Bittensor price is trading at $325.1, down 3.04% on the day, after rejecting a multi-month descending trendline for the second time in two weeks — and the daily MACD has now confirmed a bearish crossover that shifts the near-term bias toward the downside.

Bittensor (TAO) has produced two consecutive failures at the $355 to $371 resistance zone in the past two weeks, forming a lower high on the second attempt and reinforcing the strength of the descending trendline that has capped every recovery since November 2025.

The first rejection came near $371 on March 25, following Bittensor’s halving event and reports of Grayscale Investments raising its TAO weighting to 43.06% in its AI-focused fund. The second attempt reached $355 on April 7, produced a lower high, and reversed. Both rejection points are visible as circled pivots on the daily chart, and TAO has since retraced to $325.1 without recovering above either level.

The daily MACD has confirmed the setup. The MACD line has crossed below the signal, reading 19.6 against a signal of 22.0, with the histogram at -2.4. Both lines remain above zero, which limits the severity of the crossover, but the signal confirms that momentum built during March’s AI-sector rally is fading.

On the 4H chart, the MACD remains technically bullish, with the MACD line at 6.8 above the signal at 5.8 and a histogram of 1.0. The 4H Supertrend at $313.8 continues to act as dynamic support. However, the 4H histogram has compressed sharply from earlier sessions, and a bearish crossover on that timeframe would add meaningful confluence with the daily signal.

Crypto analyst Michaël van de Poppe stated on X that TAO is “approaching one of those regions for dip buying in the coming weeks,” framing the current pullback as “just normal price behavior” following a triple-digit monthly rally. That view supports a base case in which $297.5 holds as a staging ground, not a breakdown level.

Key Levels and Price Targets

Immediate support: the 4H Supertrend at $313.8, followed by the structural demand zone at $297.5, visible on both the 4H and daily charts and flagged as a key floor during the March accumulation phase.

Extended downside target: $263.7, the daily Supertrend. Previous analysis flagged a potential corrective move toward $200 if the pattern repeats from prior golden-cross fractals, though that scenario requires a sustained close below $263.7 to come into scope.

Bull case: a confirmed daily close above $371 invalidates the double rejection and opens the path toward $400. Bear case: a break below $297.5 targets $263.7. Invalidation: $371.

Derivatives and Institutional Context

Coinglass data shows TAO open interest has declined alongside price in recent sessions, consistent with long-side deleveraging rather than aggressive fresh short positioning. That configuration reduces the probability of a sharp squeeze near current levels and suggests the next directional move is more likely to be supply-driven than forced.

Grayscale has also filed with the SEC to convert its Bittensor Trust into a spot ETF and increased TAO’s weighting to 43.06% in its AI fund, making it the fund’s dominant holding. Neither development provides a near-term price floor, but both reduce the probability of a sustained breakdown below key support if broader risk appetite stabilises.

If $297.5 holds on a daily close basis, the base case is a re-test of the $355 trendline. A confirmed break below $297.5 shifts the primary target to $263.7.

TLDR:

• ZachXBT obtained leaked data from 390 accounts on a North Korean internal payment server via infostealer. 
• Over $3.5M moved through network wallets since late November 2025, with one Tron address frozen by Tether. 
• Three OFAC-sanctioned companies — Sobaeksu, Saenal, and Songkwang — appeared directly in the breached data. 
• Workers received IDA Pro cybersecurity training modules, pointing to capabilities beyond basic financial fraud.

A major breach of an internal North Korean payment server has revealed a sophisticated fraud network generating nearly $1 million per month.

On-chain investigator ZachXBT obtained data from an unnamed source, including 390 accounts, chat logs, and crypto transactions.

The leaked data exposed fake identities, forged legal documents, and crypto-to-fiat conversion methods. Since late November 2025, over $3.5 million moved through the network’s payment wallet addresses.

How the Payment Network Operated

The breach originated from a compromised device belonging to a DPRK IT worker infected by an infostealer. Data extracted from the device included IPMsg chat logs, fake identity documents, and browser history.

Investigators traced activity to a site called luckyguys[.]site, described as an internal payment remittance platform. The platform functioned similarly to a messaging app, allowing workers to report payments back to handlers.

Ten users on the platform still had the default password, 123456, unchanged. The user list included roles, Korean names, cities, and coded group names consistent with known DPRK IT worker operations.

Three sanctioned companies appeared in the data: Sobaeksu, Saenal, and Songkwang, all currently under OFAC sanctions.

ZachXBT posted on X that the remittance pattern was consistent across users. Workers transferred crypto from exchanges or services, or converted funds to fiat through Chinese bank accounts via platforms like Payoneer.

An admin account, PC-1234, then confirmed receipt and distributed credentials for various exchanges and fintech platforms.

One user identified as “Rascal” had direct message logs with PC-1234 detailing payment transfers and the use of fraudulent identities from December 2025 through April 2026.

Hong Kong addresses appeared in billing records, though their authenticity could not be confirmed. Two payment addresses were identified: one Ethereum address and one Tron address, the latter frozen by Tether in December 2025.

Using the full dataset, ZachXBT mapped the complete organizational structure of the network, including payment totals per user and group. He published an interactive org chart covering the December 2025 through February 2026 data range.

Training Modules and Broader Threat Context

Beyond financial fraud, the data revealed cybersecurity training activity within the group. According to ZachXBT’s post, the admin sent 43 Hex-Rays and IDA Pro training modules to the group between November 2025 and February 2026.

Topics covered disassembly, decompilation, local and remote debugging, and various cybersecurity subjects. One link sent on November 20 referenced using an IDA debugger to unpack a hostile executable.

A compromised device belonging to a worker identified as “Jerry” showed usage of Astrill VPN and multiple fake personas applying for jobs.

An internal Slack message showed a user named “Nami” sharing a blog post about a DPRK IT worker deepfake job applicant. Another screenshot showed 33 workers communicating on the same network through IPMsg.

Jerry also discussed plans to steal from a project called Arcano, a GalaChain game, with another worker through a Nigerian proxy.

Whether that attack proceeded remains unclear. The investigator noted this cluster is less sophisticated than groups like AppleJeus and TraderTraitor.

ZachXBT stated in a post that DPRK IT workers collectively generate multiple seven figures per month, and this data supports that estimate.

He added that threat actors are missing an opportunity by not targeting these lower-tier DPRK groups, citing minimal competition and low repercussion risk. He confirmed plans to continue publishing findings through his investigation platform.

Anthropic, the $380 billion AI giant responsible for the Claude tool, has a new AI model called Mythos that could become a crypto hacking nightmare.

Concerned about global panic if it were to release its frontier model too soon, Anthropic handed early “Mythos” access to JPMorgan Chase, Apple, Microsoft, and a few dozen other blue chip tech companies.

Unfortunately, Anthropic didn’t grant guest list access to any crypto company for its paternalistic Project Glasswing.

One Bitcoin developer asked Anthropic directly, “Why not cooperation with bitcoin/crypto projects?” Anthropic declined to reply.

JPMorgan Chase got a head start. Crypto didn’t.

A wing of glass preventing Mythos from hacking crypto

Anthropic’s Glasswing cybersecurity sprint is permitting 50-60 companies early access to its unreleased model that “can find software vulnerabilities better than all but the most skilled humans,” according to the company. 

It is also donating $4 million worth of AI credits and is “committing” up to $100 million in AI credits for Glasswing.

According to Anthropic, which obviously has an incentive to praise the powers of its unreleased model for media and fundraising purposes, Mythos has strong reasoning and coding skills and is considerably more dangerous as a software hacking tool than most human developers.

Anthropic claims Mythos is “very autonomous” and has already found “thousands of high-severity vulnerabilities,” including bugs in “every major operating system and web browser.” 

It withheld details about most of those bugs, except a 27-year-old bug in OpenBSD Unix software and a 16-year-old flaw in FFmpeg video software.

Curiously, Anthropic has published professionally staged and videotaped promotional materials in which Anthropic stakeholders sound alarms about Mythos’ capabilities.

For media purposes, it carefully selected the name “Glasswing,” which refers to the Greta oto butterfly whose transparent wings resemble glass.

Bitcoin (BTC) rallied above $72,000 on Tuesday as BTC order book and derivatives data showed buyers returning to the market.

Bitcoin’s recent trading history suggests that holding the $70,000 level is the first task bulls need to master, but previous BTC price rallies were capped by short-term traders selling into the bullish momentum. Will this time be different?

Bitcoin spot demand remains positive

Bitcoin held above $71,300 on Wednesday as the spot market demand strengthened over the past few days. The order flow across major exchanges shows a clear shift toward investor accumulation.

The 30-day spot net volume delta for Bitcoin, which tracks the net difference between market buys and sells, has turned positive on both Binance and Coinbase after persistent selling in February.

Binance’s 30-day net volume moving average stands at $43.2 million, while Coinbase records $13.88 million. This marks a coordinated shift in behavior across the key crypto exchanges.

The derivatives data adds weight to the move. CryptoQuant data shows Binance’s cumulative volume delta (CVD) has increased to $5.6 billion on Wednesday, up $3.3 billion in April. The CVD measures the aggressive market orders, and the recent rise tracks an increase in taker-buy volume following Bitcoin’s brief drop below $65,000 on March 30.

The current cumulative net taker volume on Binance has reached its highest level since early February, when CVD stood near $74 million. This indicates stronger buyer conviction than the muted activity seen during the previous consolidation phase.

Related: Bitcoin fades three-week highs as BTC price shrugs off Iran war ceasefire

$72,000 is Bitcoin’s line in the sand

Bitcoin’s interaction with $72,000 continues to shape its short-term positioning. The level has acted as a resistance since Feb. 4, with failed attempts to reclaim it on March 4 and March 16. Both rallies were met with sharp selling from the short-term holders, who sold roughly 26,000 BTC and 31,000 BTC, respectively.

The current behavior shows a different pattern. After BTC’s rally to $72,000 on Tuesday, data shows short-term holder capitulation of nearly 3,000 BTC. The reduced selling pressure signals less urgency to exit positions at the current levels than in prior attempts.

The profitability metrics are also stabilizing. Bitcoin’s net realized profit/loss seven-day moving average sits at -$109 million, recovering from a low of -$2 billion on Feb. 7. The metric is approaching a positive bias for the first time since Jan. 22, indicating a gradual reduction in realized losses.

The reduced selling pressure and rising profitability point to a more balanced market in which buyers are gradually absorbing available supply. For a bullish expansion to occur, the trend needs to continue and the buyers need to defend the $70,000 to $72,000 zone over the next few days. 

Related: Cango sells 2,000 BTC, cuts Bitcoin production cost by 19% in March