zar

Tin tức từ ChainCatcher, theo dõi của Lookonchain, nhóm hacker Lazarus đã chuyển 244.148 Bitcoin, trị giá 19.42 triệu USD.

Theo thông tin từ ChainCatcher, theo dõi của nhà phân tích trên chuỗi Ai dì, tổ chức hacker Lazarus Group đã chuyển 262,2 BTC đến địa chỉ mới cách đây 2 giờ, trị giá 16,64 triệu USD, hoặc có kế hoạch thực hiện rửa tiền.Hiện tại, tổ chức này vẫn nắm giữ tài sản trị giá hơn 73,06 triệu USD trên chuỗi, chủ yếu bao gồm BTC, USDT và ETH.

ChainCatcher tin tức, sàn giao dịch tiền điện tử Bybit đã đệ đơn kiện dân sự lên Tòa án Liên bang khu vực Washington D.C., kiện Bắc Triều Tiên, Tổng cục Tình báo Bắc Triều Tiên và tổ chức hacker Lazarus Group, vụ án liên quan đến sự kiện bị đánh cắp khoảng 1,5 tỷ USD vào tháng 2 năm 2025. Bybit cho biết, thẩm phán đã phê duyệt lệnh cấm tạm thời, cấm chuyển nhượng hoặc xử lý tài sản bị đánh cắp đã được xác định trong thời gian xét xử vụ án, và cho rằng khả năng Bybit thắng kiện về vấn đề thực thể là khá cao.Đơn kiện cũng liệt kê các cá nhân và thực thể không xác định nắm giữ hoặc chuyển nhượng các quỹ liên quan là bị cáo John Doe. Bybit tiết lộ, khoảng 48,4 triệu USD đã được thu hồi, khoảng 30,5 triệu USD đã bị đóng băng tại hơn 28 sàn giao dịch và tổ chức lưu ký, tổng cộng chiếm khoảng 5% số tiền bị đánh cắp. Kẻ tấn công đã chuyển khoảng 500.000 ETH từ ví lạnh của Bybit vào tháng 2 năm 2025, phần lớn số tiền sau đó đã được đổi thành Bitcoin qua Thorchain và chuyển đi qua dịch vụ trộn tiền. Bybit cho biết, vụ án đang tiến hành song song với cuộc điều tra hình sự.

Tin tức từ ChainCatcher, sàn giao dịch tiền điện tử Bybit đã đệ đơn kiện dân sự đối với Cộng hòa Dân chủ Nhân dân Triều Tiên, cơ quan tình báo của họ là Cục Tổng cục Tình báo (RGB) và tổ chức hacker Lazarus Group bị quốc gia trừng phạt, liên quan đến một vụ tấn công hacker trị giá 1,5 tỷ USD.Tòa án liên bang Hoa Kỳ đã ban hành lệnh cấm tạm thời, cấm việc chuyển nhượng hoặc tiêu hủy tài sản đã được xác định liên quan đến vụ án trong thời gian kiện tụng.

Tin tức từ ChainCatcher, theo dõi của Lookonchain, nhóm hacker Lazarus đã chuyển 121,5 BTC (774 triệu USD) cách đây một giờ.

Tin tức từ ChainCatcher, theo báo cáo của Bitcoin.com, Thượng nghị sĩ Mỹ Cynthia Lummis đang thúc đẩy dự luật CLARITY hoàn thành bỏ phiếu tại Thượng viện trước khi Quốc hội nghỉ. Điều khoản 303 của dự luật trao quyền cho Bộ Tài chính thực hiện các biện pháp trừng phạt đặc biệt đối với tài sản kỹ thuật số tại các khu vực tài phán nước ngoài, điều khoản 305 cho phép các sàn giao dịch thực hiện việc đóng băng tối đa 180 ngày đối với các giao dịch nghi ngờ.Dữ liệu trên chuỗi cho thấy, nhóm Lazarus của Bắc Triều Tiên đã đánh cắp khoảng 643 triệu USD trong nửa đầu năm 2026, chiếm hai phần ba tổng số tiền bị đánh cắp trên toàn cầu trong cùng thời gian (972 triệu USD), trong đó bao gồm cuộc tấn công 285 triệu USD vào Drift Protocol vào tháng 4 và cuộc tấn công 292 triệu USD vào cầu nối KelpDAO. Tổ chức này đã tích lũy tổng số tiền đánh cắp lên tới 6.75 tỷ USD kể từ năm 2019.Hiện tại, Galaxy Research đã hạ thấp xác suất thông qua dự luật CLARITY trong năm 2026 xuống còn 30%, dự luật này cần có 60 phiếu để tiến hành, có nghĩa là ít nhất cần 7 thượng nghị sĩ đảng Dân chủ bỏ phiếu ủng hộ qua đảng.

According to Cryptopolitan, cybersecurity analysts have discovered a new type of fileless remote access trojan (RAT) named RemotePE. It is believed that the cybercrime organization Lazarus Group, associated with North Korea, is using this trojan to attack banks and cryptocurrency companies. The trojan operates entirely in memory, making it difficult for traditional antivirus and forensic tools to detect. Attackers impersonate trading company employees via Telegram, using forged Calendly and Picktime links for social engineering attacks. The malware is loaded in a three-stage chain through DPAPILoader, RemotePELoader, and RemotePE, with the entire process avoiding contact with the file system, utilizing process hollowing, anti-analysis checks, and encrypted C2 communication to evade detection.This malware was first discovered in September 2025. In the first four months of 2026, the Lazarus organization has stolen approximately $577 million in cryptocurrency assets, accounting for 76% of the total global cryptocurrency theft. Since 2017, the organization has accumulated a total theft amount of $6 billion.

According to research by OpenSourceMalware, the North Korean hacker group Lazarus has adopted new techniques in malicious activities targeting developers, such as "infectious interviews" and "TaskJacker," hiding the second-stage loader in the pre-commit scripts of Git Hooks. "Infectious interviews" is a series of attack activities where the organization lures developers into cloning malicious code repositories by faking recruitment processes in the cryptocurrency/DeFi field, ultimately stealing crypto assets and credentials.Researchers recommend that developers who are asked to clone code repositories as part of the interview process should be wary of such risks and preferably run in an isolated environment to avoid mounting personal browser configurations, SSH keys, and cryptocurrency wallets.

a16z Crypto Managing Partner Chris Dixon announced on the X platform that Eddy Lazzarin has been promoted to General Partner at a16z Crypto.Lazzarin joined a16z Crypto in 2019 as a data scientist and investment partner, and from 2023, he has served as Chief Technology Officer, leading the engineering, data science, research, and security teams, driving the development of the open-source zero-knowledge virtual machine Jolt. Lazzarin has developed a clear theoretical framework in token design and classification, helping to establish standards for understanding token operations, value accumulation, governance, and incentive mechanisms.As the new General Partner, he will focus on portfolio and token strategies, as well as identifying, evaluating, and supporting emerging crypto networks and companies, including the investment work for a16z Crypto's recently announced fifth crypto fund.

According to CoinDesk, monitoring by CertiK reveals that the Lazarus Group is conducting an attack operation named Mach-O Man targeting executives in the fintech and cryptocurrency industries. This operation utilizes ClickFix social engineering techniques, sending fake online meeting invitations to lure victims into pasting repair commands on their Mac terminals, thereby gaining access to company and financial systems.CertiK researcher Natalie Newson stated that the Lazarus Group has stolen over $500 million through attacks on Drift and KelpDAO in the past two weeks. Mach-O Man is a modular macOS malware toolkit developed by the Chollima division of the Lazarus Group, capable of automatically deleting itself after use to evade detection.Additionally, attackers have implemented this attack by hijacking DeFi project domain names and replacing them with fake Cloudflare messages.

Binance Alpha will remove the following tokens from the recommended list on January 29, 2026, at 14:00: WIZARD, SHOGGOTH, G, FWOG, UFD, BRIC, UPTOP, PORT3, XNAP, MORE, BOMB, BOOST. Users can still sell these tokens on Binance Alpha.

According to Cryptopolitan, Cardano founder Charles Hoskinson expressed skepticism in an interview about the U.S. "Digital Asset Market Clarity Act (CLARITY Act)" passing in the first quarter of 2026, and called for David Sacks, the Trump administration's head of cryptocurrency affairs, to resign. Hoskinson pointed out that since Sacks took office at the end of 2024, cryptocurrency prices have fallen, regulatory clarity has been lacking, and the industry has failed to establish a solid foundation for development.He believes that if the bill does not pass this quarter, Sacks should resign, stating that he has "let the entire industry down." Hoskinson also mentioned that if the Democrats regain control of the House in the midterm elections in November, the bill will be even less likely to pass. He criticized the current U.S. cryptocurrency policy for favoring large financial institutions over retail investors, centralizing the industry around Wall Street firms like BlackRock, Goldman Sachs, and Morgan Stanley.Additionally, Hoskinson reiterated that Trump-related cryptocurrency projects have caused market confusion, emphasizing that cryptocurrencies should remain global and neutral, rather than being nationalized or politicized. He advocates for the U.S. to establish enduring and non-restrictive cryptocurrency regulations, even if it takes longer.

The report "2025 Cyber Threat Trends and 2026 Security Outlook" released by AhnLab shows that the North Korean-backed hacker group Lazarus has been named the most frequently in the past 12 months, primarily using "spear phishing" to carry out attacks, often disguising themselves as seminar invitations, interview requests, and other emails to lure targets into opening attachments. The report states that Lazarus is considered the main suspect in several major attacks, including the Bybit hacking incident on February 21 this year (resulting in a loss of $1.4 billion) and the recent $30 million vulnerability attack on the South Korean exchange Upbit.AhnLab indicates that to enhance security, companies need to establish a multi-layered defense system, including regular security audits, timely patch updates, and strengthening employee education. The company also recommends that individual users employ multi-factor authentication, handle unknown links and attachments with caution, avoid excessive exposure of personal information, and only download content from official channels. AhnLab points out that with the widespread use of AI applications, attackers will find it easier to generate indistinguishable phishing emails, spoofed pages, and deepfake content, and related threats may further complicate in the future. (Cointelegraph)

Regarding Upbit's incident of approximately 44.5 billion KRW (about 36 million USD) in cryptocurrency being stolen, CryptoQuant CEO Ki Young Ju stated today that the attack method disclosed by Upbit is "almost impossible for an ordinary hacker to accomplish."Upbit previously mentioned that the attackers might have "inferred the private keys" by analyzing the patterns of user wallet addresses. Ki Young Ju bluntly remarked that the difficulty of such attack techniques is extremely high, and if this is true, "I suspect that no hacker organization other than North Korea's Lazarus could achieve this."

CryptoQuant CEO Ki Young Ju commented on the "Upbit hacking incident," stating that the culprit is likely the North Korean hacking group Lazarus Group. Upbit announced that it discovered a security vulnerability that allowed private keys to be inferred. "If true, I suspect that no one else besides North Korean hackers could accomplish this."

According to Yonhap News Agency, South Korean virtual asset exchange Upbit has suffered a hacker attack, resulting in the theft of virtual assets worth 44.5 billion won. Currently, the North Korean reconnaissance agency's hacker organization Lazarus Group is highly suspected to be behind this incident.Local time, Yonhap News Agency learned from the information and communication technology (ICT) industry and relevant South Korean government departments that, given the significant suspicion surrounding the hacker organization Lazarus Group under the North Korean reconnaissance agency, authorities are conducting on-site inspections of Upbit. This hacker organization was previously implicated in the theft of 58 billion won worth of Ethereum from Upbit in 2019. A government official stated, "This attack is unlikely to have targeted the server; it is more probable that the administrator account was stolen, or that the attacker disguised themselves as an administrator to transfer funds." He also mentioned, "Based on the information currently available, the hackers used this method six years ago, so it is speculated that the same method was employed this time."

The BNB Chain ecological RWA card platform SuperSuperRare announced the launch of a card-drawing-based points leaderboard system. According to the official introduction, the current points mechanism of the SSR platform is calculated based on the FMV (Fair Market Value) of the cards obtained by users during each draw, and the ranking on the leaderboard will be determined by users' drawing records and the number of cards opened.SuperSuperRare stated that this project is a TCG (trading card game) combined with RWA on-chain drawing platform. The currently available Pokémon cards are all physical Pokémon cards certified by the rating agency PSA. Users can freely choose from three options: one-click buy back, trading in the NFT market, or redeeming physical cards for offline delivery.Currently, SSR has launched an unlimited blind box drawing function. Unlike most "black box" drawing mechanisms on the market, each draw will be determined by random numbers and algorithms to fairly draw cards of different rarity levels. In the future, a blockchain-based verifiable "lucky bag" limited drawing mechanism will also be launched.Previously, on November 12, the first user of the SuperSuperRare platform drew and chose to mint the "2021 Japan 25th Anniversary Edition Shiny Charizard" card, which was minted on-chain at BNB Chain block height 67930239, becoming the platform's first on-chain Pokémon card as a real RWA asset.

ChainCatcher news, venture capital giant Andreessen Horowitz (a16z) led a $12.9 million funding round to support fintech startup ZAR in promoting dollar-backed stablecoins in Pakistan.Dragonfly Capital, VanEck Ventures, Coinbase Ventures, and Endeavor Catalyst participated in this funding round. ZAR innovatively distributes stablecoins through local convenience stores, phone booths, and remittance agents, allowing users to exchange cash for stablecoins stored in their mobile wallets by simply scanning a QR code at participating stores, which are connected to a globally usable Visa card.This model specifically targets over 100 million unbanked adults in Pakistan, without requiring users to understand blockchain or cryptocurrency technology. ZAR was co-founded by Sebastian Scholl and Brandon Timinsky, who previously sold their mobile wallet startup SadaPay to Turkey's Papara. The company has received positive early feedback in urban centers in Pakistan, with total funding reaching $20 million, and plans to expand the model to the African market by 2026.

ChainCatcher news, EurekaTrading founder Kuan Sun tweeted a review of how he nearly lost $13 million due to a phishing attack: On September 2, 2025, approximately $13 million in assets in his wallet were almost stolen by the Lazarus hacker group. The security team acted urgently and ultimately recovered the funds.The incident was triggered by what appeared to be a normal Zoom meeting invitation, which was actually a carefully arranged phishing trap. The hackers exploited "acquaintance" relationships, deepfake videos, and a forged Rabby plugin to tailor the attack against the victim, Venus. Under the mistaken belief in the fake plugin, the victim executed a withdraw, putting the assets at risk of being transferred along with liabilities. PeckShield, SlowMist, Venus, and multiple security teams responded quickly, pausing the protocol and investigating risks, ultimately preventing the theft of funds. Hardware wallets are not foolproof; there are still risks of plugin and frontend hijacking; Zoom links, upgrade pop-ups, and acquaintance relationships can all serve as entry points for attacks.

ChainCatcher news, according to The Telegraph, the UK-registered cryptocurrency platform Lykke has been forced to cease operations and liquidate in March this year after being hacked and losing approximately £17 million (about $22.8 million) in Bitcoin and Ethereum. The UK Treasury's OFSI reported that the hackers are from North Korea's Lazarus group, and the funds were used for military and nuclear projects. Lykke founder Richard Olsen has been declared bankrupt, and the case is still under investigation.