Bitcoin (BTC) has flash crashed 10% on the South Korean exchange Bithumb after a user sold 2,000 BTC that they received by mistake from a promotional airdrop. 

Earlier today, X users noted that Bithumb’s listed BTC/South Korean Won (KRW) trading pair plummeted by 10% in the space of a minute before returning to its original price. 

The account “Definalist,” which claims to be made up of five crypto traders based in China, noted the price drop and a “rumor” that someone dumped 2,000 BTC.

They also appeared to show a screenshot taken from the seller’s account while they were dumping the BTC, which in today’s less-than-stellar crypto markets would fetch $134 million.

Read more: Bithumb boosts security in wake of SK Telecom malware hack

Definalist later claimed that hundreds of users may have received 2,000 BTC accidentally after an employee typed BTC, instead of KRW, when sending out 2,000 KRW ($1.4) as part of a “random box prize” promotional giveaway. 

Bithumb confirms it sent ‘abnormal’ sums of BTC to users

Bithumb has since confirmed some details of the incident, although it didn’t confirm the quantity of BTC nor the number of customers who received mistaken disbursements.

It admitted that an “abnormal” sum of BTC was paid to various users, and that BTC’s price “temporarily fluctuated sharply as some accounts that received the BTC sold it.”

It notes that it was able to restrict the accounts selling the BTC and added that “the market price returned to normal levels within five minutes, and the domino liquidation prevention system functioned normally, preventing chain liquidations due to the abnormal BTC price.”

“We want to make it clear that this incident is unrelated to any external hacking or security breach, and does not pose any issues with system security or customer asset management,” the exchange said.

If Bithumb did in fact send 2,000 BTC to at least 100 users, thats a minimum distribution of $13 billion.

BTC crashed almost 47% from its all-time high of $126,000 last October but has, for the time being, gradually begun to increase in price again. 

The flash crash is another problem for Bithumb after South Korea’s financial competition watchdog raided its office last week over various promotions it advertised last year.

Protos has reached out to Bithumb for comment and will update this piece should we hear back.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

IREN’s (IREN) latest earnings offered a snapshot of a company mid-transition, with shares currently paying the price for that transition. The firm reported weaker-than-expected revenue and earnings as bitcoin BTC$65,998.81 mining took a back seat to its rapidly expanding AI cloud ambitions.

Crushed by record-low margins after the 2024 halving, bitcoin miners are recasting themselves as digital infrastructure players, converting power-hungry mining sites into AI-ready data centers in a bid for more stable, long-term revenue.

One of last year’s best-performing stocks, not just in crypto, but for the whole market, IREN has come back to earth a bit since hitting a record high near $77 in November. Down about 20% amid Thursday’s market crash, shares are flat on Friday at $39.77.

IREN has secured $3.6 billion in GPU financing tied to its Microsoft contract, alongside a $1.9 billion customer prepayment, funding that management says will cover roughly 95% of GPU-related capital expenditures as it scales its AI business, a development JPMorgan analysts Reginald Smith and Charles Pearce described as encouraging.

IREN’s fiscal second-quarter revenue fell sequentially as lower average hashrate, fewer coins mined and a quarter-over-quarter drop in bitcoin prices weighed on results, according to the Wall Street bank.

The drag from mining was partly offset by rapid growth in cloud services, where revenue more than doubled from the prior quarter to $17 million. That figure came in above JPMorgan’s $14 million estimate but well short of the Street’s $28 million forecast. Management said all GPUs currently energized are fully contracted, a signal the bank described as encouraging as the company pivots toward AI infrastructure.

Cost controls also helped cushion the quarter. Cash SG&A dropped sharply to $43 million, while power costs declined on lower average hashrate. As a result, adjusted EBITDA reached $75 million, beating the bank’s estimate, driven by lower operating and energy expenses. The bank has an underweight rating on the stock.

Investment bank B. Riley raised its price target on IREN to $83 from $74 while reiterating its buy rating, arguing that the recent pullback has created an attractive entry point.

The upgrade comes despite a softer fiscal second quarter, during which adjusted EBITDA of $75.3 million missed expectations. B. Riley said the earnings miss is overshadowed by IREN’s progress on its AI pivot, including $3.6 billion in low-cost GPU financing tied to its Microsoft deal, a $1.9 billion prepayment that covers about 95% of GPU capex, and an expanded power portfolio now exceeding 4.5 gigawatts (GW).

Compass Point analyst Michael Donovan reiterated a buy rating and a $105 price target on IREN, saying the latest earnings show a company better positioned for growth, even though recent results were weaker. He said IREN now has more secure power and a clearer plan to fund its expansion, which matters more than one soft quarter.

Donovan described the fourth quarter as a period of change. Revenue fell to $184.7 million as the company mined less bitcoin while shifting its facilities from older bitcoin-focused machines to newer chips used for artificial intelligence. Even so, the mix of revenue improved as AI-related services began to make up a larger share of the business.

He pointed to the $3.6 billion financing package linked to IREN’s Microsoft project as an important milestone. The funding is larger than originally planned and is structured so that money is drawn as construction moves forward and revenue contracts kick in.

Donovan expects IREN to begin recognizing revenue from Microsoft toward the end of the second quarter of 2026, with revenue increasing in stages after that. By the end of 2026, he sees a path for the business to generate about $3.4 billion in annualized revenue.

Read more: Weak earnings drag IREN, Amazon; bitcoin stocks rebound in pre-market

As if the week for Strategy investors wasn’t already bad enough, their capital stack has hit another, new low. Unfortunately, 100% of the company’s convertible debt is now “out-of-the-money.”

With the firm’s 2030A convertible bond notes, the final holdout from last week, joining the other five series in reaching out-of-the-money territory, all six series now have a conversion price above the price of MSTR, Strategy’s common stock.

In plain English, it’s now worse for bondholders to convert into common stock rather than just keeping their bonds as bonds.

As a result, Strategy will need to continue servicing their coupons, and principal cash repayments.

While all bondholders are out-of-the-money, in other words, these convertibles will not convert into MSTR and will, instead, continue to drag on the cash obligations of the company going forward.

These creditors will demand on-time interest payouts and principal repayment through June 2032, unless the price of MSTR starts to rally and sufficiently motivate them to exercise their convertible options. 

Strategy’s bonds pay interest coupons of 2.25%, 0.625%, and 0%, depending on their upcoming maturities. The company has $8.2 billion worth of notional debt outstanding.

TLDR:

• Layoffs and declining job openings show employers preparing for slower growth and tighter financial conditions 
• Housing demand is weakening as sellers outnumber buyers, creating a record imbalance and reduced market liquidity 
• Bond and credit markets reflect rising stress tied to debt levels and long-term growth uncertainty 
• Rapid disinflation and firm monetary policy increase the risks of tightening into an already fragile economy

U.S. economic indicators are showing coordinated signs of strain across labor, housing, and credit markets. Layoffs are rising while hiring slows, reducing job security for many workers. 

Housing demand is weakening as sellers outnumber buyers. Bond and credit markets also reflect growing caution. Together, these trends suggest the economy is entering a fragile late-cycle phase.

Labor and Housing Data Point to Late-Cycle Fragility

Labor and housing data are moving together in a pattern associated with late-cycle slowdowns. January layoff announcements exceeded one hundred thousand, the highest level for that month since the global financial crisis. 

Weekly jobless claims have trended higher, while job openings have fallen to levels last seen in 2020. This combination reduces worker mobility and weakens income security across sectors. 

Companies are not only cutting staff but also limiting recruitment, with hiring plans reaching record lows for the month. Consumer confidence surveys now reflect growing caution toward discretionary spending and long-term purchases.

Housing markets mirror this shift in behavior. Sellers outnumber buyers by a wide margin, creating the largest recorded gap between supply and demand participants. 

Elevated mortgage rates continue to restrict affordability, while existing owners hesitate to reduce prices because of low-rate loans locked in earlier years. Listings remain visible, yet transactions slow as liquidity dries up. 

This imbalance delays price discovery and increases carrying costs for households and developers.

Employment weakness directly affects housing demand. Fewer stable incomes mean fewer qualified buyers, placing additional pressure on inventories struggling to clear. 

Together, labor deterioration and housing imbalance suggest that economic momentum is being supported by inertia rather than expanding demand, a condition that historically precedes slowdowns across consumption-driven industries.

Bond, Credit, and Inflation Signals Reinforce Economic Stress

Financial markets are reflecting stress through bond and credit indicators. The Treasury yield curve has entered bear steepening, where long-term yields rise faster than short-term rates.

Investors demand higher compensation to hold extended maturity debt, signaling concern over fiscal deficits and long-term growth expectations. Similar curve movements have preceded economic contractions in previous cycles.

Corporate credit conditions show parallel weakness. A rising share of lower-quality bonds now trades at distressed levels or faces elevated default risk. 

When financing tightens, firms cut costs, postpone investment, and reduce payroll. These actions feed back into employment and consumer demand, reinforcing pressure already visible in labor data.

Business bankruptcy filings continue to trend upward, reducing liquidity within supply chains and tightening lending standards across financial institutions. Inflation readings have shifted quickly, with real-time measures pointing toward levels near one percent. 

Rapid disinflation increases the risk that consumers delay spending in anticipation of lower prices, slowing transaction activity across goods and services markets.

Monetary policy remains focused on inflation control despite weakening forward indicators in labor and housing. A restrictive stance during slowing growth raises the probability of misalignment between financial conditions and economic capacity. 

Combined with credit strain and yield curve signals, the environment reflects fragility rather than expansion.

Key takeaways

• Privacy coins are just a step in a broader laundering pipeline after hacks. They serve as a temporary black box to disrupt traceability.

• Hackers typically move funds through consolidation, obfuscation and chain hopping and only then introduce privacy layers before attempting to cash out.

• Privacy coins are most useful immediately after a hack because they reduce onchain visibility, delay blacklisting and help break attribution links.

• Enforcement actions against mixers and other laundering tools often shift illicit flows toward alternative routes, including privacy coins.

After crypto hacks occur, scammers often move stolen funds through privacy-focused cryptocurrencies. While this has created a perception of hackers preferring privacy coins, these assets function as a specialized “black box” within a larger laundering pipeline. To understand why privacy coins show up after hacks, you need to take into account the process of crypto laundering.

This article explores how funds move post-hack and what makes privacy coins so useful for scammers. It examines emerging laundering methods, limitations of privacy coins like Monero (XMR) and Zcash (ZEC) as laundering tools, legitimate uses of privacy technologies and why regulators need to balance innovation with the need to curb laundering.

How funds flow after a hack

Following a hack, scammers don’t usually send stolen assets directly to an exchange for immediate liquidation; instead, they follow a deliberate, multi-stage process to obscure the trail and slow down the inquiry:

1. Consolidation: Funds from multiple victim addresses are transferred to a smaller number of wallets.

2. Obfuscation: Assets are shuffled through chains of intermediary crypto wallets, often with the help of crypto mixers.

3. Chain-hopping: Funds are bridged or swapped to different blockchains, breaking continuity within any single network’s tracking tools.

4. Privacy layer: A portion of funds is converted into privacy-focused assets or routed through privacy-preserving protocols.

5. Cash-out: Assets are eventually exchanged for more liquid cryptocurrencies or fiat through centralized exchanges, over-the-counter (OTC) desks or peer-to-peer (P2P) channels.

Privacy coins usually enter the stage in steps four or five, blurring the traceability of lost funds even more after earlier steps have already complicated the onchain history.

Why privacy coins are attractive for scammers right after a hack

Privacy coins offer specific advantages right at the time when scammers are most vulnerable, immediately after the theft.

Reduced onchain visibility

Unlike transparent blockchains, where the sender and receiver and transaction amounts remain fully auditable, privacy-focused systems deliberately hide these details. Once funds move into such networks, standard blockchain analytics lose much of their efficacy.

In the aftermath of the theft, scammers try to delay identification or evade automated address blacklisting by exchanges and services. The sudden drop in visibility is particularly valuable in the critical days after theft when monitoring is most intense.

Breaking attribution chains

Scammers tend not to move directly from hacked assets into privacy coins. They typically use multiple techniques, swaps, cross-chain bridges and intermediary wallets before introducing a privacy layer.

This multi-step approach makes it significantly harder to connect the final output back to the original hack. Privacy coins act more as a strategic firebreak in the attribution process than as a standalone laundering tool.

Negotiating power in OTC and P2P markets

Many laundering paths involve informal OTC brokers or P2P traders who operate outside extensively regulated exchanges.

Using privacy-enhanced assets reduces the information counterparties have about the funds’ origin. This can simplify negotiations, lower the perceived risk of mid-transaction freezes and improve the attacker’s leverage in less transparent markets.

Did you know? Several early ransomware groups originally demanded payment in Bitcoin (BTC) but later switched to privacy coins only after exchanges began cooperating more closely with law enforcement on address blacklisting.

The mixer squeeze and evolving methods of laundering

One reason privacy coins appear more frequently in specific time frames is enforcement pressure on other laundering tools. When law enforcement targets particular mixers, bridges or high-risk exchanges, illicit funds simply move to other channels. This shift results in the diversification of laundering routes across various blockchains, swapping platforms and privacy-focused networks.

When scammers perceive one laundering route as risky, alternative routes experience higher volumes. Privacy coins gain from this dynamic, as they offer inherent transaction obfuscation, independent of third-party services.

Limitations of privacy coins as a laundering tool

Privacy features notwithstanding, most large-scale hacks still involve extensive use of BTC, Ether (ETH) and stablecoins at later stages. The reason is straightforward: Liquidity and exit options are important.

Privacy coins generally exhibit:

These factors complicate the conversion of substantial amounts of crypto to fiat currency without drawing scrutiny. Therefore, scammers use privacy coins briefly before reverting to more liquid assets prior to final withdrawal.

Successful laundering involves integration of privacy-enhancing tools with high-liquidity assets, tailored to each phase of the process.

Did you know? Some darknet marketplaces now list prices in Monero by default, even if they still accept Bitcoin, because vendors prefer not to reveal their income patterns or customer volume.

Behavioral trends in asset laundering

While tactical specifics vary, blockchain analysts generally identify several high-level “red flags” in illicit fund flows:

• Layering and consolidation: Rapid dispersal of assets across a vast network of wallets, followed by strategic reaggregation to simplify the final exit.

• Chain hopping: Moving assets across multiple blockchains to break the deterministic link of a single ledger, often sandwiching privacy-enhancing protocols.

• Strategic latency: Allowing funds to remain dormant for extended periods to bypass the window of heightened public and regulatory scrutiny.

• Direct-to-fiat workarounds: Preferring OTC brokers for the final liquidation to avoid the robust monitoring systems of major exchanges.

• Hybrid privacy: Using privacy-centric coins as a specialized tool within a broader laundering strategy, rather than as a total replacement for mainstream assets.

Contours of anonymity: Why traceability persists

Despite the hurdles created by privacy-preserving technologies, investigators continue to secure wins by targeting the edges of the ecosystem. Progress is typically made through:

• Regulated gateways: Forcing interactions with exchanges that mandate rigorous identity verification

• Human networks: Targeting the physical infrastructure of money-mule syndicates and OTC desks

• Off-chain intelligence: Leveraging traditional surveillance, confidential informants and Suspicious Activity Reports (SARs)

• Operational friction: Exploiting mistakes made by the perpetrator that link their digital footprint to a real-world identity.

Privacy coins increase the complexity and cost of an investigation, but they cannot fully insulate scammers from the combined pressure of forensic analysis and traditional law enforcement.

Did you know? Blockchain analytics firms often focus less on privacy coins themselves and more on tracing how funds enter and exit them since those boundary points offer the most reliable investigative signals.

Reality of legitimate use for privacy-enhancing technologies

It is essential to distinguish between the technology itself and its potential criminal applications. Privacy-focused financial tools, such as certain cryptocurrencies or mixers, serve valid purposes, including:

• Safeguarding the confidentiality of commercial transactions, which includes protecting trade secrets or competitive business dealings

• Shielding individuals from surveillance or monitoring in hostile environments

• Reducing the risk of targeted theft by limiting public visibility of personal wealth.

Regulatory scrutiny isn’t triggered by the mere existence of privacy features, but when they are used for illicit activity, such as ransomware payments, hacking proceeds, sanctions evasion or darknet marketplaces.

This key distinction makes effective policymaking difficult. Broad prohibitions risk curtailing lawful financial privacy for ordinary users and businesses while often failing to halt criminal networks that shift to alternative methods.

Balancing act of regulators

For cryptocurrency exchanges, the recurring appearance of privacy coins in post-hack laundering flows intensifies the need to:

• Enhance transaction monitoring and risk assessment

• Reduce exposure to high-risk inflows

• Strengthen compliance with cross-border Travel Rule requirements and other jurisdictional standards.

For policymakers, it underscores a persistent challenge: Criminal actors adapt more quickly than rigid regulations can evolve. Efforts to crack down on one tool often displace activity to others, turning money laundering into a dynamic, moving target rather than a problem that can be fully eradicated.

A crypto blogger claiming to be Justin Sun’s ex-girlfriend has shared what appears to be a message from the Tron founder asking her to delete numerous articles while admitting that he “cherishes” their personal time together. 

Zeng Ying, otherwise known as Ten Ten, started making accusations against Sun last weekend, accusing him of manipulating the price of TRX with Binance accounts wash trading on his behalf, and also directing crypto accounts to spread misinformation about her.

Her latest post appears to reveal a message she received from Sun, in which he admits that he’s known her for many years and shared “very personal” experiences with her. 

In the alleged message, translated using Google, he tells Ten Ten that the two can “cherish” and “express” these experiences, but that they “shouldn’t become the subject of gossip.”

Read more:Justin Sun’s alleged ex accuses him of market manipulation, insider trading

“They are precious to us, but to onlookers, they are just something to amuse themselves and will soon pass.”

He additionally downplays her accusations as “online speculations and rumors,” and tells her that “Believing these rumors and harming your own health is the worst possible outcome.”

“I know you have something to say, but why not write it down and send it to me?” he asks. “Many things, when said aloud, might just be seen as a joke by others, but in the end, you’re often the one who gets hurt the most.”

In the message, Sun apparently also asks Ten Ten to delete some articles and replace them with different text. However, the screenshot shared online doesn’t reveal what specific text this would be. 

When sharing the message, Ten Ten said, “So you bought all those water army accounts to smear me, all to help me strengthen my body and build fitness, huh?”

Justin Sun denies all of Ten Ten’s claims

Sun claimed yesterday that “rumors regarding an ‘ex-girlfriend’ and our compliance status are unequivocally false.”

He claims that his firm “cooperates fully with global judicial and law enforcement agencies to crack down on embezzlement, fraud, hacking, other forms of cybercrime, to protect our users’ lawful assets.”

Ten Ten posted minutes later that, “Sun finally got hard for once — he never really got hard when we were together before. I’ll send the full verdict later.” This post was later deleted. 

Bitcoin’s next major catalyst may come from the common assumption being flipped on its head that interest rates are bullish for Bitcoin only when they fall, according to a crypto analyst.

“I think we should expect that having more accommodative policies may in fact actually not be the catalyst to help us go into a bull market,” ProCap Financial chief investment officer Jeff Park said during an interview with Anthony Pompliano on Thursday.

“We have to accept that reality and possibility,” Park said. Accomodative policies, such as lowering interest rates, are employed by the US Federal Reserve to stimulate economic growth, reduce unemployment, and increase liquidity. Bitcoiners often see these conditions as more favorable for riskier assets such as Bitcoin (BTC), as traditional investments like bonds and term deposits become less attractive.

Rising interest rates are usually seen as a negative for Bitcoin, but Park said that may not be the case forever. He said Bitcoin’s next biggest upside catalyst — and potentially its “endgame” — may be its entry into what he called a “positive row Bitcoin,” where the asset’s price continues to rise even as US Federal Reserve interest rates rise. 

“Perfect holy grail” for Bitcoin

“This is the mythical, elusive perfect holy grail of what Bitcoin is meant to be, which is when Bitcoin goes up as interest rates go up, which is very counterintuitive to the QE theory,” he said.