prove they are authorized and what they are allowed to do, at machine speed and machine volume. If they inherit today’s model and drag their owner’s full identity through every service they touch, we will not have a handful of honeypots. We will have billions of them, refreshed continuously, that never sleep.

The $320 million will most likely come back. The addresses, the IDs, and the faces will not. The lesson of these weeks is not that we need higher walls around the data we hoard. It is that we are hoarding data we never needed to collect. The technology to prove without surrendering already exists: provable, private, and portable, for people today and for their agents tomorrow. The only question is whether we adopt it before the honeypot becomes the permanent architecture of both.

Security researchers have traced more than 1,500 KREMLIN malware infections after uncovering a Brazilian banking campaign that uses Ethereum smart contracts to update attack infrastructure and malicious browser extensions to steal credentials and session data.

Elastic Security Labs disclosed the operation in a Sept. 14 technical report after tracking the activity under REF9334 since May 2025. Researchers followed seven campaigns over roughly 15 months and linked the latest versions to Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information.

SlowMist issued a threat-intelligence alert on Sept. 16 drawing attention to the blockchain component of the operation, including three Ethereum contracts linked to changing command-and-control infrastructure.

Despite the name KREMLIN, Elastic said it found no evidence connecting the campaign to Russia. The toolkit name comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil.

KREMLIN uses Ethereum contracts as changing address books

Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure.

Elastic traced the first contract to May 19. It stored configuration values pointing infected systems toward locations used for the installer and malicious browser extension. Later contracts changed the structure and eventually moved to a key-value configuration model that could be updated by the operator.

The current contract identified by Elastic is 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b. Researchers said it remained in use when their report was published. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.

The contracts do not represent an exploit of Ethereum’s consensus system or smart-contract platform. Elastic found that the attackers used the blockchain as a dead-drop resolver: infected machines read configuration values from the contracts to locate external infrastructure controlled or abused by the operators.

Such a design lets operators change infrastructure references by updating on-chain values while leaving the initial malware unchanged. Elastic recorded contract updates pointing toward different domains and hosted files, including a main-v2 configuration change on Aug. 13.

Crypto.news reported in 2025 that malicious npm packages were using Ethereum smart contracts to retrieve command infrastructure. ReversingLabs researchers described a comparable model in which blockchain data contained locations used to reach attacker-controlled servers.

Microsoft found ClickFix campaigns using BNB Chain smart contracts to retrieve malware instructions. Microsoft’s findings involved a separate campaign but showed another example of public blockchains being used as infrastructure for malware configuration.

Malicious extensions can enter Chrome and Edge without approval

KREMLIN’s browser component uses a technique that lets an unauthorized extension appear properly registered inside Chromium-based browsers.

Elastic said the installer modifies Chrome or Edge’s Secure Preferences data and regenerates the HMACs and encrypted integrity hashes the browser expects. Once those values match, the malicious extension can load even though the user never approved an installation through the official extension store.

The technique itself predates the KREMLIN campaign. Security firm Synacktiv documented the approach in 2025 under research titled The Phantom Extension, showing how an attacker with access to a Windows system could alter Chromium preference records and load an extension through internal browser mechanisms.

KREMLIN operationalized that technique for financial theft. Elastic’s analyzed extension masqueraded as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It could collect saved browser data and intercept information during active web sessions.

The malware gathers browser databases containing login information, cookies and stored form data. Elastic found that it acquired encryption material needed to access protected browser data before sending collected information to attacker-controlled infrastructure.

Initial infection still requires execution of a malicious file. Elastic said the campaign distributes JavaScript files disguised as bank receipts, invoices or corporate documents. Once a victim executes the lure, the loader checks the environment before progressing through later stages.

Brazilian financial brands impersonated in campaign material included Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander and Mercado Pago.

Elastic counted 1,515 infected hosts after disrupting a kill switch

Elastic gained an unusually direct measure of the campaign’s reach after researchers noticed that KREMLIN checked an unregistered internet domain as part of its anti-analysis process.

The malware was designed to test whether the domain responded. A successful response caused the program to assume it was operating inside an analysis sandbox and terminate itself. Elastic registered the previously unused domain and pointed it to infrastructure the researchers controlled.

Infected machines then began contacting the newly registered address. Elastic counted 1,515 systems at the time of publication, with 98.75% geolocated in Brazil. Researchers said the number was rising quickly.

Registering the domain turned KREMLIN’s own anti-analysis check against the campaign. Machines reaching the domain interpreted the response as evidence of a sandbox and stopped progressing through the infection chain.

Elastic cautioned that the intervention was temporary. “This has temporarily degraded and manipulated the campaign’s defense mechanisms,” the researchers wrote, saying the interruption could give defenders more time to locate and clean affected endpoints.

The systems remained infected, meaning the registration did not automatically remove KREMLIN from compromised computers. Elastic’s report said the affected machines had been prevented from moving beyond the relevant infection stage while the canary remained effective.

The geographic data supports the researchers’ earlier assessment that Brazil is the campaign’s primary target. Portuguese-language filenames, fake error messages and Brazilian financial brands appeared repeatedly across the recovered samples.

Ethereum wallet activity links multiple KREMLIN campaigns

On-chain analysis helped Elastic connect different stages of the malware operation. Researchers identified a single Ethereum wallet used to deploy malicious contracts and update their configurations. The address was financially active before the first KREMLIN-linked contract appeared, giving investigators a transaction trail spanning more than a year.

Between June 19, 2025, and Aug. 24, 2026, Elastic identified 82 USDT transfers associated with the wallet. The recorded activity totaled approximately 20,778.97 USDT received and 19,016.96 USDT sent. Researchers said individual transfers could not be conclusively classified as malware-development funding.

Transaction timing provided another attribution clue. Elastic found that much of the wallet activity lined up with working hours in the UTC-3 time zone used by São Paulo, although the researchers presented Brazil as a plausible operator location instead of a confirmed attribution.

The campaign has changed tooling during its lifespan. Earlier waves distributed PULSAR RAT, while the newer Ethereum-linked branch introduced REMCOS RAT alongside the custom browser extension. Elastic identified two related chains during this period, including one that uses a legitimate signed SentinelOne executable as part of the loading process.

Security teams can use the indicators published by Elastic Security Labs and its accompanying public IOC repository to check endpoint, browser and network telemetry for artifacts tied to the campaign. Elastic mapped the activity to MITRE ATT&CK techniques covering execution, persistence, credential access, browser extensions, command-and-control and data exfiltration.

Brazilian crypto users were targeted by separate WhatsApp-distributed malware in late 2025. That campaign targeted banking, fintech and cryptocurrency credentials but was not linked to REF9334.

Elastic’s latest published blockchain timeline shows KREMLIN’s contract configuration being modified through August, while its infrastructure observations extend into late August 2026. The researchers said the 0xCD7360…d07b Ethereum contract remained in use when the Sept. 14 report was prepared.

Bitcoin traders aren’t exactly panicking about Wednesday’s expected Federal Reserve rate hike, but they aren’t taking many chances either.

Markets are pricing a 92.5% chance the Fed raises rates for the first time in three years after strong employment data and stubborn inflation. Bitcoin has spent the past 24 days stuck between roughly $76,000 and $80,000, with volatility falling to a one-month low.

For some traders, the quarter-point hike is already old news.

“The bond market has done its job and fully priced in tomorrow’s hike,” said Chris Sullivan of Hyperion Decimus. In his view, the bigger shock could come if the Fed doesn’t hike, since that could leave investors wondering what policymakers see that markets don’t.

Appetite for the two largest cryptocurrencies has moved in the other direction. Bitcoin buying conviction has dropped to 3% from 10%, while ether has fallen to 9% from 23%.

Bitcoin Core, the software used to run Bitcoin nodes, has moved its next major update into final testing with changes to transaction fees, block processing and the way wallets build transactions.

The first release candidate for Bitcoin Core 32.0 was tagged on Sept. 14, starting the final testing cycle before developers aim to release the finished version on Oct. 10, according to the project’s release schedule.

Bitcoin Core lets a computer independently check transactions and blocks against Bitcoin’s rules rather than relying on another service. Version 32 does not change those rules.

Bitcoin Core currently estimates how much a user should pay for a transaction largely by looking at the fees attached to transactions that made it into previous blocks. Version 32 adds a second estimator that looks at transactions currently waiting to be confirmed.

The software will compare the two and can recommend the lower fee when current network conditions support it. That should let estimates fall more quickly when congestion clears instead of continuing to reflect more expensive transactions from earlier blocks, according to the draft release notes.

Donald and Melania Trump’s memecoins are down 97% and 99% respectively from their all-time highs.

$TRUMP coin reached its all-time high of ~$75 per token on January 19, 2025, and has been on a slow, but relentless, decline since then. It’s currently trading for ~$2.

Melania’s memecoin reached an all-time high of ~$14 on January 20, 2025. It now trades for $0.1.

Perhaps unsurprisingly, Trump’s coin has been outperforming his wife’s, likely due to the constant media attention the president receives. But it may also be because the coin has staged two giveaways so far with another upcoming.

Zcash token holders backed cutting the network’s target block time to 25 seconds from 75 seconds and preserving its existing halving schedule in a poll on the next major upgrade.

The faster-block proposal received 99.9% of the Zcash (ZEC)-weighted vote, while 98.9% supported keeping halvings, according to results published Monday. Voting power reflected eligible ZEC holdings, with both percentages including abstentions.

The shorter interval would reduce the expected wait for a transaction’s first confirmation, according to the proposal. The amount of new ZEC issued per block would fall to keep scheduled daily issuance unchanged.

The changes are proposed for NU7, a Zcash network upgrade whose activation date remains undetermined. Token holders also favored excluding features not implemented by Sept. 30.

Results of the NU7 sentiment poll. Source: forum.zcashcommunity.com 

The coinholder vote was separate from polls of ZecHub, the Zcash Community Advisory Panel and other community groups. Eligibility was limited to spendable ZEC in the Ironwood shielded pool at the voting snapshot. Developers plan to ship the final items for the upgrade by the Sept. 30 cut-off deadline, with testnet and mainnet activation not yet determined.

Halvings are scheduled cuts that reduce the issuance of new ZEC by half. The winning coinholder option would preserve that schedule while allowing funds removed from circulation under a separate proposal to be returned through future block rewards.

The advisory-panel results showed a closer split, with 57 members favoring a gradual issuance curve that would replace halvings and 54 favoring keeping them.

Related: Anthropic’s Mythos AI finds no more ‘serious’ bugs in Zcash: Wilcox

Zcash coinholders favor delaying reissuance

Another major feature considered for NU7 inclusion was the Network Sustainability Mechanism (NSM), a proposed upgrade to Zcash’s economic model that aims to recycle a portion of transaction fees back into a pool, rather than relying solely on block rewards.

About 97% of token holders voted to delay NSM reissuance until February 2031, with 2.3 million ZEC tokens voting to delay the motion, while only about 70,239 tokens voted to start it as soon as possible.

NSM was proposed in January in response to the network’s long-term security budget concerns, as the declining block rewards may eventually be insufficient to incentivize miners to validate transactions. The model’s three-part mechanism seeks to burn and recycle 60% of ZEC transaction fees into future block rewards, without exceeding the token’s 21 million maximum supply.

ZEC rose 3.8% in the past 24 hours, extending its 132% rally seen during the past month, according to CoinMarketCap data.

Magazine: The legal battle over who can claim DeFi’s stolen millions