north

The U.S. Securities and Exchange Commission (SEC) has approved the merger registration documents of Evernorth, a treasury company supported by Ripple, with the special purpose acquisition company Armada Acquisition Corp. II, clearing the way for the company to land on Nasdaq. Armada shareholders will vote on September 30, and if approved, the merged entity will be listed on Nasdaq under the code XRPN, with Evernorth expecting the transaction to be completed by the end of September or October.Evernorth is a company based in San Francisco, aiming to incorporate XRP into a public balance sheet and planning to invest in XRP infrastructure, gradually increasing the corresponding XRP reserve per share. The company was founded and is led by Asheesh Birla, who has been responsible for payment operations at Ripple for over a decade. In addition to Ripple, institutions such as Arrington Capital, Japan's SBI Group, Pantera Capital, Kraken, and GSR are also involved in the investment.As of the time of publication, XRP is quoted at approximately $1.41, with a weekly increase of over 27%.

According to The Block, XRP treasury company Evernorth announced that its SEC S-4 form related to the merger with Armada has become effective, advancing the Nasdaq listing process.CEO Asheesh Birla stated, "We believe institutional finance will increasingly build on-chain, and Evernorth aims to accelerate XRP's role in this process."

According to DIGITIMES, Changxin Memory and Yangtze Memory continue to expand, and recently Apple is actively seeking to introduce the two Chinese memory supply chains, drawing attention to their entry into Apple's supply system. Industry insiders reveal that the two manufacturers are actually using Apple to prove that the quality of Chinese DRAM and NAND Flash has reached international standards, while secretly expanding their cloud and enterprise market share through third-party assembly for export to North American neocloud operators.Changxin Memory's parent company, Changxin Technology, has completed fundraising of 29.5 billion yuan, while Yangtze Memory plans to raise about 33 billion yuan through an IPO for production line upgrades and R&D. Yangtze Memory has turned profitable in 2024, with a net profit attributable to the parent company reaching 33.379 billion yuan in the first quarter of 2026; its third-phase new factory will begin production ahead of schedule in the fourth quarter of 2026, with a total monthly production capacity of 100,000 wafers, of which about 20% will be trial-produced LPDDR, becoming its first DRAM base. The supply chain indicates that the two companies are expected to increase the self-sufficiency rate of domestic memory in China to over 50% by the end of 2027 to 2028.Yangtze Memory sells NAND to third-party module manufacturers and assembles them into enterprise-level SSDs to avoid location sensitivity; Changxin Memory has already obtained certifications from small and medium-sized cloud operators in the U.S., Canada, and other regions. U.S. private enterprises can, in principle, procure from the two companies, with the entity list primarily restricting their access to U.S. technology, but not completely prohibiting private procurement. Cloud operators also reduce compliance risks through methods such as renting computing power or holding assets through third parties. The industry believes that Apple's influence on supply and demand in the industry is declining, and the two companies have no intention of supplying Apple in large quantities or engaging in price competition, making it difficult to meet Apple's demand in the Chinese market in the short term.

According to Cryptopolitan, attackers released malicious versions of three widely used Rust packages through a supply chain attack, with a library named arrayref being used by about three-quarters of Rust development environments. The malicious update hid a backdoor that could automatically steal login information when users compiled projects; users who compiled the affected versions may have exposed their computers and keys.Wiz researchers pointed out that the command and control path of the arrayref attack overlaps with the Mastra operation used by the North Korean hacker groups Sapphire Sleet and UNC1069, with IP addresses sharing the same security certificate and using the same hosting provider, Hostwinds. The attackers only added a misspelled proc-macro1 dependency, mimicking the popular proc-macro2, without modifying the original code, allowing it to pass tests and builds. The attack was removed 86 minutes after release but had already been downloaded extensively. The affected packages are widely used in Solana and Ethereum tools. The Rust team believes the maintainer's actions were not malicious, and their device or credentials may have been compromised.

According to Cointelegraph, Mauro Eldritch, the founder of cybersecurity company BCA LTD, and Heiner García, a network threat intelligence analyst at Telefónica Tech, jointly established a fake cryptocurrency startup "Ballena Azul," successfully luring suspected North Korean IT workers to work in a controlled virtual desktop environment for up to five weeks while monitoring their behavior throughout.Investigations show that the external servers used by the workers are linked to North Korean cyber operations that previously distributed malware such as InvisibleFerret, BeaverTail, and OtterCookie; the workers also heavily relied on ChatGPT for programming assistance and Google Gemini to forge identity documents. Researchers pointed out that North Korean IT workers obtained remote jobs by faking U.S. identities, with their earnings ultimately flowing into Pyongyang's weapons of mass destruction programs. According to the U.S. Treasury Department, such programs are expected to generate nearly $800 million for North Korea in 2024.

According to Bitcoin.com, cybersecurity company Genians Security Center has released an analysis report stating that the North Korean Reconnaissance General Bureau's hacker organization Kimsuky is building and testing a set of AI-based cyber attack tools. Researchers found traces of the deployment of three local AI platforms: Ollama, GPT4All, and Msty, as well as components of AI development frameworks such as Microsoft Semantic Kernel and LLaMaSharp in their infrastructure, indicating that the organization is systematically developing dedicated AI attack tools rather than just making temporary attempts.Since early 2026, Kimsuky has been using high-quality documents generated by generative AI for spear-phishing attacks targeting virtual assets, financial investments, and game development. The AI-generated professional documents significantly reduce the effectiveness of traditional phishing email detection. The attack vector is a ZIP archive disguised as a legitimate document, containing a malicious LNK file that, when triggered, can silently execute PowerShell commands in the background.

Cryptocurrency exchange Bybit has filed a civil lawsuit in the United States District Court for the District of Columbia, suing North Korea, the North Korean Reconnaissance General Bureau, and the hacker group Lazarus Group, regarding a theft incident of approximately $1.5 billion in February 2025. Bybit stated that the judge has approved a preliminary injunction prohibiting the transfer or disposal of identified stolen assets during the case proceedings, and believes that Bybit has a high likelihood of success on the merits.The lawsuit also lists unknown individuals and entities holding or transferring the relevant funds as John Doe defendants. Bybit disclosed that approximately $48.4 million has been recovered, and about $30.5 million has been frozen across more than 28 exchanges and custodians, together accounting for approximately 5% of the stolen amount. The attackers transferred about 500,000 ETH from Bybit's cold wallet in February 2025, with most of the funds subsequently exchanged for Bitcoin via Thorchain and transferred through mixing services. Bybit stated that the case is progressing in parallel with a criminal investigation.

Cryptocurrency exchange Bybit has filed a civil lawsuit against the Democratic People's Republic of Korea, its intelligence agency Reconnaissance General Bureau (RGB), and the state-sanctioned hacking organization Lazarus Group, involving a $1.5 billion hacking incident.A U.S. federal court has issued a preliminary injunction prohibiting the transfer or dissipation of identified assets related to the case during the litigation period.

According to Wired, a security researcher who has been infiltrating a North Korean hacking organization for nearly two years has issued a warning, pointing out that the attack methods targeting individual employees and contractors are extremely effective and have a wide-ranging impact, leading to numerous organizations worldwide suffering breaches.Greek cybersecurity researcher Vangelis Stykas stated that since gaining access to the North Korean system 22 months ago, he has found evidence indicating that 1,640 companies in 57 countries have been affected by North Korean hacking operations. Among them, approximately 700 to 800 affected organizations have suffered "highly destructive" breaches.

According to Jinshi reports, several Iranian one-way attack drones attacked and hit a military base in northern Kuwait on Monday night.

According to Jinshi reports, the UK Maritime Trade Operations Office stated that a cargo ship was attacked 20 nautical miles northeast of Haiseb in the Strait of Hormuz.

According to Crypto.news, the hacker organization BlueNoroff, linked to North Korea, uses fake Zoom and Microsoft Teams meetings to analyze cryptocurrency users before deploying malware.The hackers first take control of accounts belonging to trusted contacts in the cryptocurrency industry, then send seemingly normal meeting links via Calendly and other platforms, directing users to counterfeit Zoom/Teams domains. Once users enter the fake meeting page, it quietly scans the wallets in their browsers and decides whether to continue the attack based on the wallet's value. The fake meeting will prompt users to "update Zoom/Teams" or run commands, which actually download malware (supporting Windows and macOS). The malware will steal browser keys, system data, and Telegram sessions.

According to South Korean media Daily NK, North Korean authorities arrested an elite hacker group on July 12, which is suspected of infiltrating the internal networks of the North Korean central bank and foreign trade bank, stealing national trade funds and laundering money through cryptocurrency. Sources say the group's leader is a veteran from the cyber warfare unit under the North Korean Reconnaissance General Bureau, who recruited talented IT graduates from Kim Chaek University of Technology and Pyongyang University of Science and Technology, using encrypted communications and wireless devices to commit crimes.They split the stolen funds into small amounts and transferred them to overseas cryptocurrency wallets, exchanged them for cash through intermediaries, and then converted them into dollars and other currencies in border areas. Pyongyang officials launched an investigation after discovering anomalies in foreign currency payment approvals and records of overseas IP access, ultimately raiding a safe house and arresting suspects who were laundering money, seizing equipment worth hundreds of thousands of dollars. This case has caused a stir among the elite and military circles in Pyongyang, with senior officials in the Reconnaissance General Bureau and the science and education sector worried about being implicated. North Korea has long been accused of stealing billions of dollars in cryptocurrency assets through hacker organizations like the Lazarus Group, but this incident rarely shows that its own financial system has also become a target of internal attacks.

According to Protos, AI shopping agent developer ORO disclosed that it suffered losses of approximately $630,000 due to a suspected North Korean hacker attack. The attackers sent spoofed Microsoft Teams links to ORO employees through a compromised Telegram account, inducing them to install malicious extensions, and after nearly a month of data theft, stole 147,000 Alpha tokens on July 13. ORO is highly confident that the attack originated from the North Korean hacker group Sapphire Sleet.ORO also admitted to security negligence—due to insufficient hardware wallet support in the Bittensor protocol, the company "temporarily" set the owner keys to software wallets, violating its internal principle of prioritizing hardware wallets, which led to the keys being stolen from the compromised computer. ORO stated that it is working with exchanges, law enforcement, and Bittensor ecosystem partners to recover the stolen assets and emphasized that its subnet is operating normally, and other wallets, user data, and validator signing keys were not affected.

According to CoinDesk, a survey by financial technology service provider Broadridge of 200 North American financial services executives shows that 84% of the responding institutions believe that tokenization is of significant importance to their business, indicating that Wall Street is transitioning from the experimental phase of blockchain to preparing for the integration of tokenized assets into everyday market infrastructure.The survey reveals that 68% of respondents believe that tokenization will partially reshape financial markets in the next 3 to 5 years, with nearly one-third of institutions planning to increase their investment in tokenization projects by 26% to 50% or more over the next 2 years. Meanwhile, 92% of institutions expect digital assets and traditional assets to coexist in the foreseeable long term, and 69% plan to integrate tokenization into existing infrastructure rather than building a native on-chain system from scratch.

According to Cointelegraph, Consensys introduced a software developer earlier this year through a "reputable third-party service provider," who was later found to have connections to North Korea. The developer had approximately one month of access to the Consensys system under the alias Tyler Knapp.Consensys General Counsel Matt Corva stated that the developer was not an employee of Consensys but collaborated as a consultant. After discovering the threat, the company immediately terminated access and launched a comprehensive investigation, confirming that no assets or data were stolen, no malicious code was deployed, and user security was not affected. Consensys stated that it would reevaluate its practices regarding outsourcing engineering and development work.

The U.S. CFTC has sued North Carolina man Trevor Vernon and his company Argent Capital Management LLC, accusing them of defrauding approximately 60 investors out of a total of $14 million through a fraudulent commodity pool.According to the complaint filed by the CFTC in the U.S. District Court for the Western District of North Carolina, the commodity pool operated by Vernon and his company involved trading in multiple asset classes, including stock index futures options, stock index futures contracts, and crypto assets. The CFTC stated that Vernon falsely claimed to investors that he was a "successful trader" through quarterly financial updates and monthly performance review emails, while in reality, he was incurring significant losses when trading with investor funds. The regulatory agency indicated that Vernon had accumulated losses of at least $8.6 million in futures, options, and crypto trading. The CFTC stated that the actual trading results were "persistent and catastrophic losses," which were severely inconsistent with the profitability presented to investors.

The Ministry of Interior of Thailand, in conjunction with provincial electricity authorities, police, and local administrative officials, conducted a joint law enforcement operation this Saturday in five provinces: Ubon Ratchathani, Yasothon, Amnat Charoen, Roi Et, and Maha Sarakham, inspecting 14 locations in total. The operation confiscated 315 digital currency mining devices, and investigators found that the individuals involved supplied power to the mining machines by tampering with electricity meters and illegally connecting to the power supply. The total estimated loss reached 40.38 million baht (approximately 1.227 million USD), which includes a 5.38 million baht fine for electricity violations and about 35 million baht in unpaid electricity bills. Relevant evidence has been collected, and authorities have filed lawsuits against the individuals involved.

The leaders of the G7 countries issued a statement at the G7 summit held in Évian-les-Bains, France, once again calling for a joint effort to combat North Korea's cryptocurrency theft and cybercrime. United Nations security researchers have linked North Korea's cryptocurrency theft to the funding of the country's weapons program.Previously, attacks suspected to be related to North Korean hackers included a $285 million attack on Drift Protocol in April and a $36 million breach of Humanity Protocol in June. According to Chainalysis data, North Korean hackers have stolen at least $2 billion in cryptocurrency in 2025, bringing their total historical theft to at least $6.75 billion.

Humanity released an independent investigation report by Quantstamp, which disclosed that in the H token security incident, the attacker used tools and methods characteristic of North Korean hackers, disguising themselves as communication from the Bithumb exchange through phishing emails, inducing project directors to click on malicious attachments, thereby deploying a remote control Trojan on their devices, ultimately gaining full desktop control and wallet private keys. Subsequently, on Ethereum and BNB Chain, they launched on-chain attacks: on the Ethereum side, by stealing keys to upgrade contracts and transferring approximately 141.18 million H tokens, and on the BSC side, by taking over the ProxyAdmin contract and minting new tokens. The stolen assets were then continuously sold on Uniswap and PancakeSwap for about 8 hours, causing significant impact on liquidity and market prices.Currently, the H token contract on the Ethereum side has been frozen, the mainnet bridge remains unaffected, but the BSC deployment has been controlled by the attacker and still has minting permissions. The team is working with exchanges and security parties to advance subsequent disposal and recovery plans, while reminding users to be wary of false "compensation/claim" links, and stated that further progress will be announced through official channels.Previously, the Humanity Protocol was attacked, resulting in the leak of a private key from a member of the Humanity Foundation, leading to over 31 million dollars in funds being stolen.