Connect with us
DAPA Banner

Crypto World

Bitcoin Selloff Sparks Hedge Fund Speculation Around BlackRock ETF

Published

on

Bitcoin Selloff Sparks Hedge Fund Speculation Around BlackRock ETF

Traders suggest unusual activity in IBIT may point to Hong Kong–based hedge funds, though no hard evidence has emerged.

Unusual trading in BlackRock’s bitcoin ETF, iShares Bitcoin Trust (IBIT), has led traders to speculate that this week’s sharp Bitcoin drop may have been triggered by one or more Hong Kong–based hedge funds, rather than selling pressure from crypto traders.

The theory was laid out in a post on X by Parker White, the COO and CIO of DeFi Development Corp, and centers around record trading and options activity in IBIT.

Bitcoin (BTC) fell sharply over the past week, dropping 16%, and trading as low as $62,000 on Thursday before rebounding to around $70,400 on Friday, per CoinGecko. On Thursday, IBIT recorded its highest daily trading volume to date, with about $10.7 billion traded. Despite the heavy volume, IBIT recorded only $175 million in net outflows, according to SoSoValue.

Advertisement

White cited several signals suggesting that selling pressure did not come from crypto-native traders, including relatively low liquidations on centralized crypto exchanges and unusual price action in BTC and Solana (SOL).

“Given these facts and the way $BTC and $SOL traded down in lockstep today (normally SOL trades with beta) + the relatively lower liquidations on CeFi exchanges, this leads me to believe that the nexus of the problem lies with a large IBIT holder,” the post reads. “IBIT has become the #1 venue for BTC options trading, so my guess is that a hedge fund trading IBIT options is the culprit.”

White said public filings show that some funds hold a very large share (and in some cases nearly all) of their assets in IBIT. He added that many of those IBIT-focused funds are based in Hong Kong and do not normally trade crypto, which could explain why traders didn’t see warning signs ahead of the selloff.

He also pointed to activity in $DFDV, a fund tied to DeFi Development Corp, which he said posted its worst single-day decline on record, alongside a sharp drop in its net asset value.

Advertisement

“I personally know a number of HK-based hedge funds that are holders of $DFDV… the mNAV had been holding steady surprisingly well throughout this pull back until today.” White wrote, adding that he finds it unlikely a fund running a large IBIT position through a single-entity structure would operate only one vehicle.

White cautioned that while he has no hard evidence, “just some hunches and bread crumbs,” he believes his theory seems “very plausible.” Other experts echoed parts of White’s view, noting that the size and structure of the move did not resemble a typical crypto-driven selloff.

Rob Wallace, co-founder of BitcoinNews.com, agreed that the combination of factors mentioned by White looks more like institutional selling than a retail panic. He also said IBIT has become an important link between traditional markets and BTC trading.

Still, White and other traders emphasized that the clearest confirmation would come from regulatory filings showing a large IBIT position being reduced to zero.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Published

on

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Ethereum Name Service gateway eth.limo has revealed that the domain hijacking on Friday was caused by a social engineering attack directed against EasyDNS, its domain name service provider. 

According to a postmortem published by eth.limo on Saturday, an attacker impersonated one of its team members to initiate an account recovery process with easyDNS, granting access to the eth.limo account and allowing them to alter domain settings.

“The NS records were changed and directed to Cloudflare… Once we understood that a DNS hijack had taken place, we immediately notified the community as well as Vitalik Buterin and others. We then began contacting EasyDNS in an attempt to respond to the incident,” the company said.

Eth.limo serves as a Web2 bridge, providing access to around 2 million decentralized websites using the .eth domain name. Hijacking the service could allow an attacker to redirect users to malicious websites. Ethereum co-founder Vitalik Buterin warned users Friday to avoid his blog until the incident was resolved.

Advertisement

Mark Jeftovic, CEO of easyDNS, has publicly accepted responsibility for the incident in its own postmortem report. 

“We screwed up and we own it,” said Jeftovic on Saturday. 

“This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts.”  

Both companies have pointed to the Domain Name System Security Extension (DNSSEC) in thwarting the hacker’s attempts to do further damage. 

The attacker couldn’t produce valid cryptographic signatures, so Domain Name System resolvers rejected the attacker’s forged DNS responses, causing users to see error messages instead of being redirected to malicious sites. 

Advertisement

“DNSSEC was enabled for their domain when the attackers attempted to flip their nameservers, presumably to effect some manner of phishing or malware injection attack, DNSSEC-aware resolvers, which most are these days, began dropping queries,” Jeftovic said. 

Source: eth.limo

In its postmortem, eth.limo noted that because the attacker lacked the signing keys, they were unable to bypass the safeguards, which likely “reduced the blast radius of the hijack. We are not aware of any user impact at this time. We will provide updates if that changes.”

easyDNS makes changes since the attack

Jeftovic described the social engineering attack as “highly sophisticated,” and said easyDNS is still conducting a post-mortem on how the breach occurred, and has already begun rolling out changes to prevent a recurrence.

Source: easyDNS

“In eth.limo’s case, we will be migrating them to Domainsure, which has a security posture more suited toward enterprise and high-value fintech domains, TLDR there is no mechanism for an account recovery on Domainsure, it’s not a thing,” he added.

“On behalf of everyone here, I apologize to the eth.limo team and the wider Ethereum community. ENS has always had a special place in our heart as the first registrar to enable ENS linking to web2 domains and we’ve been involved in the space since 2017.”

Related: RaveDAO denies manipulation as Binance, Bitget probe RAVE trading activity

Advertisement

The eth.limo incident is the latest in a series of domain hijackings targeting crypto projects. Days earlier, decentralized exchange aggregator CoW Swap lost control of its website after an unknown party hijacked its domain. 

Steakhouse Financial, a DeFi advisory and research firm, similarly disclosed at the end of March that it had lost control of its domain to an attacker.

Magazine: Will the CLARITY Act be good — or bad — for DeFi?