engine

"On-chain detective" ZachXBT published a case analysis stating that in a cryptocurrency asset case involving an Indian scam gang, the relevant individuals reported the case to law enforcement after their assets were frozen, drawing attention. The incident began when a user sought help, claiming that approximately 5.73 BTC (about $475,000) was frozen on Changelly in March 2025.Subsequent on-chain analysis revealed that these funds could be traced back to multiple social engineering attacks and theft cases related to Bitcoin ATMs targeting U.S. users, with a total amount involved exceeding $1 million and several elderly victims. The investigation showed that the individual provided multiple changing explanations for the source of the funds, including "loan," "boss transfer," and "investment from 2014-2015," and there were significant contradictions in the evidence chain.More concerning is that this user had previously filed a police report in India in December 2025, attempting to recover the frozen funds (case number 3207-P/2025). Subsequent on-chain evidence collection and email data analysis indicated that they might be a "mule" for transferring funds, with some bank documents inconsistent with their identity information. ZachXBT noted that such cases demonstrate that social engineering attacks and cross-border fund transfers continue to occur and remind users to avoid interacting with funds from suspicious sources to prevent triggering compliance freezes or legal risks.

According to Bloomberg, the three types of investors under Michael Saylor's Strategy—Bitcoin holders, leveraged equity traders, and preferred shareholders—are all under pressure. Strategy sold 32 Bitcoins this week, marking the first sale since the end of 2022, breaking the "never sell" promise. Bitcoin has fallen to a four-month low, and Strategy's stock price has dropped about 70% from last year's peak, with STRC preferred shares falling below the $100 par value. STRC has an annualized dividend of 11.5%, and if the market continues to weaken, the pressure to pay dividends will continue to rise.Analysts point out that increasing the dividend rate will add a $1.7 billion burden, while keeping it unchanged will lead to further price declines. Strategy will vote on Monday to change the dividend to bi-monthly payments to stabilize the price. The Chief Investment Officer of Arca stated that unless Bitcoin rebounds before the cash buffer is exhausted, it will be nearly impossible to protect all stakeholders. StoneX believes that this sale indicates that Strategy can fulfill its obligations without materially reducing its holdings.

Slow Fog's Yuxian stated on platform X that incidents of search engine poisoning involving fake Codex, Claude Code, and others have recently surged. It mentioned that it has previously warned multiple times about Google search results and its own services like Google Sites being exploited by black and gray market poisoning, but Google has not taken action against such obvious poisoning methods.

In mid-2026, multiple data points indicate that AI tools are generating significant hidden costs. A survey by Entelligence AI of 2,444 companies found that for every $1 spent on AI, $0.44 is used to fix vulnerabilities, $0.27 is spent on rewriting AI-generated code, and $0.11 is consumed by audit and merge delays.The 2026 report from Lightrun further notes that 43% of AI-generated code still requires manual debugging in production environments after passing quality checks, and no surveyed engineering leaders expressed complete trust in the AI outputs that have been deployed.On the infrastructure front, Oracle has accumulated approximately $108 billion in total debt and is raising another $50 billion in 2026 for AI data center construction, with free cash flow nearing negative $13 billion. Over $300 billion of its $553 billion backlog is concentrated in OpenAI, which incurred a loss of about $14 billion last year. In terms of talent, OKX CEO Stax Xu stated that AI agents have exposed employees who rely on impression management rather than outcome production while accelerating execution. The exchange has now incorporated AI proficiency into its employee evaluation system.

The prosecution materials released by the U.S. Attorney's Office for the Southern District of New York show that Google security engineer Michele Spagnuolo has been arrested and charged for allegedly using significant non-public information to bet on Google user search result-related markets on Polymarket.The prosecution materials state that Spagnuolo used Google internal tools to track the list of the most searched people in 2025 and transferred approximately 3.8 million USDC to a Polymarket address; his associated account AlphaRaccoon placed a bet that D4vd would become one of the most searched people in late November after accessing internal tools for several hours.The prosecution materials also state that AlphaRaccoon transferred 5 million USDC from the Polymarket account to a wallet and moved the funds through exchange services and privacy tools, with some of the funds ultimately entering an account at a payment processing institution in Italy. Spagnuolo is accused of profiting over 1.2 million dollars from the related transactions and currently faces charges of commodity fraud, telecommunications fraud, and money laundering.

The Ethereum Foundation stated that the Open Intents Framework aims to serve as a shared infrastructure for cross-chain intents, providing a modular open framework for deploying, discovering, and executing intents for the ecosystem.At the same time, LI FI announced the launch of LI FI Intents, a full-stack execution engine for same-chain and cross-chain transfers, which competes for quotes and completes order execution through a professional Solver network. LI FI documentation shows that its Intent/Solver Marketplace is one of the official foundations of the Open Intents Framework, and the Ethereum Foundation claims that the framework is entering a phase of large-scale adoption.

"On-chain detective" ZachXBT stated that the hacker "Dritan Kapplani Jr" transferred approximately $2.59 million in assets, including 1.99 million DAI and 259 ETH. The related funds were transferred from address 0x4487...bba6 to address 0x67ec...125d, and the stolen funds are currently in a stagnant state.ZachXBT indicated that it released an investigation report on May 12, detailing the connections between Dritan Kapplani Jr and Trenton (Trent) Johnson in a social engineering theft case involving 185 bitcoins (approximately $13 million).

The cryptocurrency research institution Delphi Digital released the latest report "How Far Can Saylor Stretch It," which systematically analyzes the Bitcoin (BTC) funding expansion mechanism of Strategy, pointing out that its financing structure is transitioning from "low-cost accumulation" to the "diminishing marginal efficiency" stage. The report shows that in the current asset accumulation system centered around Bitcoin, STRC has become the core financing tool for Strategy's continuous purchase of BTC. Initially, it relied on a significant premium in MSTR's stock price (mNAV far exceeding BTC's net value) to achieve a positive cycle of "issuance leads to accumulation," but as the valuation has fallen back to about 1.24 times the EV-based mNAV, the BTC per share enhancement effect from common stock issuance is nearing breakeven.At the same time, while convertible bond tools have played an important role historically, they have accumulated about $8.2 billion in principal and will face concentrated repayment pressure after September 2027, putting long-term sustainability of the financing structure under pressure. STRC provides a continuous financing source for Strategy by offering approximately 11.5% annualized monthly dividends to income-oriented investors, to maintain the pace of BTC purchases. However, this mechanism also introduces ongoing cash flow obligations, meaning that each round of financing increases BTC assets while simultaneously accumulating future dividend burdens.The report emphasizes key risk scenarios: if BTC prices remain stagnant and MSTR's premium fails to recover, then the "STRC financing purchase gain" may be gradually offset by "common stock dilution and dividend obligations." Although the company's approximately $2.25 billion cash reserves can cover about $1 billion in redemption pressure in 2027, larger-scale debt and dividend structures in 2028 still need to be addressed. Additionally, the current authorized issuance limit of about $28.3 billion for STRC becomes a critical constraint point. Once the limit is reached, the ability to purchase new BTC may slow down, but existing dividend obligations will continue to exist, thus altering the overall BTC per share dynamic growth path.

The BAI platform announced user data for May 11, showing that the platform gained 8,756 new users that day. While maintaining strong growth, the proportion of Stripe payments among the core paying group has risen to 69.0%, indicating a steady improvement in retention rates among traditional developers and production-level users. In terms of business structure, the DeepSeek-V4 series has contributed nearly 60% of Token consumption due to its extreme cost advantages. This series of models, with ultra-low latency, high concurrency, and high throughput capabilities, is becoming an indispensable core execution engine in the AI Agent era. The B.AI platform will continue to provide developers with efficient and economical model services, helping more AI-native applications to be implemented.

According to CoinDesk, Ripple announced on Monday that it will share its internal intelligence on North Korean hackers with the cryptocurrency industry threat intelligence sharing organization Crypto ISAC to help businesses identify coordinated infiltration actions.This move comes against the backdrop of a recent shift in attack patterns faced by the cryptocurrency industry. Ripple stated, "The strongest crypto security posture is a shared posture. A threat actor who has not passed a background check at one company may submit resumes to three other companies in the same week. Without shared intelligence, each company starts from scratch."

North Korean hackers had months of offline contact and infiltration with employees of Drift Protocol before launching one of the largest social engineering attacks in the history of the cryptocurrency industry, resulting in a loss of approximately $285 million.Data from blockchain security company TRM Labs shows that North Korean hackers have accounted for 76% of all cryptocurrency hacking losses in 2026 to date.

Coinbase stated that it is optimizing the rule creation process in its anti-fraud system by integrating machine learning models with a rules engine, achieving more efficient risk management. It also proposed a dual-track strategy of "models responsible for long-term defense, rules responsible for rapid response," and built a unified framework to create a feedback loop between the two: rules are used to capture new types of fraud and train the model in reverse, thereby continuously enhancing overall defense capabilities.In terms of specific optimizations, Coinbase has transformed the previously manual rule creation process into a data-driven and automated recommendation system by restructuring data, automating schema evolution, and introducing notebook-based analytical tools, significantly improving efficiency. Among these improvements, the performance of rule backtesting has increased by more than 10 times, and the overall response time has been reduced from several days to a few hours. Additionally, the new system uses machine learning to recommend parameters, helping to reduce false positive rates while combating fraud and minimizing the impact on normal users. Coinbase indicated that the next step will be to advance event-driven automatic rule generation and explore the "one-click conversion" of efficient rules into model features, further moving towards an automated risk management system.

According to The Block, the Ethereum Name Service (ENS) gateway eth.limo experienced a DNS hijacking attack last Friday evening. The project released a post-incident analysis report on Saturday, tracing the attack back to a social engineering attack against the domain registrar EasyDNS.eth.limo stated that DNSSEC validation rejected the attackers' domain server changes, and no users have been found to be actually affected. In response to the recent breaches at the DNS level affecting crypto frontends, eth.limo plans to migrate to EasyDNS's stricter security services, which no longer support account recovery features.EasyDNS CEO Mark Jeftovic has publicly acknowledged the vulnerability, stating that this is the first successful social engineering attack against customers in its 28-year history.