An attacker drained 99.7% of the XRP reserve backing the Coreum cross-blockchain bridge on August 9 by conjuring fake evidence of deposits that fooled the bridge’s own operators into authorizing real withdrawals.

Nobody stole anyone’s private key to execute the clever hack. Instead, Coreum’s bridge liquidity account paid out 199,916 XRP worth over $200,000 across 94 transactions, each one carrying a majority of signatures from its own relayers. 

Hours later, Coreum was shocked to discover it held just 493 XRP worth roughly $500.

A memo was all Coreum’s bridge required

The relayer software watched the bridge account’s history for payments carrying a Coreum recipient memo.

It never verified that payment destination. A seemingly valid memo existed, yet the destination was the hacker’s wallet.

Ostensibly independent operators reached identical conclusions and signed off on all of the withdrawals because they were all running the same buggy code.

Read more: XRP Ledger generated less than $400 in fees yesterday

TX confirms an FBI report

TX, a brand that absorbed both the Coreum and Sologenic communities in February, confirmed the incident, and admitted the software “incorrectly registered transactions that never actually delivered any XRP to the bridge as deposits, and minted bridged XRP on the tx chain against them.”

Advertisement

The same statement said the bridge had undergone “multiple internal and third-party audits prior to deployment.”

It also conceded that bridged XRP on the tx chain “is not currently fully backed,” and confirmed a complaint had gone to the FBI.

The price of XRP dipped below $1 yesterday, its first sub-dollar print since November 2024. The coin has lost 45% of its value this year, and is 74% below its all-time high.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

Russia’s central bank will allow retail investors to only trade bitcoin BTC$64,148.66, ether ETH$1,912.59 and USDT on regulated exchanges, making Tether’s dollar-linked token the only stablecoin on the initial list.

The draft rules would limit non-qualified investors to 300,000 rubles (around $3,600) of crypto purchases per year at each intermediary. Qualified investors wouldn’t face the cap.

The whitelist adds detail to legislation passed in July that opens regulated crypto trading from Sept. 1 but did not specify which assets retail investors could buy. Crypto payments inside Russia remain prohibited.

The wording sets the 300,000-ruble limit per intermediary rather than across an investor’s total purchases, potentially allowing larger aggregate exposure through multiple brokers or exchanges.

It isn’t often that a reporter gets asked to pose as a venture capitalist to fool suspected North Korean IT workers.

But in June, I found myself joining a Zoom call as “Aelin Ashriver,” an investor from the fictitious Definitive Communications, to meet the development team of crypto startup Ballena Azul.

The IT workers on the call believed they were pitching for VC backing for their startup. In reality they had spent weeks working inside a fake crypto company set up purely to study their methods and infrastructure by Mauro Eldritch, founder of cybersecurity firm BCA LTD, and Heiner García, a cyber threat intelligence analyst at Telefónica Tech and founder of NorthScan.

Cointelegraph tagged along for one stage of the investigation.

During the call, I played up the ruse by suggesting I might even be able to land Ballena Azul some coverage in Cointelegraph.

So at least someone was telling the truth.

Suspected DPRK IT workers pitch for venture capital backing from the fictitious Definitive Communications, played by Cointelegraph. Source: ANY.RUN

Building a company for suspected North Korean IT workers

Eldritch and García built the fictitious Ballena Azul with infrastructure provided by cybersecurity platform ANY.RUN. An existing UK registration for an unrelated company of the same name, which was dissolved in 2022, added legitimacy to the project.

Eldritch assumed the identity of co-founder “Leonardo Nelson,” while García took on the alias “Andy Jones” and posed as the company’s team lead.

Related: North Korean cyber spies are no longer just remote threats

One of the most valuable pieces of intel that the five-week ruse exposed were the external servers the workers used as intermediary points before connecting to Ballena Azul’s controlled virtual desktops.

Exposed servers were particularly valuable because such infrastructure is often recycled across operations and can remain active for long periods.

García tells Magazine the servers were associated with malware families linked to North Korean campaigns that steal credentials, crypto wallet data and other sensitive information.

“Some of the servers we found were tied back to distributing InvisibleFerret and BeaverTail/OtterCookie in prior years and were active to this day,” he says.

But some others were totally new and had zero intelligence about them, looking clean and keeping outside of mainstream block lists or threat feeds.”

He adds that the infrastructure could serve multiple purposes, with servers previously used for malware distribution also acting as command-and-control infrastructure, and as proxies for operators carrying out their day-to-day work.

The suspected workers do not need to deploy malware to pose a threat, according to the researchers. Once hired, they can gain legitimate access to a company’s internal systems, source code and other sensitive information. The longer they remain undetected, the longer they can continue drawing salaries that researchers say ultimately help fund the North Korean regime.

The operation also showed the group relied on artificial intelligence tools to help compensate for gaps in their technical knowledge. They used ChatGPT for writing and coding, including to answer basic questions and complete assignments they struggled with themselves. They preferred Google Gemini for image alteration and document forgery.

A suspected DPRK IT worker and ChatGPT team up in an attempt to obtain testnet crypto during the Ballena Azul operation. Source: ANY.RUN

Other tools employed included remote desktop software, crypto wallets and a service for sharing two-factor authentication codes.

North Korean IT workers have become a growing cybersecurity threat to the cryptocurrency industry. Consensys said in July that it had engaged a North Korea-linked developer through a third-party service provider before identifying the threat and cutting off access.

In another case, US prosecutors charged four North Korean nationals in 2025 with using false identities to obtain remote IT jobs and allegedly stealing more than $900,000 in cryptocurrency from two companies, including a US blockchain research and development firm.

The US Treasury said in March that North Korean IT worker schemes generated nearly $800 million in 2024 to help fund the Pyongyang regime’s weapons-of-mass-destruction programs.

Inside fake crypto company Ballena Azul

The ruse began when García connected with a recruiter via GitHub, who had been linked to Famous Chollima, a threat group associated with North Korean IT worker operations.

García said that Ballena Azul needed to hire software developers and the recruiter offered up “Jack Anderson,” “Angelo Espree” and “Lucas Theo.” At least two of them presented US identification.

The trio were given various programming assignments inside controlled virtual desktop environments, which allowed García and Eldritch to observe how they worked.

Angelo Espree was one of the developers onboarded through a recruiter associated with DPRK operations. Source: ANY.RUN

The researchers also deliberately introduced technical problems, including selective network outages and disappearing mouse cursors, to see how the suspected workers reacted and which tools they turned to when things went wrong.

“Honestly, the biggest surprise was how much of it ran on improvisation,” García says. “There was no rigid playbook, no polished corporate process behind them.”

During their many weeks working inside the controlled environments, the suspected North Koreans left behind a treasure trove for the researchers, including chat logs, AI conversations, crypto wallet information, VPN exit nodes and hours of live video footage. Their connections also exposed the servers that became one of the investigation’s most valuable findings.

To be sure, the heavy AI reliance isn’t unique to the workers hoodwinked in Ballena Azul’s operation. 

Ballena Azul workers generally used AI as a crutch for coding and technical tasks they struggled with. Reuters reported Monday that another North Korean hacking group, Kimsuky, was using AI for a more offensive purpose. The group was reportedly running AI tools locally to help automate cyberattacks, analyze stolen data and produce more convincing phishing campaigns.

Evolving playbook of remote DPRK IT workers

This was not the first time Cointelegraph has played a minor role in exposing suspected North Korean workers.

In February 2025, García and Cointelegraph conducted a job interview for a suspected operative calling himself “Motoki.” The developer claimed to be Japanese but ragequit the interview after being asked to introduce himself in his mother tongue.

Still, García kept communicating with him. Motoki eventually offered to send García money to buy a computer that he could access remotely, allowing him to work through a local machine instead of connecting through a VPN to bypass restrictions used by employers and freelance platforms.

Related: From Sony to Bybit: How Lazarus Group became crypto’s supervillain

García later documented suspected North Korean operatives recruiting freelancers to provide verified accounts, identities and remote access to their computers. In one version of the scheme, operatives could work through machines physically located in the US, making them appear to employers and freelance platforms as US-based contractors.

In May, two US “laptop farmers” — people who hosted a cluster of computers that North Koreans could remotely access — were sentenced to 18 months in prison for helping DPRK IT workers pose as US-based employees in schemes that generated more than $1.2 million and affected nearly 70 companies.

Taking Ballena Azul down

All fake things must come to an end, so the researchers introduced “Benito Camella,” Ballena Azul’s co-founder, who had supposedly been focused on other business in Milan while the company expanded.

When he returned, Camella confronted the workers over discrepancies in their identities and documents. The confrontation quickly began to clear the chat room. Espree left the video call first, while Anderson stayed longer before realizing the scheme was unraveling.

“Are you living two lives, Mr. Anderson?” Camella asks Jack Anderson during the confrontation. Source: ANY.RUN

But the researchers kept the deception going even after the meeting ended. In the company’s Telegram channel, the “CEO” accused “Andy Jones” of bringing in “illegal workers” and putting the company at risk. “Jones” responded that he had been under pressure to build a team quickly and was not being paid enough to do it. He maintained that he had done the best he could with what he had.

The staged argument ended with the fake CEO terminating both their working relationship and friendship, keeping up the appearance that Ballena Azul had collapsed because of a disastrous hiring decision.

One of the suspected North Koreans later contacted García privately to apologize for what had happened and ask whether he was all right.

According to the researchers, they never heard from the rest of the group again.

To this day, they say, the suspected workers do not know they wasted weeks working inside an environment built to extract intelligence from them.

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?

Editor’s note: Cointelegraph could not independently confirm the nationality or affiliation of the suspected DPRK IT workers, and no government agency has publicly identified them.

Bitcoin (BTC) transaction fees now account for just 0.69% of miner revenue as major players pivot to AI.

Key points:

• Bitcoin miners now rely on block subsidies more than at any time in the past decade, data shows.
• Bitcoin hash rate has declined by 33% since October 2025.
• Analysts warn that miners switching to AI could affect the network.

Bitcoin miner fee revenue share returns to 2016 levels

Data from onchain analytics platform Glassnode shows that fees as a proportion of miner revenue remain near decade lows after falling to just 0.52% in April.

Miners face ongoing pressure as declining Bitcoin prices and rising electricity costs squeeze profits and force smaller players out of the market. Glassnode co-founder Rafael Schultze-Kraft noted that fees had made up less than 1% of miner revenue for almost a year.

“Bitcoin was below $400 the last time fee share was this low,” he said on X. 

Bitcoin fees as a portion of miner revenue. Source: Rafael Schultze-Kraft on X.com

When transaction fee revenue drops, miners increasingly depend on the fixed block subsidy for income — the amount of newly minted BTC awarded for each mined block, currently 3.125 BTC. Bitcoin’s value has fallen nearly 50% since its October 2025 all-time high, dragging down the US dollar value of the block subsidy and further squeezing miners’ profit margins.

The latest data from onchain analytics resource Checkonchain puts the estimated average cost of producing one Bitcoin at $78,254 as of Tuesday — almost 23% above the current spot price.

Bitcoin estimated average production cost. Source: Checkonchain

Bitcoin’s network hash rate, an estimated measure of the computing power securing the network, reflects a mining sector in flux. Hash rate has declined from its October 2025 peak of 1.3 zettahashes per second (ZH/s) to 861 exahashes per second (EH/s), Checkonchain shows — a drop of 33%. 

Bitcoin hash rate net position change. Source: Checkonchain

Analyst: AI pivot is “concerning development”

In analysis published at the weekend, independent analyst William Clemente acknowledged the downturn, while noting that miners would have been incentivized to boost activity through automated difficulty readjustments. With difficulty itself now rising again, miners’ shift toward more lucrative AI computing has become conspicuous.

Related: Bitcoin sell pressure ‘closer to exhaustion’ after $4B USDT market-cap drop: CryptoQuant

“There is no other way to slice it, hash rate has been in a decline. This has taken place as miner margins got squeezed post 2022 from more competition are higher energy prices, but more importantly the pivot of many into AI/HPC, which so far have shown to be prudent business decisions for the public names that have done it,” he wrote.

As Cointelegraph reported, Bitcoin miner CleanSpark recently refocused on AI, switching to operating data centers after missing profit targets. Another miner, Keel Infrastructure, shut down all its US mining operations after revenue fell 50% in the second quarter.

“This dynamic has been reinforced as Bitcoin has underperformed AI related assets & the rate of change in demand for compute,” Clemente added.

Charles Edwards, founder of hedge fund and AI platform Capriole Investments, directly linked the drop in hash rate to public miners’ AI pivot.

“This is the least talked about, concerning Bitcoin development in 2026,” he argued on X, noting that the trend had accelerated since April.

Binance and RedotPay are disputing whether a Singapore case related to their nearly $473 million Hong Kong legal battle is coming to an end.

The stablecoin payments card issuer told Cointelegraph on Tuesday that it expects Binance to discontinue the Singapore proceedings following a hearing on Aug. 7. “RedotPay will be seeking legal costs arising from the discontinuance of the matter from the claimant,” a spokesperson for RedotPay said, adding that the parties would try to agree on costs.

However, Binance said it has no plans to abandon its claims. “Reports that Binance will be withdrawing its Singapore claims are false,” a Binance spokesperson told Cointelegraph, adding that the company “is not abandoning its claims and has informed both the court and RedotPay accordingly.”

The disagreement marks the latest development in a broader legal fight between Binance-affiliated companies and RedotPay, which includes a separate Hong Kong case seeking nearly $473 million in damages.

Singapore case part of broader legal fight

Binance-linked legal action against RedotPay first made headlines on Aug. 5, when Bloomberg reported that Nest Trading, DistributedTechnologies and Chaintecs Consulting Singapore had filed a petition in Hong Kong against RedotPay’s co-founders.

The Hong Kong plaintiffs allege RedotPay diverted more than 470,000 Binance Card users by allowing Binance Pay funds to be used for stablecoin card top-ups outside the terms of a commercial agreement. They estimated damages at $472.8 million, based on a claimed lifetime customer value of $925 per user.

Chaintecs also brought related proceedings against RedotPay affiliates in Singapore, where a hearing was scheduled for Aug. 7.

RedotPay rejected what it called “unfounded allegations” against the company and its co-founders at the time, telling Cointelegraph it would defend the claims through the legal process.

RedotPay announced its Binance Pay partnership in December 2023, allowing Binance Pay users to make direct deposits to RedotPay cards. Binance ended support for the integration as of April 3, 2026, citing a review of its merchant partners, months before the legal dispute became public.

Magazine: Fierce backlash to Ethereum’s EIP-8363 staking proposal

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Germany’s benchmark index just made history, breaking above 26,500 for the first time ever, extending a rally that has already delivered close to 10% over the past twelve months. The move came on fresh optimism around a potential resolution to the Iran conflict, though that optimism proved short-lived: President Trump’s latest demands, that Tehran compensate for lives lost in recent attacks, have since added friction to already fragile diplomatic efforts around reopening the Strait of Hormuz, and the index has pulled back modestly from its peak.

Beneath the geopolitical noise, the underlying story remains genuinely constructive. Stronger-than-expected industrial production and export data have reinforced confidence in German manufacturing, while a wave of solid corporate earnings, alongside notable strength from SAP and Infineon, has kept sentiment firmly bullish. Roughly a third of this year’s growth still owes to calendar effects and government stimulus in defence and infrastructure, a detail worth remembering, but private-sector momentum finally looks like it’s stabilizing rather than collapsing.

The result: a record-breaking index now testing whether Middle East headlines can derail a rally built on genuinely improving fundamentals.

Technical Analysis of the DAX 40 (GDAXIm on FXOpen)

As the daily DAX 40 (GDAXIm on FXOpen) chart shows, the index remains firmly within a well-defined ascending channel that has guided price higher since April, with the index now testing the channel’s upper boundary near current record highs. The 50-period EMA continues to trend higher well below price, reinforcing the strength of the broader uptrend, while the RSI sits at 67.83, comfortably bullish without yet flashing overbought extremes.

Bullish Scenario

Should buyers maintain momentum and break above the upper channel trendline, the index would confirm a genuine acceleration of the current trend, opening the door toward fresh uncharted territory beyond 26,800, with the EMA and lower channel boundary offering strong support on any pullback.

Bearish Scenario

Conversely, a rejection at the upper trendline could see price pull back toward the 50-period EMA near 25,450, or even the lower channel boundary, without necessarily threatening the broader bullish structure. Only a decisive break below the channel itself, and the 23,600-23,800 support zone that anchored April’s advance, would put the medium-term uptrend genuinely at risk.

With price testing the top of a channel that has held for nearly five months, the DAX 40 (GDAXIm on FXOpen) faces a familiar question: does the trend simply extend once again, or is this finally where momentum starts to fade?

Trade global index CFDs with zero commission and tight spreads (additional fees may apply). Open your FXOpen account now or learn more about trading index CFDs with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Crypto markets were steady on Wednesday as traders absorbed a protocol exploit while waiting for a U.S. inflation report that often sets the tone for risk assets.

Harmony, a layer-1 blockchain network for DeFi protocols and marketplaces. confirmed it had been hit by an exploit early in the Asian day. An attacker minted some 4 billion ONE tokens through empty blocks, representing about 26% of the token’s circulating supply.

Around 2.8 billion of the tokens were quickly funneled to exchanges, pushing ONE down as much as 40% to a record low.

Broader markets were also little changed before the July U.S. CPI print, due at 12:30 UTC. Brent crude is near $90 a barrel after more Houthi attacks on shipping in the Bab el-Mandeb Strait and a U.S. strike on a vessel in the Gulf of Oman renewed supply concerns overnight.

Bitcoin BTC$63,726.88 absorbed all of this quietly, adding 0.23% since midnight UTC to around $63,900. The Fear and Greed index is at 38.

Derivatives positioning

• Futures market stasis masks a bearish shift in taker sentiment: While the aggregate crypto futures market appears to be in stasis, with negligible changes in total volume and open interest, underlying positioning is shifting. The long-short ratio for takers, or those executing market orders that remove liquidity from the book, has flipped bearish, with shorts now accounting for 51.36% of activity. This is a 180-degree reversal from the bullish bias observed earlier in the week.
• Avalanche shows signs of aggressive shorting as open interest climbs: The AVAX token has emerged as one of the largest laggards among the top 100 coins over the past 24 hours, even as open interest (OI) grew 6%. A combination of falling prices and rising OI validates the current weakness in the spot price. Confirming this trend is the 24-hour cumulative volume delta (CVD), which is the most negative among major assets, suggesting that bears are aggressively shorting via market orders rather than utilizing passive limit orders.
• Dogecoin leverage builds toward a potential volatility breakout: Open interest in DOGE futures continues to climb, surpassing 17.2 billion tokens, the most since October. This significant growth from the June low of 12 billion tokens occurred while the price remained pinned near the 7-cent mark. The buildup of leverage amid sideways price action suggests that the market may be coiled for a significant volatility event in the near term.
• Major assets see light positioning: Market participation in the two largest cryptocurrencies remains subdued, with bitcoin’s open interest hovering below 750,000 BTC. This lack of momentum has persisted for several weeks, and a similar trend is visible in ether ETH$1,889.28, indicating that institutional and retail traders alike are currently sidelined in the majors.
• Selling pressure dominates the altcoin market according to CVD trends: Most of the 25 largest cryptocurrencies are exhibiting negative 24-hour cumulative volume deltas. This widespread selling pressure indicates a general bearish tilt across the sector, with Chainlink LINK$8.8372, Cronos CRO$0.04705, and Tron TRX$0.3359 being the only notable exceptions.
• Implied volatility remains depressed ahead of key U.S. inflation data: Bitcoin’s 30-day implied volatility index, BVIV, is back under pressure, receding to 37.5% from Monday’s high of 38.66%. Short-dated one-week implied volatilities also remain at low levels, signaling that options traders are not anticipating significant changes following the U.S. CPI release. This suggests the market may be underpricing the actual event risk.
• Options traders eye the $70,000 level while hedging for volatility: In the Deribit bitcoin options market, the $70,000 call remains the most actively traded contract for the second consecutive day. Simultaneously, there is a growing preference for BTC strangles, a strategy involving the simultaneous purchase of puts and calls, indicating that some participants are positioning to profit from a sharp move in either direction.

Token talk

• CRV is the week’s standout performer, up roughly 35% over seven days and trading around 28 cents. The move coincides with a 15% annual emissions reduction that is set to trigger imminently. It has risen by more than 3% since midnight UTC.
• Uniswap (UNI) has tumbled by more than 10% over the past 24 hours with no clear catalyst for the slide, suggesting the altcoin market remains vulnerable to price swings due to limited liquidity and market depth.
• Monero (XMR) is up by 5.8% since midnight and has now retraced Tuesday’s entire shift to the downside.
• AI tokens NEAR, FET and TAO are all also in the black, up by between 1.3% and 2.3% respectively as AI-themed optimism slowly returns to the market after months of waning sentiment.