Crypto World
North Korean hackers stole 7,000 crypto wallet records, Japan says
North Korea linked hacking group WaterPlum has compromised more than 30,000 devices across over 100 countries and regions, stealing information from more than 7,000 cryptocurrency wallets while targeting developers through fake recruitment campaigns.
Summary
- WaterPlum infected more than 30,000 devices across over 100 countries and regions and stole information from more than 7,000 crypto wallets.
- Japanese and U.S. authorities linked WaterPlum and some North Korean IT workers to Bureau 313 of the Workers’ Party of Korea.
- Attackers posed as crypto, AI and NFT companies to target developers with malicious files disguised as interview tasks and coding tests.
- Japanese investigators dismantled a domestic laptop farm used by North Korean IT workers to remotely take jobs while concealing their locations.
- A suspected North Korean IT worker separately applied for an engineering role at bitFlyer in 2025 but was identified before being hired.
Japan’s National Police Agency said on Sept. 18 that its investigation, conducted with the National Cybersecurity Office, the FBI, the U.S. Department of Defense Cyber Crime Center and agencies in Australia and Germany, uncovered the group’s attack methods and links to North Korean IT workers.
Japanese and U.S. authorities assessed that WaterPlum, which is associated with the threat activity commonly known as Contagious Interview, and some North Korean IT workers operate under Bureau 313 of the Workers’ Party of Korea’s Munitions Industry Department.
Investigators found that more than 30,000 computers were likely infected between around December 2025 and July 2026. The victims were spread across more than 100 countries and regions, including Japan, with web designers, engineers and people working in crypto, blockchain and Web3 among the main targets.
More than 7,000 cryptocurrency wallet records were stolen during the infections, while wallets controlled by WaterPlum received at least 1.7 billion yen, equivalent to roughly $10.7 million based on the exchange rate used by Japanese authorities.
Japan’s Foreign Ministry separately confirmed that authorities from Japan, the United States, Australia and Germany had jointly disclosed WaterPlum’s tactics and the activities of North Korean IT workers involved in foreign currency generation and recruitment schemes.
WaterPlum used fake crypto jobs to spread malware
WaterPlum approached software developers and other IT workers through social media, online job sites, gig platforms and freelance marketplaces, according to the Japanese police report. The attackers posed as legitimate artificial intelligence, cryptocurrency and NFT companies or recruitment services before presenting candidates with apparently attractive job opportunities.
During technical interviews or coding tests, candidates were instructed to download malicious programs hosted on collaborative development platforms and code repositories. Some victims were told that the files were needed to diagnose problems with video conferencing software or complete a coding assignment.
The group placed malware including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle inside malicious NPM packages. Once a device was compromised, attackers could establish backdoors and use remote access tools to retain access and move through affected systems. Information stealing malware was then used to extract confidential data and cryptocurrency.
Stolen information included browser credentials, keystrokes, screenshots and clipboard data. Private keys and seed phrases for cryptocurrency wallets were among the targeted records, along with identity documents such as passports and driver’s licenses stored on affected computers or shared folders.
Security researchers have documented similar recruitment methods in the crypto industry. As crypto.news previously reported,North Korean linked developers had worked inside more than 40 DeFi projects over seven years, according to MetaMask developer and security researcher Taylor Monahan. Investigators described job postings, emails, LinkedIn messages, Zoom calls and interview processes as recurring routes used to approach targets.
North Korean IT workers used laptop farms in Japan
Japanese investigators said they dismantled the first known domestic “laptop farm” connected to North Korean IT workers in the country. Under the arrangement, a local facilitator kept computers at their residence while workers remotely controlled the machines from elsewhere.
Workers used identity documents supplied by people living in Japan to impersonate them while seeking contracts. In some cases, payments were directed into bank accounts controlled by facilitators, who then transferred the money onward. North Korean workers connected to the investigations sent cryptocurrency and other assets worth hundreds of millions of yen overseas, according to the agency.
Some workers operated from North Korea, while others were based in China or Russia, with smaller numbers located in Africa and Southeast Asia. Laptop farms and virtual private servers allowed them to disguise where the work was actually being performed while accepting jobs through domestic and overseas crowdsourcing services.
Comparable operations have been prosecuted in the United States. Two U.S. men received 18 month prison sentences in 2026 for helping North Korean workers remotely access company laptops, while the Justice Department said the schemes involved nearly 70 companies and generated more than $1.2 million. The sentences brought the number of laptop farm facilitators sentenced in the United States over a five month period to eight.
U.S. authorities have pursued the proceeds of the employment schemes through cryptocurrency forfeiture cases as well. A federal judge in September ordered the forfeiture of roughly $212,700 in USDC and USDT traced to payment addresses used by North Korean IT workers, part of a Justice Department effort involving more than $7.74 million in digital assets.
Prosecutors said the forfeited wallet had received around 158,123 USDC from at least 10 addresses used to pay workers and 54,574 USDT from at least four other payment addresses. Authorities alleged that workers concealed their identities and locations while taking overseas technology jobs before routing their earnings through cryptocurrency.
bitFlyer caught suspected North Korean applicant
Japan’s investigation identified a separate attempt by a suspected North Korean IT worker to secure an engineering position at cryptocurrency exchange bitFlyer in May 2025.
The applicant submitted a resume under another person’s identity directly through the exchange’s recruitment form and used Gmail as the contact address. Investigators said the person accessed the application system through VPN and proxy services including NETNUT Proxy, Astrill VPN and High Speed Rabbit Proxy.
During an online interview, the applicant claimed to be Malaysian and living in Finland. The resume listed extensive experience across programming languages, blockchain, cryptocurrency and cloud services, along with education at a European university and employment in several European and Asian cities.
The applicant could answer simple questions about the listed skills but gave abstract responses or avoided more detailed questions, according to the agency. Investigators noted repeated checks of another monitor during the interview, occasional voices in the background and interruptions to the video feed. The person resisted relocating to Japan and insisted on receiving salary in cryptocurrency. bitFlyer identified the suspicious behavior and did not hire the applicant, and no damage was reported.
A similar recruitment attempt had previously been detected at Kraken, where an applicant suspected of links to North Korea joined an interview using a name different from the one on the resume and appeared to receive real time assistance during the call. The exchange later connected the applicant’s email address with information previously flagged by industry partners.
Investigators tied WaterPlum activity to the same infrastructure
Japanese authorities found a technical connection between the WaterPlum attacks, the overseas worker operations and the attempted bitFlyer recruitment.
IP addresses used by WaterPlum attackers matched addresses used by North Korean IT workers to connect to laptop farms and crowdsourcing services, according to the National Police Agency. Investigators found that the suspected North Korean worker who applied for the bitFlyer engineering position had used matching infrastructure.
The National Police Agency and FBI assessed that Bureau 313 played a central role in both WaterPlum’s cyberattacks and some of the foreign currency earning operations carried out by North Korean IT workers.
Japanese authorities advised companies to verify applicants’ claimed locations, qualifications and contact information, particularly when candidates insist on remote work or cryptocurrency payments. Employers were urged to check technical skills during interviews and scrutinize cases where a candidate’s stated residence does not correspond with the location of the IP address used to submit an application.
Crypto World
Ethereum Price Analysis: ETH Jumps Past $2.5K as Moving Averages Eye Bullish Cross
Ethereum has recovered sharply from its mid-year lows and jumped past the key $2.5K level on Friday. The charts show a constructive improvement in the broader market structure, although ETH remains below several important higher-timeframe resistance levels.
Meanwhile, the Coinbase Premium Index is once again negative, suggesting that the recent recovery has not been accompanied by consistently strong spot demand from U.S. investors.
Ethereum Price Analysis: The Daily Chart
On the daily timeframe, ETH has undergone a significant structural recovery from the $1.5K support area. The rebound has pushed price back above both the 100-day and 200-day major moving averages shown on the chart, with the 100-day yellow average aggressively pushing toward the 200-day one from below, likely to form a bullish crossover around $2K.
ETH is currently trading around $2.5K, directly inside a key resistance zone. This area has repeatedly contained price during the recent consolidation. Yet, a valid daily breakout above it can lead to continuation of the recovery.
A successful move above the $2.5K area could expose the next major resistance around $3.0K. Beyond that, the larger daily resistance zone sits around $3.3K-$3.4K, which coincides with the broader structure established earlier in the year.
On the downside, the first important support is around $2.1K, where the moving averages are also currently clustered. Below this area, the $1.9K zone becomes the next notable support. Still, the daily RSI is around the mid-to-upper 50s, meaning momentum is still bullish but not showing an overbought reading anymore. Therefore, there could still be room to the upside if sufficient demand emerges.
ETH/USDT 4-Hour Chart
The 4-hour chart provides a clearer picture of the current consolidation. ETH has been trading inside a broad range roughly between $2.35K and $2.65K since the sharp late-August advance.
The latest price action shows ETH recovering from the lower portion of the range and returning toward the $2.5K area. The repeated reactions around the range boundaries suggest that the market is still in consolidation rather than an established directional breakout.
The immediate resistance is around $2.5K, followed by the upper range boundary near $2.65K. A decisive 4-hour breakout above the latter would provide a clearer structural shift and could open the way toward the higher daily resistance zones.
Conversely, rejection around the current resistance and a move back below $2.35K would weaken the short-term structure. Losing that zone would invalidate much of the current range-based bullish setup and bring the next major support into consideration, as a deeper retracement would be probable.
On-Chain Analysis
The Coinbase Premium Index is currently around -0.07, with the indicator spending much of the recent period below the zero line. The metric compares ETH prices on Coinbase with those on other major exchanges and is commonly used as an indication of relative buying or selling pressure from Coinbase’s predominantly U.S.-based market.
The notable point is the divergence between price and the premium index. ETH has recovered from roughly $1.5K to around $2.5K, yet the Coinbase Premium has generally remained negative during much of that advance. This suggests that the recovery visible on the price chart has not been accompanied by consistently strong US-based spot demand.
There have been brief positive spikes, particularly during parts of the summer, but they have not developed into a sustained positive trend. The latest reading has also returned firmly below zero.
This does not necessarily invalidate the broader recovery, since ETH can rise through demand from other venues and derivatives markets. However, a sustained move back above the zero line in the Coinbase Premium Index, particularly alongside a breakout above $2.5K, would provide additional confirmation that spot demand is strengthening, and that the recovery is likely to continue.
The post Ethereum Price Analysis: ETH Jumps Past $2.5K as Moving Averages Eye Bullish Cross appeared first on CryptoPotato.
Crypto World
How to Make the U.S.-China AI Race Less Dangerous
The Trump Administration should push for technical exchanges on how to actually test models for dangerous capabilities and behaviors that neither country wants to see released into the wild. These include AI systems capable of helping amateurs develop bioweapons, or evading human oversight and control. American AI companies have been studying these risks for years, and they have also begun to appear in Chinese technical standards related to safety testing. Exchanging best practices and new insights about how to test for and mitigate these risks could render the systems built in both countries meaningfully safer.
These proposed technical exchanges would not depend on “trust” or even strict “reciprocity” between the two superpowers, nor would they require identical conceptions of AI risk. They would be driven by self-interest. As the most advanced AI models grow even more powerful, both countries have an interest in ensuring that these systems remain controllable, regardless of where they are built or deployed. That will require both countries to improve their model testing, monitoring and safeguards, and share promising findings that could enhance safety without surrendering a competitive edge or undermining national security.
Crypto World
Your Shoe Size Can Change as You Age. Here’s Why
A study published in 2016 examined the foot measurements of 68 women aged 20 to over 80. It found that the widths of the balls of the feet increased by 3 to 4 millimeters per decade, while ball circumferences increased by about 5 to 7 millimeters, high-step circumferences 0.4 to 4.8 millimeters, and heel instep circumferences up to 2 millimeters.
“That may sound small, but these changes accumulate over several decades and can become enough to affect shoe fit,” Koury says.
If your feet seem to be getting wider or longer and you’re experiencing pain, swelling, numbness, tingling, or difficulty walking or doing other activities, see your doctor, Koury says. Also, talk to your doctor if you’re getting recurrent calluses, blisters, or skin breakdown, or if your bunions, hammertoes, or flatfoot are worsening. Sudden foot changes, especially if they only affect one foot, should also get checked, Srinivas says.
Crypto World
Morpho adds USDC lending for five Coinbase tokenized stocks
Morpho has opened lending markets for five Coinbase tokenized stocks on Base, with users pledging $104,401 in stock tokens and borrowing $54,652 in USDC against them so far.
Summary
- Morpho has opened lending markets for five Coinbase tokenized stocks on Base, with $104,401 pledged as collateral and $54,652 borrowed in USDC.
- Apple, Alphabet, Nvidia, Meta and SpaceX tokens are supported, while five other Coinbase stock tokens currently have no Morpho markets.
- Borrowing jumped from $503 to $42,105 in roughly two hours on Sept. 16 and has since climbed to $54,652.
- All current borrowing is concentrated in variable rate markets, while Morpho’s 95 Midnight fixed rate markets have no outstanding loans.
According to Morpho, holders can now use the Coinbase issued assets as collateral and borrow USDC through variable rate markets or its Midnight fixed rate lending layer, giving eligible investors a way to access dollars without selling their tokenized stock positions.
The markets cover Apple (AAPLc), Alphabet (GOOGLc), Nvidia (NVDAc), Meta Platforms (METAc) and SpaceX (SPCXc). Coinbase currently has 10 stock tokens listed on Base, but Amazon, Microsoft, Strategy, SanDisk and Tesla do not yet have corresponding Morpho markets.
Morpho lending starts with five Coinbase stocks
Borrowing remained limited after the five markets were deployed on Sept. 7, with outstanding loans staying below $600 until Sept. 16. Morpho historical data showed borrowing climbing from $503 to $42,105 in roughly two hours that day before reaching $54,652 by Friday morning.
The lending activity follows Coinbase’s expansion of its tokenized equity products on Base. Coinbase initially released Apple, Nvidia, Meta and Alphabet tokens in August before adding six more stocks in September, taking the lineup to 10 assets. The second batch included Amazon, Microsoft, Strategy, SanDisk, SpaceX and Tesla.
Coinbase’s first four products are backed one for one by underlying shares held through a segregated custody arrangement, crypto.news previously reported. The tokens represent beneficial interests in the underlying securities and are designed to remain in self custodial wallets while interacting with supported applications on Base.
Coinbase Onchain SPV Ltd., an entity incorporated in the Abu Dhabi Global Market, issues the securities. The products are offered to eligible investors outside the United States and are not registered under the U.S. Securities Act.
Steakhouse Financial curates all five Morpho markets and determines parameters including collateral requirements. Its two Steakhouse High Yield USDC vaults account for 98.9% of the dollars supplied to the largest market.
For Apple, the two vaults supply $24,540 of the $24,805 deposited into the lending pool. Chipworks USDC accounts for another $262, while two wallets provide less than $3 combined.
Stock collateral carries different liquidation limits
Morpho’s Apple, Nvidia, Meta and SpaceX markets have a liquidation loan to value ratio of 62.5%, while Alphabet carries a higher 77% threshold.
Market contracts themselves do not enforce the geographic restrictions. Morpho said compliance controls are set through the stock tokens and their issuers, with the markets unavailable to U.S. persons and people in other restricted jurisdictions.
Coinbase’s tokenized stock structure already limits access to eligible non U.S. investors. Its first products launched under Regulation S, with each token representing an interest in an underlying security instead of a synthetic contract that simply tracks its price.
Chainlink introduced price feeds for the initial Coinbase stock tokens shortly after their Base launch, allowing lending protocols to calculate collateral values, borrowing limits and liquidations. Chainlink price feeds initially supported Apple, Nvidia, Meta and Alphabet, with each feed calculating the total return value of the corresponding token.
Morpho now uses its Chainlink V2 oracle adapter to price collateral in the five markets. The Apple feed showed $335.49 at 1:42 p.m. UTC on Friday, compared with a $337.52 price for the token on DefiLlama.
At a 62.5% liquidation loan to value ratio, the Apple market applies a 12.67% liquidation penalty. No liquidation has been recorded in the market since its deployment, while its largest borrower holds 113.46 AAPLc against a 20,360 USDC loan with a health factor of 1.17.
Variable rate markets hold all current borrowing
Borrowing has so far remained entirely on Morpho’s variable rate markets despite fixed rate alternatives being available through Midnight.
Apple, Alphabet and Nvidia are running at 90% utilization, matching the target set by their interest rate model. Borrowers in the markets pay 5.62%, while lenders receive 5.06%.
Meta has reached 97% utilization, pushing it past the model’s target and onto the steeper section of its rate curve. Borrowing costs have consequently reached 17.52%, with lenders earning 16.98%.
Morpho launched Midnight on Base in July as a fixed rate and fixed term lending system designed to let borrowers and lenders establish loan conditions without depending solely on variable rate models. The protocol was later expanded to Ethereum.
For each of the five Coinbase stock tokens, Midnight currently has 19 USDC markets, creating 95 fixed rate markets in total. Maturities run daily through Sept. 30 before moving to Oct. 30, Nov. 27, Dec. 25 and March 26, 2027, alongside an open ended market for each token.
None of the 95 markets has outstanding units, leaving the $54,652 in current stock backed borrowing concentrated in Morpho’s variable rate pools.
Tokenized stock collateral remains a small market
Around $11.4 million of the five supported stock tokens is outstanding on Base based on contract supply and Morpho’s oracle prices. The $104,401 deposited as Morpho collateral represents less than 1% of that amount.
Trading activity across Base’s tokenized stock sector has expanded more quickly. Token Terminal recorded $730.9 million in decentralized exchange volume over the 30 days ending Sept. 12, while daily volume reached a record $100 million.Base stock trading volume was led by Aerodrome, which processed $557.1 million during the measured period, with Uniswap v4 handling another $139.3 million.
Morpho holds $4.03 billion in deposits on Base and $10.42 billion across supported chains, according to DefiLlama. Base lists Aave and Euler alongside Morpho as protocols where eligible holders can borrow against Coinbase’s stock tokens.
MORPHO traded at $2.40 on Friday, up 11% over the previous 24 hours, with a market capitalization of $1.68 billion, according to CoinGecko. Bitcoin gained 4.9% over the same period, while ether rose 4.3%.
Crypto World
Sharon Horgan Nails Middle-Aged Precarity
If youth is, as the saying goes, wasted on the young, then Horgan’s Alex is a character actually equipped to savor what little she has left of it. “I have 10 years left as a sexual person,” she determines in the premiere. With the petulant son, Ruarí (Aran Murphy, a near-clone of dad Cillian), whom she raised with minimal help from her ex-husband Lorcan (Owen McDonnell) packing up for uni, she’s resolved to end a long celibate streak. This search for not just a sex partner, but also the enduring love that has so far eluded her should be aided by Alex’s genuine youthfulness. But with guys like Lorcan and another former flame, Patrick (a rakish Rupert Friend), dodging adulthood with girlfriends decades their junior, the dating pool seems sparse. Set up on a blind date with a patient 67-year-old (Tim McInnerny’s Michael) who looks like he could be her dad, she can’t hide her disappointment. She treats him atrociously. Then again, the double standard that dictates she’s now too old for men her own age is also pretty atrocious.
Crypto World
Bitcoin climbs over $80,000 as rally accelerates at U.S. market open
Hyperliquid’s HYPE rose more than 11% to nearly $89 as of Asian morning hours Friday, the strongest move among the majors, according to CoinDesk data. Zcash’s ZEC added 8% to roughly $1,472 and Solana’s SOL 6% to just above $106.
BNB and DOGE each gained about 4%, with XRP, ether and bitcoin up 2%. TRX was the laggard at under 1%.
Bitcoin traded just below $78,000 after touching $75,972 during U.S. hours, recovering the whole of that overnight drop and marking a third consecutive day of gains. Total crypto market value rose 2% to roughly $2.66 trillion.
None of the 40 most liquid coins fell over the period, according to FxPro chief market analyst Alex Kuptsikevich, who said traders are “cautiously shifting their focus towards altcoins” even with the altcoin season index still subdued. NEAR led that group at 30%, followed by UNI at 26% and APT at 18%.
The move came with equities rising and a broader appetite for risk, a day after the Fed’s quarter-point hike landed without the reaction traditional markets had braced for.
Bitcoin faces the upper edge of its established trading range near $82,000. Kuptsikevich expects profit-taking into the weekend to delay any attempt at it.
Crypto World
Hacktron Says It Hacked Openai in Under 72 Hours
Hacktron AI says it managed to hack OpenAI in less than 72 hours. The security research team revealed that it chained two separate vulnerabilities to gain access to ChatGPT and Codex accounts belonging to OpenAI employees. To prove the access was real, the researchers used an employee’s Codex account to open a harmless pull request in OpenAI’s internal monorepo rather than accessing sensitive code. The entire attack started with something that sounds relatively harmless: uploading an image.
Hacktron shared the details in a technical write-up on September 13, while also summarizing the exploit chain on X.
According to the researchers, the chain looked like this:
- HEIF upload → libheif heap overflow → remote code execution → OpenAI SSO flaw → ChatGPT/Codex takeover → connected GitHub → internal repository
Key Takeaways
- Hacktron AI says it compromised OpenAI systems in less than 72 hours.
- The attack began with a HEIF image upload and a vulnerability in libheif.
- An OpenAI SSO flaw allegedly allowed the researchers to move from the compromised forum to employee ChatGPT and Codex accounts.
- A connected GitHub integration provided a path to demonstrate access to OpenAI’s internal repository.
- OpenAI says it fixed its side of the issue about 14 hours after the report and later paid Hacktron a $6,500 bounty.
- The research highlights how AI can accelerate vulnerability research and exploit development, although Hacktron says human guidance was still necessary.
The Hack Started With a Heif Image
Hacktron was looking at the image-upload system used by OpenAI’s community forum, which runs on Discourse. The researchers noticed that HEIC and HEIF images were processed differently from other image formats. Because Discourse’s usual image-checking tool did not support HEIF, those files were passed to ImageMagick for conversion.
That meant the uploaded files eventually reached libheif, an image-processing library responsible for handling the format. Hacktron then discovered a heap buffer overflow in the version of libheif used by the environment.
According to the team, some security fixes had not been backported to the Debian package. This left the library vulnerable to a memory corruption attack that could provide out-of-bounds read and write capabilities. In other words, a specially crafted image could become much more than just an image.
AI Helped Turn the Bug Into an Exploit
This is where the story gets particularly interesting. Hacktron says it used AI models to help investigate and exploit the vulnerability.
The researchers initially worked with Claude Opus 4.8, asking it to examine the installed libheif package for potential security problems. The model helped identify the relevant vulnerability, but getting a reliable exploit working proved difficult when ASLR was enabled.
Then Anthropic released Claude Opus 5. Hacktron says the new model was able to produce a working ARM64 exploit within about three hours. The researchers then had it adapt the exploit to the x86-64 environment and the jemalloc configuration used by Discourse.
By the morning of July 25, the team says it had confirmed remote code execution through an image upload. And that was only the beginning.
The Openai SSO Flaw Changed Everything
Getting code execution on the forum wasn’t enough to reach OpenAI employee accounts. Hacktron discovered that the forum supported “Sign in with OpenAI” through OpenAI’s authentication infrastructure at auth.openai.com. The researchers believed this SSO setup could provide a route from a compromised forum account into other OpenAI services.
According to Hacktron, they were able to confirm that assumption. The researchers said they took over an OpenAI employee’s ChatGPT and Codex accounts. That employee’s Codex account was connected to OpenAI’s GitHub organization.
Rather than digging through OpenAI’s internal source code, Hacktron used the compromised Codex account to create a pull request in OpenAI’s internal monorepo. The team described the pull request as a harmless proof of concept and stopped testing after demonstrating the access.
OpenAI Fixed the Issue Within Hours
Hacktron reported its findings to OpenAI through the Bugcrowd bug bounty program on July 25. According to the team’s timeline, OpenAI confirmed that its side of the issue had been fixed at around 22:49 UTC, roughly 14 hours after the initial report.
The researchers also reported the underlying Discourse vulnerability to Discourse through HackerOne. Discourse responded the next day and had a fix ready by July 27. The company also added sandboxing for ImageMagick as an additional security measure.
OpenAI later awarded Hacktron a $6,500 bounty for the OpenAI-side vulnerability. OpenAI clarified that testing against the Discourse-hosted community forum was outside the scope of its bug bounty program.
The Bigger Concern Is AI-Assisted Hacking
For Hacktron, this wasn’t just another vulnerability disclosure. The researchers say the experiment shows how AI is changing the amount of time and expertise required to turn vulnerabilities into working exploits.
Hacktron said the OpenAI and Discourse attack took a few days for an AI agent and only a few hours of human effort. Its broader HEIF Heist research reportedly involved three researchers and cost less than $3,000 in AI tokens.
The team is careful to point out that the process wasn’t completely autonomous. Human researchers still provided guidance and made important decisions during the operation. Still, the speed is notable. Hacktron argues that tasks that once required highly specialized security expertise and significant amounts of time can increasingly be accelerated by AI.
The incident also shows why vulnerabilities in seemingly ordinary software can have much wider consequences when that software is connected to authentication systems and other services.
Crypto World
Bitcoin Registers Fourth-Ever Bullish Cross, Boosting Bull-Case Momentum
Bitcoin’s longer-term price structure is starting to look more stable, with analyst Willy Woo pointing to a well-known technical setup that historically has aligned with major bear-market endings. Woo argues that Bitcoin’s latest monthly “Fisher Transform” signal marks a new phase of trend reversal—though he also cautions that clean bottoms are not guaranteed and some consolidation is still possible.
Writing in a Friday update on X, Woo highlighted that the Fisher Transform indicator produced a monthly bullish crossover in August—only the fourth time this has happened in Bitcoin’s history—suggesting the market may have already formed its next macro floor.
Key takeaways
- Willy Woo says Bitcoin’s Fisher Transform produced a monthly bullish crossover in August—only the fourth such event on record.
- Woo links prior monthly crossovers to bear-market bottoms, citing late 2022 as an example when the indicator reached about -3.83.
- A weekly bullish divergence in Fisher continues to develop, echoing the pattern seen during the final six months of Bitcoin’s 2022 bear market.
- Woo notes the signal tends to be more reliable near bear-market bottoms because speculative churn is typically lower than during bull phases.
Why the Fisher Transform matters for market timing
Woo used the Fisher Transform, a trend-strength indicator developed in 2002, to assess whether Bitcoin’s broader trajectory has shifted. The Fisher Transform works by smoothing price action into a form that is easier to interpret as trend conditions change.
The method applies a log-based transform to correct for the way raw price tends to linger near extreme values. In practice, the Fisher Transform is plotted as two lines: the Fisher line and a trigger line derived from it, delayed by one period. Both lines oscillate around a central zero line, with crossovers between the Fisher and trigger lines typically interpreted as a signal of regime change.
According to Woo, when these two trend lines cross upward on monthly time frames, the occurrence has repeatedly coincided with bear-market bottoms—events that historically precede larger macro uptrends.
August’s monthly crossover: “3 for 3” with a fourth added
In Woo’s read-through, the key development is the timing and frequency of Bitcoin’s monthly Fisher bullish crossover. He states that a sharp upward reversal—where the Fisher and trigger lines intersect—has matched bear-market bottoming phases on monthly charts, and that the latest August cross appears to extend this track record.
Woo specifically points to the crossover occurring during July at around -2.26 on the Fisher Transform scale, stating that it would represent the fourth recorded bullish monthly crossover if it plays out as history suggests. He also frames the pattern as “3 for 3 without fake out,” before adding the newest event as a potential extension rather than a one-off.
Importantly, Woo does not claim that the crossover automatically prevents additional volatility. He notes that even when the indicator turns, price can still consolidate and potentially test lower levels before a more durable macro advance takes hold. He compares this to other cycles where Fisher showed a bearish crossover during bull markets—followed later by a fresh bullish signal—implying that the macro signal can precede full directional confirmation.
Bear-market signals may be “cleaner” than bull-market ones
Woo’s reasoning goes beyond chart math. He argues that the reliability of the Fisher Transform’s reversal timing depends on market participants. In his view, long-term bull phases often include more speculative activity—traders reacting aggressively to short-term swings—creating choppier conditions and increasing the odds of “fake out” signals.
By contrast, in bear-market bottom zones, he says speculative participation is largely reduced. When buy pressure returns because value buyers step in, the price reversal becomes less noisy, which can make trend signals such as Fisher crossovers easier to interpret.
That distinction is central to how Woo frames the current setup: even if the indicator has turned, investors should still expect that a bottom can involve time-consuming stabilization rather than an immediate straight-line recovery.
Weekly bullish divergence mirrors 2022’s late-stage pattern
Alongside the monthly crossover, Woo also emphasized a bullish divergence developing on weekly time frames. In this setup, Fisher continues to form higher lows while Bitcoin’s price prints lower lows—an often-cited sign that downward momentum is weakening even as the market remains trapped in a drawdown.
Woo says Fisher hit a swing low near -2.85 at the end of December last year, when BTC/USD was around the $90,000 area. Since then, he reports that Fisher has produced a series of higher lows while price has not followed suit. The divergence matters because it suggests deterioration in selling pressure may be occurring underneath the surface.
Critically, Woo links this current divergence structure to what was seen during Bitcoin’s 2022 bear market. He notes that a similar Fisher bullish divergence appeared as the prior bear market moved into its final months—then proceeded to coincide with the eventual transition out of the downtrend.
What remains uncertain: July’s $57,000 area and buyer behavior
Even with the technical backdrop improving, Woo and other onchain-driven observations leave room for doubt. The article points to ongoing uncertainty about whether recent lows near $57,000 on July 1 truly marked a full cycle bottom. Earlier onchain analysis referenced in the coverage suggested that while some metrics have produced bear-market reversal signals, there may not yet be consistent confirmation from traditional “buyer interest” behavior.
Woo himself previously flagged a “lack of typical buyer interest” at those lows, arguing that accumulation appeared dominated by a smaller set of large-volume investors rather than broad-based demand. That matters for how traders interpret reversals: a market can bounce on limited buying, but more durable cycle transitions usually require sustained participation across the market.
For now, the key question is whether the monthly Fisher crossover will translate into a macro uptrend rather than only a temporary turn. Readers should watch whether Fisher continues to confirm on higher time frames and whether price action starts to align with the divergence signals on weekly charts—especially if Bitcoin tests deeper support before any sustained break higher.
Crypto World
Banks Now Account for Nearly 1 in 4 EU MiCA Crypto Providers
Banks are rapidly expanding their presence in Europe’s regulated crypto market, with traditional lenders now accounting for nearly one in four providers listed under the European Union’s Markets in Crypto-Assets framework (MiCA).
The number of banks on the EU’s MiCA crypto provider list doubled to about 80 from roughly 40 between June 26 and Sept. 16, according to a Cointelegraph analysis of MiCA register data from the European Securities and Markets Authority (ESMA).
The overall number of listed crypto-asset service providers (CASPs) rose from 243 to 349 over the period, but non-bank providers lost ground in relative terms, with their share falling from about 84% to 77%.
While non-bank providers still dominate the register and grew in absolute numbers, banks expanded much faster, increasing their share from around 17% in late June to nearly 23% in September.
German banks pile into crypto
Germany drove much of the banking expansion, with dozens of cooperative and commercial banks appearing on ESMA’s MiCA register.
New names include Deutsche Bank, Germany’s largest lender, which on Wednesday announced plans to launch digital asset custody services for institutional and corporate clients in Europe. A Deutsche Bank spokesperson told Cointelegraph that the bank expects to receive regulatory approval for the offering under MiCA in October.
Related: Binance brushes off Lagarde MiCA speculation, reaffirms Europe commitment
The trend extends beyond Europe’s biggest banking groups. Germany’s additions include numerous Volksbank, Raiffeisenbank and VR Bank institutions, showing that regulated crypto services are spreading into the country’s regional cooperative banking network rather than remaining limited to large international banks.
Banks have a different route into MiCA
Unlike crypto companies that must apply for CASP authorization, banks can provide crypto services under MiCA through a separate notification procedure.
Under Article 60 of MiCA, a credit institution may provide crypto-asset services if it submits the required information to its home regulator at least 40 working days before providing those services for the first time.
The notification route gives banks a way to expand into crypto without going through the standard CASP authorization process.
Crypto World
Layer-2 and DeFi tokens lead broad crypto advance: Crypto Markets Today
Crypto’s post-Fed hike bid extended into Friday, with decentralized finance (DeFi) and layer-2 tokens taking over from privacy and haven assets that led Thursday’s gains, a rotation that demonstrates a return to risk-on trading.
Bitcoin rose above $78,000 during the European morning, adding 2.1% since midnght UTC and 1.9% over the past 24 hours. It’s still 5% below the Sept. 4 monthly high of $82,284 after two weeks of range-bound price action.
While all but two CoinDesk 100 constituents were higher on the day, the focus is on the DeFi Select Index (DFX). That accelerated the fastest, surging by 8.3% since midnight and 16% over the past 24 hours.
Market gains follow a more conducive macro backdrop. The 10-year Treasury yield slipped back under 5% and Brent crude eased below $103 after trading as high as $109 earlier in the week, taking some of the heat out of the inflation scare that followed the rate increase.
Equity index futures also showed strength, with S&P 500 and Nasdaq 100 futures rising 0.3% and 0.6%, respectively, while gold and silver added 1.1% and 2.8% apiece.
Derivative positioning
- Futures market signals positional trading revival: The crypto futures market is signaling a revival in positional trading. This shift is underscored by a nearly 5% expansion in cumulative open interest (OI) to $141.2 billion, which contrasts with a 3% dip in daily trading volume to $95 billion. The taker buy-sell volume remains balanced, suggesting capital is entering the market structurally rather than through aggressive momentum chasing.
- Bitcoin open interest builds as the price gains: OI in bitcoin futures ticked up to 680K BTC from 670K BTC since midnight UTC, a slight increase alongside BTC’s advance. This combination is typically taken to represent a build-up of long, or bullish, positions. However, the increase is quite small, and the OI tally remains well below the peak of 800K BTC hit early this year. In other words, overall positioning remains light.
- Binance trader ratios show institutional conviction: Binance’s top trader long-short accounts ratio has pulled back to 1.52, still bullish, but lower than Wednesday’s high of nearly 2. Meanwhile, the long-short positions ratio remains elevated at 2.36. That means fewer individual “whales,” or large holders, are leaning long, but the ones who are have greatly increased their bet sizes, indicating strong institutional conviction.
- UNI futures open interest surges to near record: Among altcoins, open interest (OI) in futures tied to Uniswap’s UNI surged to 86.61 million tokens — flirting with an all-time high, up from 76.89 million tokens yesterday. This expansion highlights substantial capital inflows, which are moving in tandem with a 30% explosion in the token’s spot price. This renewed appetite for major DeFi altcoins stems from mounting market optimism surrounding friendly, coordinated crypto regulations from the SEC and CFTC.
- Bullish momentum dominates major tokens’ volume delta: The bullish mood is also reflected in the 24-hour OI-adjusted cumulative volume delta, which is positive for most major tokens, excluding GRAM, SHIB, HBAR and BNB. A positive reading means bulls are being more aggressive by trading longs at market orders rather than passive limit orders.
- Implied volatility drops to May’s lows: With major events such as the Clarity Act vote, and the Fed and Bank of Japan interest-rate meetings out of the way, bitcoin’s annualized 30-day implied volatility index, BVIV, dropped to 36%. That level has been a floor since May. The decline points to expectations for near-term market calm.
- Options skew turns short-term bullish for BTC and ETH: In options listed on Deribit, BTC’s one-week put-call skew has turned positive, pointing to relative richness of calls, or bullish bets, over puts. However, one- and two-month skews still show a slight put bias. ETH’s one-week skew also shows bullishness. The 24-hour volume rankings, however, show a mixed sentiment, with both BTC call and puts featuring in the most active list.
Token talk
- The DeFi Select Index’s advance on Friday rested largely on uniswap (UNI), up 13% since midnight UTC and 25% over the past 24 hours, with ethena (ENA) gaining 9.6% and liquid-staking token lido adding 6.6%.
- Layer-2 tokens matched DeFi’s strength, led by starknet at 18% on the day and 21% over 24 hours, with arbitrum up 17% and 25%, stacks up 9.2% and optimism up 8.9%. STRK is now at its highest since June 19 while ARB, at 20.9 cents, hasn’t been this pricey since January.
- Solana (SOL) added 4.5% to $106.14, but the sharper move sat in its ecosystem, where solana-based DEX token raydium rose 16% to $1.71 and liquid-staking token jito lagged at 1.6%, a split that points at DEX volume rather than a blanket bid for the chain.
- Thursday’s leader stalled. Zcash (ZEC) traded at $1,490.10 for a gain of 1.6% on the day against 7.6% over 24 hours, meaning almost all of the advance took place on Thursday. Rival privacy token dash was one of only two CoinDesk 100 constituents in the red, losing 0.53%, alongside world liberty financial , which fell 0.31%.
- CoinMarketCap’s “Altcoin Season” index is now at 44/100 have risen from Tuesday’s low of 32/100, a sign that speculation is the overarching theme on Friday.
-
Fashion7 days agoWeekend Open Thread – Corporette.com
-
Tech5 days agoThe Latest Weird Thing to Play Doom Is the Mapped-Out Brain of a Fruit Fly
-
Crypto World4 days agoKraken Lets xStocks Holders Earn Yield Through DeFi
-
Entertainment7 days agoNews Specials, Movies, Shows, More
-
Crypto World2 days agoUS Charges Robinhood Engineers Over Crypto Listing Trades
-
Crypto World6 days agoCan AI Build a Startup in 72 Hours? Elon Musk's Team Will Livestream the Test
-
Crypto World4 days agoElon Musk Drops a Bombshell: Grok 5 Could Be the AGI Breakthrough
-
Business5 days agoRivals Sam Altman and Elon Musk Rally Behind Dario Amodei’s Call for a Slowdown in AI Development
-
Crypto World3 days agoWhat Is the Status of the U.S.-Iran Peace Talks? Here's What Both Sides Are Saying
-
NewsBeat4 days ago‘Sick conspiracy’: Trump says only guardrails AI needs is ‘a strong and smart (High IQ!) president’ in all-caps rant
-
Crypto World5 days agoNew Tesla Roadster Uses SpaceX Tech. Will It Impact the Stock Price?
-
Crypto World6 days agoRobinhood Chain Never Stopped But its Blobs Did Stop Reaching Ethereum For 14 Minutes
-
Entertainment7 days agoNew Horror Movie Officially Earns a Rare Stephen King Recommendation
-
Crypto World3 days agoNVIDIA Analysis: Attempted Rising Wedge Breakout Amid Pressure on the AI Sector
-
Business6 days agoMarvell: Most Potent Setup Of The AI Factory Decade
-
Crypto World4 days agoDOJ Seeks to Seize $61M in Iran Oil Funds From Binance Accounts It Vouched For
-
Crypto World6 days agoBitcoin ETFs lose $462.7M as Ethereum funds gain $196.9M
-
Crypto World4 days ago3 Token Unlocks to Watch in the Third Week of September 2026
-
Crypto World4 days agoRevolut Attackers Warn of Ongoing Daily Customer Data Leaks
-
Business4 days ago
SK Hynix ADRs Fall More Than 6% as Memory Rally Breaks on Fears of Slower AI Spending




You must be logged in to post a comment Login