Bitget · 1703
Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker

Black eats black? Fake DeFi actually snatched out North Korea's Lazarus real hacker

Source: Security Company ANY.RUN Compiled by: Daily Planet Daily Original title: Fishing Show of the Year, Fake DeFi Picks Out North Korea's Lazarus, Real Madrid Fans, Real Madrid Fans. With a mathematical background, they only use AI to write code. Core point of view: By setting up a fake DeFi company, the security agency successfully infiltrated the “Famous Chollima” hacker group under North Korea's Lazarus Group, revealed its complete process of using false identities, AI tools, and remote collaboration to infiltrate Western companies, and revealed its evolving toolset and infrastructure. Key element: The researchers disguised themselves as recruiters and recruited three North Korean agents within a few months to record their operation behavior, tool usage, and collaboration patterns in real time through the ANY.RUN sandbox environment. Agents used forged driver's licenses, stolen social security numbers, and mule accounts to complete the onboarding process. Some of these documents were processed by Google Gemini and had SynthID watermarks, revealing signs of forgery. Attackers rely on AI tools such as ChatGPT and Google Gemini to encode, translate, and modify files, and use AstrillVPN, remote desktop software, and dedicated servers to covertly access corporate environments. The three agents showed insufficient skills during development, frequently searched for basic issues, and exposed more proxy server and infrastructure information induced by selective network outages and captcha. The investigation found that Famous Chollima aims to lurk within the enterprise for a long time and legally obtain access to code, systems, and intellectual property rights, and is not limited to short-term attacks, and the threat persists significantly. Crypto friends who are often phished have probably heard of the North Korean hacker group Lazarus Group. Its well-known “campaigns” include, but are not limited to: Bybit ($1.5 billion) theft, Ronin Network/Axie Infinity Bridge attack ($6.2 billion), DMM Bitcoin/Ginco related attack ($308 million), Harmony Horizon Bridge attack ($100 million), and Atomic Wallet attacks ($100 million), etc. And the key to the success of these attacks is social engineering — hackers usually disguise themselves as normal job applicants, lurk at crypto companies for years, and wait for the right time. Recently, security agency ANY.RUN joined forces with BCA LTD (a company dedicated to threat intelligence and hunting) and NorthScan (a threat intelligence program to uncover the infiltration of North Korean IT workers) to effectively crack down on North Korean hacker agents. The researchers created a fake DeFi startup and successfully recruited “Famous Chollima” agents under North Korea's Lazarus Group who specialize in human infiltration, to gain an inside perspective on the actions of North Korea's IT workers. The ANY.RUN sandbox environment shows the agent's behavior patterns in real time, revealing their evolving toolsets, remote access workflows, AI tool usage, and supporting infrastructure. This survey went beyond the simple recruitment process and showed in depth how these agents collaborated, obtained, and used company resources after joining the company. The findings suggest that the North Korean IT worker program not only poses a recruitment risk; once agents sneak inside the organization, they can legally obtain access to code, systems, intellectual property, and critical business processes. The following is a report co-authored by the three parties, compiled by Daily Planet Daily. ——————Introduction In December of last year, we fully recorded the infiltration cycle of “Famous Chollima” for the first time. From recruiting collaborators to help them join Western companies, to falsifying documents, shipping laptops to intermediaries, and even using AI tools to assist and translate in real time during interviews, everything is under control. In that survey, we pretended to be a middleman willing to interview them and lend them a laptop in exchange for a percentage of their salary. The point is that those laptops are actually ANY.RUN sandbox environments that record every click and every step they take. This provided us with massive metrics, hours of computer operation videos, and face-to-face contact images, making an unprecedented survey and making headlines in many media. (“Famous Chollima...

1d agoOdaily星球日报#wallet security #hacks

RootData stock derivatives exchange data: Top 5 turnover falls across the board, crypto market recovers or diverts liquidity

Comparative news, according to RootData's latest stock derivatives exchange rankings, the 24h turnover of the Top 5 exchanges declined across the board. Binance's 24h turnover was about $21.03 billion, a decrease of 31.04%; OKX's turnover was about $4.7 billion, a decrease of 41.39%; Gate's turnover was about US$2.805 billion, a decrease of 43.16%; Hyperliquid's turnover was about US$3.681 billion, a decrease of 31.01%; and Bitget's turnover was about US$2.2 billion, a decrease of 26.92%. Meanwhile, positions in the crypto native contract market have increased significantly. According to Coinglass data, the total Bitcoin contract holdings were about 734,900 BTC (about 54.967 billion US dollars), an increase of 5.65% over 24 hours; total Ethereum contract holdings were about 13.1407 million ETH (about US$30.917 billion), an increase of 5.17% over 24 hours.

1d ago

Bitget CFD Chief Analyst: FOMC minutes are hawkish, and the market focuses on high interest rates for longer

Comparing news, Lewis Huang, chief analyst of Bitget CFD, said in a live broadcast yesterday that the minutes of the Federal Reserve's July FOMC meeting overall sent an eagle signal. Despite keeping interest rates unchanged at this meeting, many officials emphasized that if inflation does not continue to fall back to the 2% target, further policy tightening or even raising interest rates again is still a viable option. This means that the market should not simply trade expectations of interest rate cuts in the short term, but should re-evaluate the impact of “maintaining high interest rates for longer” on the US dollar, US bond yields, gold, and US stock valuations. Lewis Huang pointed out that the future direction of the market will be determined by a combination of inflation and employment data: if CPI, PCE, or wage data rises and the job market remains resilient, US dollar and US bond yields may strengthen, and highly valued assets such as gold and Nasdaq 100 may be under pressure; conversely, if inflation cools down significantly and employment and consumption weaken at the same time, the market will once again raise the Fed's easing expectations, and gold, non-US currencies, and risk assets are expected to be supported. He recommended that CFD traders focus on the trend of US two-year treasury bond yields, the US dollar index and gold, wait for price breakouts and retracement confirmation after major data is released, avoid chasing the first wave of fluctuations, and strictly control leverage and stop-loss risks.

1d ago
Millions of dollars are rushing into the market, but some are in a hurry to exit: Pharos's high-interest treasury causes a “view of time” collision

Millions of dollars are rushing into the market, but some are in a hurry to exit: Pharos's high-interest treasury causes a “view of time” collision

Article: Sanqing, Foresight NewsSharos Network joined forces with Vault infrastructure agreement R25 and credit asset management agency Axil to launch Axil Prime Credit Vault (APC), an institutional consumer credit RWA wealth management product issued by Pharos on July 15. The products were launched simultaneously with Binance Wallet, TopNod, OKX Wallet, Bitget Wallet, and KuCoin Wallet, with a total fundraising limit of 100 million USDC, with a target annualization of about 14.3%. As of the closing of the deposit window, a total of $45.39 million had been deposited. This year, there have been frequent security explosions in Web3 on-chain strategies. User funds are looking for new stable income sources, and project parties are also there. Binance Wallet is now offering an additional $300,000 PROS as an incentive to explore RWA Vault's market space, causing the Vault to generate a lot of discussion in the market. The launch time coincided with the redemption period of the Pharos TGE pre-deposit campaign. The previous treasury required the submission of a redemption application about half a month before the end of the lockdown period, stop accruing interest on July 20, and complete the redemption within 7 days. Users accustomed to DeFi T+0 looked back and found that they couldn't help but missed the redemption period and began to question the redemption time and asset safety. R25 and Axil then held an AMA at Binance Square. Well-known KOLs such as Haotian and Tianqing participated in discussions, detailing the differences between RWA assets and DeFi Vault, the role of fund managers (Curators), why consumer credit is worth allocating, and risk management methods from pre-investment to post-investment. In complex asset logic and mixed social media discussions, some users put in one million funds on the last day, while others sought early redemptions from the project party. On July 23, Pharos issued an announcement: Users who submitted applications on time in the previous issue have received all principal and interest, breaking the “financial security” concerns; funds that missed the window will automatically be carried forward to the next three-month cycle according to the treasury's preset rules, and interest will continue to be accrued at 14% USDC per annum. The controversy revealed more important issues than the redemption itself. Although the RWA TVL has exceeded $38 billion, non-institutional chain users are clearly dissatisfied when investing in RWA products. Institution-driven, stable, and high interest rates, but often require longer lockdown periods and complex understanding costs. From DeFi to RWA, is the market really ready? High yield, low threshold, and high liquidity. BlackRock's “impossible triangle” of RWA's BUIDL threshold is $5 million. It is only open to qualified buyers, yet it can be redeemed almost instantly through the stablecoin channel; the APC threshold is so low that ordinary users can buy it at will; instead, it must be locked for three months. Liquidity has never been determined by how high or low the threshold is, but rather how quickly the underlying assets can be realized. The bottom layer of BUIDL is US treasury bonds, and the world's deepest secondary market can take over at any time; the bottom layer of APC is hundreds of thousands of emerging market consumer loans, and few people are ready to buy large amounts of capital at any time. This has formed a triangle that RWA cannot bypass at this stage: high yield, low threshold, and high liquidity; the three can only take two. For example, Franklin Templeton's BENJI starts at $20 (low threshold) and supports daily redemption (high liquidity), and the annualization is only 3% to 5%; if you want double-digit returns, you have to accept non-standard assets and a lock-up period. This is the liquidity premium. A significant portion of the excess income is the consideration for abandoning liquidity. APC, on the other hand, is a combination of high returns and a low threshold, and the cost is liquidity. There is nothing wrong with this trade-off itself; it also explains the full source of this controversy. Retail investors have obtained assets that were originally only open to institutions, and they have also taken over the agency's time rules that focus on long-term matching. The period of use of institutional funds is scheduled before investment, and the lockdown period is a predictable cost; private equity credit and closed-end funds already have redemption restrictions. However, most ordinary users on the chain are not the same; most of the latter's first appeal is to go in and out. So the current “retail” RWA is mostly just distribution-side retailing, to be precise. Web3 wallets and low initial investment amounts have contributed to a low threshold, but the liquidity structure is still designed according to institutional logic. Having understood this triangle, the remaining questions became specific: why must the liquidity side be sacrificed, a high income of 14.3%...

2d agoForesight News#WEB3

RootData tokenized asset data: Binance, Hyperliquid, and Bitget rank in the top three OIs for TradiFi asset contracts

In comparison, according to the latest data from the RootData tokenized asset board, the top three asset contract OIs for TradiFi are Binance, Hyperliquid, and Bitget. Binance ranked first with a contract OI of approximately $3.74 billion, with a market share of 43.4%. Hyperliquid ranked second with a contract OI of approximately $1.89 billion, with 22.0% market share. Bitget ranked third with a contract OI of approximately $855 million, with 9.9% market share. The total market share of the three companies is about 75.3%. According to reports, this TradiFi asset statistics only includes cryptographic native asset types such as contracts and tokenization, and does not include traditional stock broker data.

2d ago

Bitget Research Institute: Policy and regulation are catalyzing the crypto market to enter a new turning point

Comparing news, yesterday the crypto market welcomed the strongest single-day market in the coming year. Bitcoin hit a high of $70,000 for the first time in two months; Ethereum climbed $2,300; and Solana rose about 12%. According to an analysis by the Bitget Research Institute, the core driving force of this round comes from both policy and regulatory breakthroughs: the White House summoned talks between the President, crypto industry executives, and SEC and CFTC leaders, marking that digital assets have officially entered the national financial strategy discussion level; the SEC proposed “Regulation Crypto Assets” on the same day, establishing clear channels for token financing and introducing an “safe haven for investment contracts” mechanism for the first time, which is expected to drive the emergence of more native US projects. Judging from the market structure, when the first two catalysts were launched, the market was in an empty position state, and rising prices triggered chain liquidation. On the same day, 126,000 traders across the network, with a total of 1.92 billion US dollars in positions bursting out, set the largest short liquidation day in history, further amplifying the increase. Bitget Research believes that since a significant percentage of the increase in this round comes from concentrated liquidation of short orders rather than spot purchases, there is pullback pressure on the market in the short term. However, in the medium to long term, the crypto market is facing a double turning point in policy and liquidity. Clarification of regulatory paths, combined with improvements in the long-term liquidity environment, have formed the foundation for a new cycle.

2d ago

Mysterious address cluster withdraws $51.4 million worth of monster coins BTW in the early morning

In comparison, according to monitoring by on-chain analyst Ai Ai (@ai_9684xtpa), five addresses proposed $51.4 million BTW from Bitget in the past 9 hours, and the price of the coin soared to a maximum of 770% in August. It should be pointed out that the withdrawal time was 01:36 to 03:07 this morning. BTW was falling sharply during this period ($0.6727 rapidly fell to $0.3130 at 23:40, a decrease of 53.4%). Currently, 150 million tokens have not been transferred or sold.

2d ago