elliptic

Anthropic's AI model Claude cracked a 25-year-old puzzle in the field of cryptography in less than 30 minutes, tracing a set of numbers provided by the National Security Agency (NSA) to the U.S. government in the late 1990s back to a common random number generator that used timestamps from 1997 and 1998. These numbers have long been suspected of hiding a backdoor.In 2000, the National Institute of Standards and Technology (NIST) adopted a set of elliptic curves provided by the NSA, but the NSA never explained where the partial numbers (seeds) used to generate these curves came from. After Edward Snowden disclosed that the NSA had attempted to undermine cryptographic standards, suspicions about its hidden backdoors intensified. Cryptographers Neal Koblitz and Alfred Menezes discussed this controversy in a 2015 paper, and security researcher Steve Weis spent years searching for answers. In 2023, Filippo Valsorda and others even set up a bounty for this.Claude traced the five NIST curve seeds back to the random number generator lrand48 in an old C software library and reproduced the widely used P-256 curve sequence, finding an exact match with the published seeds among the 1842 candidates. Anthropic stated that this significantly reduces the possibility of hidden weaknesses, and users of NIST curves do not need to make any changes. Bitcoin is unaffected, as its wallets use the simpler secp256k1 curve, which has almost no room for secretly implanted weaknesses. The bounty of $36,864 will be donated to the nonprofit organization Internet Security Research Group behind Let's Encrypt.

According to Insurance Journal, blockchain analysis company Elliptic disclosed that it has tracked over 50 security incidents related to North Korea, with a total of approximately $1.2 billion stolen this year.Some of the stolen funds from Bitget overlap with the associated addresses from last year's $1.5 billion theft incident at Bybit exchange. Initial on-chain money laundering patterns indicate that the Bitget incident was carried out by the hacker organization TraderTraitor.

According to Caixin, the internal situation of Cambodia's first publicly disclosed telecom fraud base "Zone 8" has been revealed. This "fraud city" is the largest telecom fraud base in Cambodia, capable of accommodating up to 20,000 workers who have been trafficked and forced to engage in online scams, operated by the Cambodian company Legend Innovation.Blockchain analysis firm Elliptic found that the operating company has connections to the Prince Group. Legend Innovation is accused of having links to the Prince Group, which has been sanctioned by the U.S. and the U.K., through company phone numbers, board activities, and related business records. Notably, the phone number registered by Legend Innovation appeared in the records of a real estate company that is alleged to belong to the Prince Group's network. The park once had a physical store for Huiwang Payment, allowing personnel to exchange cryptocurrency and cash, while Huiwang Logistics was accused of providing freight services between Thailand, Vietnam, Cambodia, and the park.

According to official news, OKX, in collaboration with Elliptic, SlowMist, and OttoSec, has released the "Web3 Security and Risk Control Report for the First Half of 2026." The report points out that the focus of Web3 attacks is gradually shifting from smart contract code to more complex scenarios such as signature processes, user devices, operational infrastructure, and AI Agents.Data shows that in the first half of 2026, the OKX risk control system intercepted over 5.7 million high-risk transactions, including approximately 2.41 million transactions related to hacking and theft, about 1.48 million transactions related to phishing, and around 990,000 transactions related to fraud. The OKX Web3 on-chain intelligence label library currently has over 1 billion labels, covering more than 420 chains, and has integrated capabilities such as address screening, transaction monitoring, and sanction address control into infrastructures like DEX and Exchange OS.In addition, in terms of user protection, OKX has intercepted over 7 million visits to risky websites, completed over 200,000 device risk assessments, identified over 60,000 high-risk apps, and intercepted or alerted on over 4 million high-risk signature operations. The report also introduces the "risk control pre-positioning" design in scenarios such as Exchange OS, Outcomes, RWA, and Agentic Wallet.

Blockchain analysis company Elliptic announced that it has received a strategic investment from Circle Ventures. Previously, the company completed a $120 million Series D funding round in May this year, led by One Peak, with participation from Nasdaq Ventures, Deutsche Bank, and the British Business Bank.At the same time, Circle officially joined Elliptic's Agentic Design Partner Program, which brings together infrastructure providers, compliance agencies, and technology teams to collaboratively develop compliance solutions for AI agents. Elliptic pointed out that AI agents are different from traditional bots, as they can autonomously set goals and make independent decisions. Their operational speed and scale have far exceeded the carrying capacity of human compliance systems, necessitating specialized solutions to address this.

Blockchain analysis company Elliptic has completed a new round of financing of $120 million at a valuation of $670 million, led by One Peak Partners, with participation from Deutsche Bank, Nasdaq's venture capital division, and British Business Bank, while existing shareholders like JPMorgan Chase continue to invest.Founded in 2013, Elliptic provides cryptocurrency transaction monitoring and anti-money laundering, sanctions compliance tools for financial institutions and law enforcement agencies. Currently, the company screens over 1 billion transactions weekly for more than 700 clients to support the compliance operations required for large banks, asset management firms, and fintech companies to conduct digital asset business.

According to CoinDesk, blockchain analytics firm Elliptic stated that the Drift Protocol attack resulted in a loss of $285 million, with "multiple signs" pointing to the North Korean-supported DPRK hacker organization. Elliptic focused on analyzing on-chain behavior, money laundering techniques, and signals at the network level, all of which align with previous state-affiliated attacks.The Elliptic report noted: "If confirmed, this would be the 18th DPRK attack tracked by Elliptic this year, with over $300 million stolen to date." On a technical level, Elliptic described this attack as "premeditated and meticulously planned," with early test transactions and pre-positioned wallets prior to the main attack. After the execution of the attack, the funds were quickly consolidated and transferred across chains, converted into more liquid assets, forming an organized and repeatable money laundering process aimed at obscuring the source of funds while maintaining control.This incident involved over ten types of assets, with funds being transferred across chains from Solana to Ethereum and other chains, further highlighting the importance of cross-chain tracing capabilities. Drift Protocol is the largest decentralized perpetual contract trading platform on the Solana blockchain, and its token has dropped over 40% to approximately $0.06 since the hack.

The latest report from blockchain analysis company Elliptic points out that a cryptocurrency exchange related to Russia, known as the "shadow network," is assisting in evading international sanctions through large-scale cryptocurrency transactions and names five platforms, most of which have not yet been sanctioned and still provide Russian entities with funding channels to bypass traditional banking regulations. Among them, ABCeX is identified as the largest, having processed at least $11 billion in cryptocurrency transactions.The report also notes that although Exmo claims to have exited the Russian market, on-chain data shows that it still shares custodial wallet infrastructure; Rapira, registered in Georgia and with an office in Moscow, is said to have direct transactions exceeding $72 million with the sanctioned exchange Grinex; Bitpapa evades monitoring by frequently changing wallet addresses; and Aifory Pro provides cash-to-crypto exchange services in Moscow, Dubai, and Turkey.Analysis indicates that the previously targeted cryptocurrency-related sanction evasion infrastructure in Russia has not disappeared but has instead dispersed across more platforms.

Blockchain analysis company Elliptic's latest report shows that the ruble stablecoin A7A5 has surpassed $10 billion in on-chain transaction volume since its launch in 2025.This stablecoin is primarily launched by the Russian company A7 LLC, aimed at helping Russian businesses evade Western sanctions. The main function of A7A5 is to serve as a bridge asset between the ruble and USDT, with a total trading volume reaching $17.3 billion, the vast majority of which occurs on exchanges like Grinex in Kyrgyzstan.Despite the significant trading volume, its growth has been notably constrained since August 2025, when countries like the United States imposed sanctions on A7A5. New token issuance has essentially stalled since the end of July, with daily trading volumes dropping from a peak of $1.5 billion to around $500 million. Major DEXs like Uniswap have listed it on their token blacklist, while the liquidity injection of USDT on its own DEX has significantly decreased. Sanctions have led users to face the risk of account freezes when transferring USDT from A7A5 to mainstream exchanges, increasingly isolating it from the broader crypto ecosystem.

Cryptocurrency tracking company Elliptic's latest analysis shows that the Chinese-dominated crypto black market ecosystem on Telegram has reached an all-time high. Some platforms built on Telegram facilitate nearly $2 billion in money laundering and fraud-related transactions each month, including money laundering services, stolen data, fake investment websites, AI deepfake tools, and human trafficking.Researchers point out that these markets have surpassed dark web platforms like AlphaBay and Hydra, becoming the largest illegal online crypto market in history.

According to Solid Intel's monitoring, Vitalik Buterin warned at Devconnect that quantum computing could break elliptic curve cryptography before the 2028 U.S. presidential election, and urged ETH to transition to quantum-resistant cryptography within the next four years.

ChainCatcher news, blockchain analytics company Elliptic announced that it has received a strategic investment from HSBC, becoming the first industry company to gain support from four global systemically important banks (G-SIBs), with the other three being JPMorgan Chase, Santander, and Wells Fargo.Richard May, Head of Financial Crime at HSBC Group, will join the board of Elliptic. Elliptic stated that this investment will be used to expand the team and the coverage of financial services to meet the growing demand from financial institutions for blockchain transaction monitoring tools. The company's key focus areas include stablecoin regulation, AI-driven compliance tools, and the expansion of blockchain network coverage.

ChainCatcher news, according to Cryptoslate, Elliptic released a report stating that despite the Huione Guarantee platform in Cambodia being shut down on May 13 due to its involvement in a $27 billion pig-butchering scam, dark market transactions on Telegram have not decreased.Data shows that merchants quickly shifted to the competitor platform Tudou Guarantee, in which Huione holds a 30% stake, and the USDT inflow to this platform has returned to levels seen before Huione's shutdown. On-chain data indicates that after the ban was implemented, Huione's USDT inflow dropped to nearly zero, while the number of users on Tudou Guarantee more than doubled, with inflows comparable to those before Huione's closure.

ChainCatcher news, according to Cointelegraph, blockchain security company Elliptic disclosed that a company registered in Colorado in 2022, Xinbi Co. Ltd, is associated with an illegal online marketplace called "Xinbi Guarantee."This marketplace is based on the Telegram platform and is a Chinese illegal market primarily serving Southeast Asian scammers, having received $8.4 billion in funds to date, mainly in the form of USDT transactions. Merchants on the market provide scammers with technology, personal data, and money laundering services, assisting them in carrying out "pig butchering" scams. Xinbi Guarantee claims to be an "investment and capital guarantee group company," but its status was updated to "delinquent" in January 2025 for failing to submit periodic reports on time. The black market's money laundering service has the largest transaction share and also offers Starlink devices, stolen personal data, and fake IDs.Elliptic states that Xinbi Guarantee is the second-largest illegal online marketplace, with transaction volumes exceeding $1 billion in the fourth quarter of 2024, and is linked to North Korean hacker money laundering. The $8.4 billion transaction volume may only be the tip of the iceberg of actual trading volume. The platform has 233,000 users and operates under a "guarantee model," yet remains a hotbed for illegal activities. Records from the Colorado state government show that Xinbi Co. Ltd was listed as "in violation" in January 2025 for failing to submit its annual report on time.

ChainCatcher news, according to crowdfundinsider, digital asset company Elliptic announced a partnership with Monerium to provide compliance and anti-money laundering (AML) solutions for the latter's Euro (EURe) stablecoin in accordance with European MiCA regulations.It is reported that this real-time multi-chain compliance system can reduce manual intervention by 60%.

ChainCatcher message, the Slow Mist security team published a disclosure revealing a critical vulnerability (GHSA-vjh7-7g9h-fjfh) found in the widely used elliptic cryptography library.Attackers can extract private keys with just one signature by constructing specific inputs, which may lead to the theft of digital assets or identity credentials. This vulnerability could affect blockchain applications and digital identity systems that rely on this cryptography library.

ChainCatcher news, according to Cointelegraph, blockchain analysis company Elliptic has discovered that North Korean hackers involved in the Bybit hack control over 11,000 cryptocurrency wallets for money laundering.

ChainCatcher news, financial research firm Moody's has announced a strategic alliance with blockchain analytics company Elliptic, aimed at enhancing risk screening for virtual asset service providers (VASPs).Moody's and Elliptic will use on-chain and off-chain data to provide additional background information and risk assessments for financial institutions and businesses. This solution leverages Elliptic's real-time on-chain data to classify the risks of illicit activities in digital asset transactions and integrates it with Moody's off-chain data in a unified risk engine.

ChainCatcher news, according to The Block, blockchain analysis company Elliptic released a report on Wednesday stating that the Cambodian market Huione Guarantee is suspected of money laundering and other criminal activities.Since its establishment in 2021, Huione and its merchants' crypto wallets have received at least $11 billion, primarily using Tether (USDT) for transactions. Elliptic pointed out that Huione executives are connected to Cambodian Prime Minister Hun Manet and claimed that the platform turns a blind eye to crimes such as money laundering and "sexual exploitation." Elliptic has identified and labeled hundreds of cryptocurrency addresses controlled by Huione, helping to prevent further money laundering activities.