News Heat Trend
Project Overview
Telegram Messenger is a globally accessible freemium, cloud-based and centralized instant messaging (IM) service. The application also provides optional end-to-end encrypted chats (popularly known as "secret chats") and video calling, VoIP, file sharing and several other features.Telegram was launched in 2013 by the brothers Nikolai and Pavel Durov. Previously, the pair founded the Russian social network VK.
AlphaTON Capital Plans to Raise $43 Million to Expand AI Computing Infrastructure
According to The Block, AlphaTON Capital has announced plans to raise $43 million through a strategic partnership with Vertical Data Inc. to expand its AI compute infrastructure; the transaction is expected to close in Q2 2026. AlphaTON CEO Brittany Kaiser stated that the funding will be used to deploy additional NVIDIA B300 GPUs, with the core objective of advancing the convergence of AI, digital assets, and confidential computing—and scaling up the platform’s overall compute capacity. On the business front, AlphaTON not only holds a substantial amount of TON tokens as corporate treasury assets but also actively participates in building infrastructure for the Telegram and TON ecosystems, with key investment focus areas including Cocoon, Telegram’s decentralized AI platform. Background-wise, AlphaTON was formed through the restructuring and transformation of former biotech public company Portage Biotech Inc., which had previously focused on cancer therapy research; the company completed the spin-off of its cancer therapy subsidiary in February this year.
AlphaTON and Vertical Data Announce $43 Million AI Infrastructure and Financing Partnership
AlphaTON Capital (NASDAQ: ATON) announced a strategic AI hardware and financing agreement with Vertical Data Inc., with a total transaction value of approximately $43 million, expected to close in Q2 2026. The agreement centers on deploying high-performance GPU clusters powered by NVIDIA’s B300 architecture. Financing will be provided through Vertical Data’s GPUfinancing.com platform via an asset-backed, non-recourse structure and includes managed infrastructure services. This expansion will support AlphaTON’s business initiatives with partners including Telegram, Gamee, Animoca Brands, and Midnight Blockchain.
ZachXBT Goes Undercover in Lazarus Group-Linked Money Laundering Ring: Invested Nearly $3.5 Million in OTC Trades with Counterparty Using the Alias Jimmy Green
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
布鲁克林男子因加密货币诈骗近 1600 万美元被判最高 12 年监禁
据布鲁克林地区检察官 Eric Gonzalez 宣布，布鲁克林男子 Ronald Spektor（23 岁）因实施大规模 Coinbase 网络钓鱼诈骗，于 2026年 9月 23 日被布鲁克林最高法院判处 4至 12 年有期徒刑。 Spektor 冒充 Coinbase 客服代表，以"账户遭黑客攻击"为由，诱骗全美约 100 名用户将加密资产转入其控制的钱包，累计盗窃金额约 1594.4 万美元。被盗资产随后经多个加密交易所反复兑换洗钱，最终流向赌博平台、礼品卡及数字资产购买渠道。 Spektor 在 Telegram 频道"Blockchain enemies"中以 @lolimfeelingevil 为昵称公开炫耀犯罪所得，并招募他人协助实施社会工程攻击。调查人员通过区块链分析、数字取证及多项搜查令，将其家庭 IP 地址与多个被盗钱包关联，最终锁定其身份。 Spektor 已就全部 31 项指控认罪，包括一级洗钱罪、一级重大盗窃罪等，并被命令没收逾 50 万美元资产，同时赔偿受害者近 1600 万美元。
HBO Max Reddit Account Hijacked, 108 Malicious Ads Pushing Infostealer Malware Deployed Over 48 Hours
Odaily reports: Earlier this month, the verified Reddit account of streaming service HBO Max was hijacked by hackers, who deployed 108 malicious ads over approximately 48 hours, tricking Mac and Windows users into executing commands to install infostealer malware.The malware can steal browser credentials, Telegram data, Apple Notes, saved passwords, and crypto wallet recovery phrases, and may also alter wallet addresses in the clipboard. Reddit has suspended the relevant ads and launched a security investigation. The number of infections and crypto asset losses have not yet been confirmed. (Decrypt)
US Department of Justice Has Frozen Approximately $938 Million in Fraud-Related Crypto, With About $52 Million Added in a Single Day
Odaily News: In an operation targeting the Telegram crypto escrow trading platform Xinbi Guarantee, the U.S. Department of Justice's Scam Center Strike Force restricted the handling of approximately $52 million in fraud-related cryptocurrency in a single day, bringing the cumulative total to approximately $938 million. Previously, the cumulative amount frozen, seized, or recovered had already exceeded $580 million.The U.S. Department of the Treasury stated that since its founding around 2022, Xinbi Guarantee has processed over $24 billion in transactions, involving digital assets and fiat currency, primarily serving Southeast Asian transactions. North Korean hackers and sanctioned entities are alleged to have used the platform, including entities under Jin Bei Group and Prince Group.A U.S. federal court approved the seizure on September 7 of the Telegram channel operated by Xinbi Guarantee. Law enforcement authorities also seized two payment wallets totaling approximately $12 million and applied to freeze another 47 cryptocurrency wallets suspected of being used for money laundering or associated with fraud-related service providers.The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) added Xinbi Guarantee and its two supporting companies, Safew Technology and Anwen Technology, to its sanctions list on September 9. The U.S. Department of Justice also dispatched investigators to Madagascar to assist local law enforcement in cracking down on 13 scam compounds operated by Chinese nationals and to process over 3,200 electronic devices. (Bitcoin.com News)
OpenAI bans suspected Russian-based ChatGPT accounts, citing their use in covert influence operations
According to official sources, OpenAI has banned a group of ChatGPT accounts suspected to originate from Russia, which were used to generate social media content promoting the self-described Israeli-based "expert community," International Burke Institute (IBI). OpenAI stated that the operation involved publishing content on platforms such as Substack, Telegram, X, Facebook, and LinkedIn, while attempting to conceal the operators' Russian origin. Investigations revealed that the IBI website contains copied and misattributed academic content, and has introduced a so-called "Sovereignty Index." Related content tends to present Russia in a positive light while criticizing Western countries.
Telegram Founder Durov Listed as "Terrorist" by Russia for Refusing to Comply with Mass Surveillance
Telegram founder and CEO Pavel Durov (@durov) revealed in a post that the Russian government has designated him as a "terrorist" because he refused to comply with Russian demands to implement mass surveillance and content censorship on Telegram. Under relevant Russian laws, Durov is prohibited from "publishing any information on the internet." Durov responded to this by stating: "Russian officials obviously fail to understand who can actually kick whom off the internet."
ZachXBT Goes Undercover in Lazarus Group-Linked Money Laundering Ring: Invested Nearly $3.5 Million in OTC Trades with Counterparty Using the Alias Jimmy Green
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
Upbit 将上线 Dolphin（POD），支持韩元、BTC 及 USDT 交易对
据 Upbit 公告，Upbit 将上线 Dolphin（POD），支持 KRW、BTC 和 USDT 三个交易市场，预计于北京时间今日 15:00 开放交易。POD 仅支持通过 Base 网络充值和提现，充提服务将在公告发布后 2 小时内开放。 Dolphin 是一个 AI DePIN 项目，通过整合全球闲置 GPU 资源分布式处理 AI 推理任务，并提供 Web Chat、Telegram Bot 等产品。POD 代币主要用于网络质押及 Bonding。
布鲁克林男子因加密货币诈骗近 1600 万美元被判最高 12 年监禁
据布鲁克林地区检察官 Eric Gonzalez 宣布，布鲁克林男子 Ronald Spektor（23 岁）因实施大规模 Coinbase 网络钓鱼诈骗，于 2026年 9月 23 日被布鲁克林最高法院判处 4至 12 年有期徒刑。 Spektor 冒充 Coinbase 客服代表，以"账户遭黑客攻击"为由，诱骗全美约 100 名用户将加密资产转入其控制的钱包，累计盗窃金额约 1594.4 万美元。被盗资产随后经多个加密交易所反复兑换洗钱，最终流向赌博平台、礼品卡及数字资产购买渠道。 Spektor 在 Telegram 频道"Blockchain enemies"中以 @lolimfeelingevil 为昵称公开炫耀犯罪所得，并招募他人协助实施社会工程攻击。调查人员通过区块链分析、数字取证及多项搜查令，将其家庭 IP 地址与多个被盗钱包关联，最终锁定其身份。 Spektor 已就全部 31 项指控认罪，包括一级洗钱罪、一级重大盗窃罪等，并被命令没收逾 50 万美元资产，同时赔偿受害者近 1600 万美元。
Suspected collective theft incident hits Lootbot subscribers, losses surpass $600,000 and continue to grow
Odaily News On-chain analyst SomaXBT stated on the X platform that suspected Lootbot users have experienced a collective wallet theft incident, with losses now exceeding $600,000 (approximately 245 ETH). Preliminary information shows that about 50% of the victims are Lootbot subscribers.It is worth noting that Lootbot is one of the projects founded by dexter, the founder of gm.ai, a project previously involved in a soft rug pull. Lootbot was originally a trading bot platform within the Telegram ecosystem.
Ukraine busts Kyiv-based cryptocurrency fraud ring, involved platform's monthly turnover reaches up to $1 million
According to Decrypt, the Ukrainian National Police and Security Service recently shut down a network of fake cryptocurrency investment platforms based in Kyiv. The group distributed fraudulent investment ads on Telegram, guiding users to connect their wallets and deposit funds, while silently falsifying trading returns in the background. When victims requested withdrawals, the platform claimed verification was required, instructing them to connect their main wallet and approve a small "test transaction," which triggered a built-in crypto drainer to transfer the assets to wallets controlled by the syndicate.
value of 73 BTC, worth $4.6 million, originally came from the Whirlpool coin mixer, with some funds bridged to Ethereum and deposited through a phishing Tornado Cash interface
Odaily News: According to on-chain detective Specter's monitoring, the victim claimed that due to a Coldcard hack, funds were transferred from Bitcoin to Ethereum. However, on-chain data shows that the 73 BTC ($4.6 million) originally came from the Whirlpool coin mixer two weeks ago, with some of it bridged to Ethereum and subsequently deposited through a phishing Tornado Cash interface. Two coin mixers were used during the fund transfer process. The individual was also found to have appeared in Telegram groups involving private key searches and brute-force attacks. On-chain detective Specter stated that the victim may be a threat actor, and their funds may have been stolen by another threat actor.
Researchers Disclose Zero-Click Vulnerability in Telegram Emoji Stickers Enabling Code Execution on iOS
Researchers disclosed a zero-click vulnerability in Telegram's emoji sticker feature at a security conference held in Tokyo, and demonstrated that attackers can execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information has not yet clarified the specific scope of impact or remediation progress.
Security agency: Hackers used LLM combined with AI penetration tools to attack South Korean financial institutions, leaking data of approximately 68,000 people
security firm CrowdStrike released an intelligence report stating that an unidentified hacker, between late September and early October, combined large language models (LLMs) with the domestic open-source AI penetration testing tool ARTEX to launch targeted cyberattacks against multiple South Korean financial institutions and steal data.After analyzing the hacker's exposed open directory, it was found that they employed a dual-server architecture centered on a Hong Kong IP, and used models including Claude Code, GLM-5.3, Grok 4.6, and DeepSeek v4.1-flash accessed through an API proxy to orchestrate the attack process. The hacker also asked Claude how to monetize the leaked South Korean data in Telegram groups. According to estimates by South Korean media, at least seven South Korean financial institutions were attacked, including KB Kookmin Bank, Shinhan Bank, and Hana Bank, with personal data of approximately 68,000 people leaked, involving sensitive information such as annual income and loan limits.
ZachXBT Goes Undercover in Lazarus Group-Linked Money Laundering Ring: Invested Nearly $3.5 Million in OTC Trades with Counterparty Using the Alias Jimmy Green
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
ZachXBT: Gang Suspected of Assisting North Korean Hackers with Money Laundering is Transferring Stolen Bitget Funds and Publicly Seeking Technical Support
On-chain investigator ZachXBT disclosed that illicit actors assisting a suspected North Korean hacker group with money laundering are currently publicly seeking order processing support on the Discord public servers and Telegram channels of relevant service platforms. The laundered funds originate from the $387 million security breach previously suffered by Bitget.
布鲁克林男子因加密货币诈骗近 1600 万美元被判最高 12 年监禁
据布鲁克林地区检察官 Eric Gonzalez 宣布，布鲁克林男子 Ronald Spektor（23 岁）因实施大规模 Coinbase 网络钓鱼诈骗，于 2026年 9月 23 日被布鲁克林最高法院判处 4至 12 年有期徒刑。 Spektor 冒充 Coinbase 客服代表，以"账户遭黑客攻击"为由，诱骗全美约 100 名用户将加密资产转入其控制的钱包，累计盗窃金额约 1594.4 万美元。被盗资产随后经多个加密交易所反复兑换洗钱，最终流向赌博平台、礼品卡及数字资产购买渠道。 Spektor 在 Telegram 频道"Blockchain enemies"中以 @lolimfeelingevil 为昵称公开炫耀犯罪所得，并招募他人协助实施社会工程攻击。调查人员通过区块链分析、数字取证及多项搜查令，将其家庭 IP 地址与多个被盗钱包关联，最终锁定其身份。 Spektor 已就全部 31 项指控认罪，包括一级洗钱罪、一级重大盗窃罪等，并被命令没收逾 50 万美元资产，同时赔偿受害者近 1600 万美元。
HBO Max Reddit Account Hijacked, 108 Malicious Ads Pushing Infostealer Malware Deployed Over 48 Hours
Odaily reports: Earlier this month, the verified Reddit account of streaming service HBO Max was hijacked by hackers, who deployed 108 malicious ads over approximately 48 hours, tricking Mac and Windows users into executing commands to install infostealer malware.The malware can steal browser credentials, Telegram data, Apple Notes, saved passwords, and crypto wallet recovery phrases, and may also alter wallet addresses in the clipboard. Reddit has suspended the relevant ads and launched a security investigation. The number of infections and crypto asset losses have not yet been confirmed. (Decrypt)
Telegram 13.0 Version: Plans to Launch Cryptocurrency Wallet Gram Wallet, Original Wallet Service Renamed to Walt
According to Durov's Code, Telegram is expected to launch a new cryptocurrency wallet, Gram Wallet, in the latest version 13.0 update, though the service has not yet been officially opened to users. Meanwhile, the original Wallet service has been renamed Walt and moved from the settings menu to the mini-app interface, with existing accounts and assets remaining unaffected.
Security agency: Hackers used LLM combined with AI penetration tools to attack South Korean financial institutions, leaking data of approximately 68,000 people
security firm CrowdStrike released an intelligence report stating that an unidentified hacker, between late September and early October, combined large language models (LLMs) with the domestic open-source AI penetration testing tool ARTEX to launch targeted cyberattacks against multiple South Korean financial institutions and steal data.After analyzing the hacker's exposed open directory, it was found that they employed a dual-server architecture centered on a Hong Kong IP, and used models including Claude Code, GLM-5.3, Grok 4.6, and DeepSeek v4.1-flash accessed through an API proxy to orchestrate the attack process. The hacker also asked Claude how to monetize the leaked South Korean data in Telegram groups. According to estimates by South Korean media, at least seven South Korean financial institutions were attacked, including KB Kookmin Bank, Shinhan Bank, and Hana Bank, with personal data of approximately 68,000 people leaked, involving sensitive information such as annual income and loan limits.
Upbit 将上线 Dolphin（POD），支持韩元、BTC 及 USDT 交易对
据 Upbit 公告，Upbit 将上线 Dolphin（POD），支持 KRW、BTC 和 USDT 三个交易市场，预计于北京时间今日 15:00 开放交易。POD 仅支持通过 Base 网络充值和提现，充提服务将在公告发布后 2 小时内开放。 Dolphin 是一个 AI DePIN 项目，通过整合全球闲置 GPU 资源分布式处理 AI 推理任务，并提供 Web Chat、Telegram Bot 等产品。POD 代币主要用于网络质押及 Bonding。
ZachXBT: Gang Suspected of Assisting North Korean Hackers with Money Laundering is Transferring Stolen Bitget Funds and Publicly Seeking Technical Support
On-chain investigator ZachXBT disclosed that illicit actors assisting a suspected North Korean hacker group with money laundering are currently publicly seeking order processing support on the Discord public servers and Telegram channels of relevant service platforms. The laundered funds originate from the $387 million security breach previously suffered by Bitget.
US Department of Justice Has Frozen Approximately $938 Million in Fraud-Related Crypto, With About $52 Million Added in a Single Day
Odaily News: In an operation targeting the Telegram crypto escrow trading platform Xinbi Guarantee, the U.S. Department of Justice's Scam Center Strike Force restricted the handling of approximately $52 million in fraud-related cryptocurrency in a single day, bringing the cumulative total to approximately $938 million. Previously, the cumulative amount frozen, seized, or recovered had already exceeded $580 million.The U.S. Department of the Treasury stated that since its founding around 2022, Xinbi Guarantee has processed over $24 billion in transactions, involving digital assets and fiat currency, primarily serving Southeast Asian transactions. North Korean hackers and sanctioned entities are alleged to have used the platform, including entities under Jin Bei Group and Prince Group.A U.S. federal court approved the seizure on September 7 of the Telegram channel operated by Xinbi Guarantee. Law enforcement authorities also seized two payment wallets totaling approximately $12 million and applied to freeze another 47 cryptocurrency wallets suspected of being used for money laundering or associated with fraud-related service providers.The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) added Xinbi Guarantee and its two supporting companies, Safew Technology and Anwen Technology, to its sanctions list on September 9. The U.S. Department of Justice also dispatched investigators to Madagascar to assist local law enforcement in cracking down on 13 scam compounds operated by Chinese nationals and to process over 3,200 electronic devices. (Bitcoin.com News)
Solana Social Wallet Hey Wallet Announces Cessation of Operations, Reminds Users to Back Up Their Wallets
Hey Wallet, a Solana-based social wallet, has announced the cessation of its product operations and reminded users to back up their wallets on the official website. Operating since 2021, the project previously supported users in making SOL transfers, tipping creators, minting NFTs, and trading tokens via social platforms such as X, Telegram, and Discord.
Related news
Researchers Disclose Zero-Click Vulnerability in Telegram Emoji Stickers Enabling Code Execution on iOS
Researchers disclosed a zero-click vulnerability in Telegram's emoji sticker feature at a security conference held in Tokyo, and demonstrated that attackers can execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information has not yet clarified the specific scope of impact or remediation progress.
Telegram Provides User Data to US Authorities: Court Documents Reveal Details
According to 404 Media, newly filed court records reveal the specific circumstances under which Telegram provided user data to U.S. authorities after receiving a court order. The documents include a letter drafted by Telegram, listing specific users' phone numbers, user IDs, and IP addresses. This report was produced in collaboration between 404 Media and independent media outlet Court Watch. It should be noted that viewing the full article requires registration, and the currently accessible content does not disclose the identities of the users involved or the specifics of the case background.
Telegram renames built-in Gram Wallet to Money and opens it to all users.
Telegram has renamed its previously restricted wallet service "Gram Wallet" to "Money" and officially rolled it out to over one billion users across all platforms.
Telegram 13.0 Version: Plans to Launch Cryptocurrency Wallet Gram Wallet, Original Wallet Service Renamed to Walt
According to Durov's Code, Telegram is expected to launch a new cryptocurrency wallet, Gram Wallet, in the latest version 13.0 update, though the service has not yet been officially opened to users. Meanwhile, the original Wallet service has been renamed Walt and moved from the settings menu to the mini-app interface, with existing accounts and assets remaining unaffected.
Security agency: Hackers used LLM combined with AI penetration tools to attack South Korean financial institutions, leaking data of approximately 68,000 people
security firm CrowdStrike released an intelligence report stating that an unidentified hacker, between late September and early October, combined large language models (LLMs) with the domestic open-source AI penetration testing tool ARTEX to launch targeted cyberattacks against multiple South Korean financial institutions and steal data.After analyzing the hacker's exposed open directory, it was found that they employed a dual-server architecture centered on a Hong Kong IP, and used models including Claude Code, GLM-5.3, Grok 4.6, and DeepSeek v4.1-flash accessed through an API proxy to orchestrate the attack process. The hacker also asked Claude how to monetize the leaked South Korean data in Telegram groups. According to estimates by South Korean media, at least seven South Korean financial institutions were attacked, including KB Kookmin Bank, Shinhan Bank, and Hana Bank, with personal data of approximately 68,000 people leaked, involving sensitive information such as annual income and loan limits.
ZachXBT Goes Undercover in Lazarus Group-Linked Money Laundering Ring: Invested Nearly $3.5 Million in OTC Trades with Counterparty Using the Alias Jimmy Green
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.