Blockchain data reviewed by CoinDesk shows wallets tied to North Korea’s Lazarus Group sold more than $30 million in bitcoin on the platform in the last three weeks alone.
Lawsuit accuses North Korea and Lazarus Group of orchestrating the $1.5 billion theft, as court-ordered asset freeze supports recovery efforts and Bybit expands collaboration with law enforcement and industry partners to strengthen accountability for crypto-related cybercrime
Bybit, the world’s second-largest cryptocurrency exchange by trading volume, today announced that it has filed a civil lawsuit in the U.S. District Court for the District of Columbia against the Democratic People’s Republic of Korea (DPRK), its Reconnaissance General Bureau (RGB), and the Lazarus Group, which U.S. authorities have identified as the DPRK-linked hacking group responsible for the February 2025 cyberattack.
Bybit has also secured a preliminary injunction freezing identified stolen assets held by the unidentified individuals and entities holding or moving those funds, named in the case as John Doe defendants. The order is intended to preserve identified stolen digital assets while the litigation continues, representing an important step in Bybit’s ongoing efforts to recover funds, support international law enforcement investigations, and reinforce accountability for large-scale cybercrime. Indeed, the court found that “Bybit has demonstrated a likelihood of success on the merits” in its lawsuit.
The legal action forms part of a broader strategy combining blockchain intelligence, international cooperation, and judicial remedies to pursue the illicit actors responsible for what the court, in granting the initial temporary restraining order, described as “one of the largest cryptocurrency thefts in history.” While criminal investigations remain the responsibility of government authorities, the civil proceedings provide an additional avenue for preserving assets and protecting the interests of affected stakeholders.
“Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” said Ben Zhou, Co-founder and CEO of Bybit. “The Lazarus attack wasn’t just an attack on Bybit. It was an attack on trust in our industry. That’s why we’ve worked closely with investigators, exchanges, regulators, law enforcement, and now the courts. We hope this marks another step toward making crypto a much harder place for criminals to operate in and a much safer place for everyone else.”
Strengthening Accountability Through Legal Action
The preliminary injunction prohibits the transfer or dissipation of identified assets connected to the case while litigation continues. Bybit intends to seek additional judicial relief as the proceedings advance.
The civil action is being pursued independently of ongoing criminal investigations conducted by U.S. law enforcement authorities. Bybit continues to cooperate closely with relevant agencies, including the FBI, by sharing blockchain intelligence and investigative findings that may support broader enforcement efforts.
As digital assets increasingly become a target of sophisticated cross-border cybercrime, the company believes legal remedies, alongside criminal enforcement, can play an important role in preserving recoverable assets and strengthening accountability.
Global Collaboration Driving Asset Recovery
Since the February 2025 incident, Bybit has worked alongside blockchain analytics firms, exchanges, custodians, and international law enforcement agencies to trace stolen assets and disrupt laundering networks.
To date:
- Approximately US$48.4 million in stolen assets has been recovered.
- Over approximately US$30.5 million has been frozen across more than 28 exchanges and custodians, pending further legal and investigative action.
These efforts have also supported broader enforcement actions targeting infrastructure allegedly used to launder stolen funds. Authorities in Germany dismantled the cryptocurrency exchange eXch, while German and Swiss authorities later disrupted Cryptomixer.io, removing key channels used to move illicit proceeds. Together, these actions demonstrate the impact of effective cooperation between the private sector and law enforcement in combating transnational cybercrime.
“The real test comes after the crisis,” Ben added. “That’s when you show whether your commitment is real. For us, that means continuing to strengthen our security, working hand in hand with investigators and industry partners, and doing everything we can to protect our users. Trust isn’t something you claim. You have to earn it through action, every single day.”
Building a More Resilient Digital Asset Ecosystem
The legal proceedings represent one component of Bybit’s broader commitment to improving security standards across the cryptocurrency industry. The company continues to invest in advanced blockchain intelligence capabilities, deepen cooperation with exchanges and regulators, and support initiatives aimed at making digital asset theft increasingly difficult, traceable and costly for criminal organisations.
This action reflects Bybit’s commitment to holding state-sponsored threat actors accountable and using all available legal avenues, both civil and in cooperation with law enforcement, to disrupt cybercrime targeting the digital asset industry.
The civil proceedings remain ongoing. Bybit will continue to cooperate with relevant authorities and provide updates as permitted by the court.
#NewFinancialPlatform
About Bybit
Bybit is The New Financial Platform.
We believe every person should have access to every financial opportunity on earth. That’s why we’re building the first intelligent platform that connects anyone, anywhere to the world’s finance.
Trusted by more than 80 million users worldwide, Bybit brings together investing, trading, payments, and wealth-building in a single secure and intelligent ecosystem. Through the combination of AI-powered technology, deep global liquidity, robust security, and transparent operations, Bybit makes global finance more accessible, efficient, and empowering for everyone.
Built for everyone. Powered by intelligence. Open to the world.
Learn more at Bybit.com.
For more details about Bybit, please visit Bybit Press
For media inquiries, please contact: media@bybit.com
For updates, please follow: Bybit’s Communities and Social Media
Discord | Facebook | Instagram | LinkedIn | Reddit | Telegram | TikTok | X | Youtube
A contractor brought in through a third-party provider worked on MetaMask code from March 9 until Consensys cut off access in April. Consensys later described the person as linked to North Korea.
Consensys said its investigation found no misappropriation of assets or data, no malicious code deployment and no impact to user safety or security. General counsel Matt Corva said the company identified the threat quickly, terminated access, launched a comprehensive investigation and notified law enforcement.
Drop Site reported that an internal April alert ordered all product releases suspended pending the investigation and told staff not to interact with the consultant. Corva called the service provider relationship reputable and said Consensys has since reviewed its third-party service practices, so the rigorous standards applied to employees also cover more complex outside relationships.
Contractor checks need repository limits
The incident gives no indication that user accounts or wallet assets were compromised. Consensys’ existing relationship with the vendor still left a gap: every contractor and account needed its own safeguards.
MetaMask’s general security guidance warns that malicious workers can use false identities and forged documents to obtain remote roles. It recommends checks using actual documents, multiple interviews, hardware authentication, IP and location verification, reference checks, and limits on access to critical systems.
The FBI has separately warned that North Korean IT workers have used company-network access to copy code repositories. Its guidance calls for identity verification during interviews, onboarding and throughout employment, routine audits of third-party staffing firms, least-privilege access and monitoring for unusual remote connections or repository exfiltration.
After onboarding, repository permissions and review become the core safeguards. UK National Cyber Security Center guidance recommends making repository activity attributable, reviewing every production-bound change, applying extra scrutiny to external contributions, and revoking access quickly when it is no longer required. Hardware-backed credentials can protect an account from credential theft, while tightly scoped permissions and independent review limit what an authorized account can change.
CryptoSlate reported on July 5 that operational compromises around keys, custody, signing and approval systems accounted for roughly 76% of stolen value during the first half of 2026, even though smart-contract exploits were more frequent. That gap shows why access and operational controls matter even when they account for fewer incidents.
Wallet and protocol teams should treat contractor access as continuously conditional. Identity checks should extend through employment, third-party firms should be audited, repository privileges should remain narrow and observable, every production-bound change should receive independent review, and access should be revoked as soon as it is no longer required.
Consensys’s April release pause also shows the value of retaining a predefined way to halt changes while suspicious access is investigated.
A malicious attachment delivered through a phishing email points to the involvement of North Korea-linked threat actors in Humanity Protocol’s recent hack, according to blockchain security company Quantstamp.
The decentralized identity company said a compromised employee’s laptop enabled attackers to steal $36 million in Humanity (H) tokens on Monday.
The malicious attachment was disguised as a token lockup schedule update from South Korean cryptocurrency exchange Bithumb. It installed malware that gave attackers full remote access to the laptop, Quantstamp said in its incident response.
The phishing email that led to the Humanity Protocol compromise. Source: Quantstamp
Quantstamp added that the malware was signed with a South Korean Hancom digital certificate, a pattern it described as “characteristic of DPRK intrusions.” The malware enabled attackers to copy Humanity Protocol director Chong Yee Wai’s MetaMask wallet credentials and private keys.
The suspected North Korean link would add to a series of major crypto thefts attributed to the country. North Korea-linked threat actors were tied to at least $578 million of the $634 million stolen in crypto-related incidents in April.
North Korean hackers tied to some of the largest crypto hacks
According to a May report by blockchain security company CertiK, the same actors have been linked to about $2 billion of the $3.4 billion lost to crypto exploits in 2025, while accounting for 12% of total incidents. CertiK said the figures reflect a focus on “precision and scale.”
Over the past decade, North Korea-linked actors stole an estimated $6.75 billion in cryptocurrency across 263 documented incidents, the report said.
Related: CZ sounds alarm as ‘SEAL’ team uncovers 60 fake IT workers linked to North Korea
CertiK added that North Korea has “industrialized” crypto theft into a core state revenue mechanism, making these operations a substantial share of the regime’s external income.
Total DPRK crypto theft over the years. Source: CertiK/Skynet
North Korea rarely responds to cybercrime allegations, but on May 3, a Foreign Ministry spokesperson rejected them in a statement carried by the Korean Central News Agency, the country’s state media.
The spokesperson accused the US of spreading “incorrect” narratives about the “non-existent ‘cyber threat’” from North Korea.
Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why
Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.
Former Democratic Gov. Roy Cooper has a sizeable lead in both polls and prediction markets in a state that has leaned Republican.
Prediction markets are showing North Carolina could be a prime spot for Democrats to pick up a key Senate seat in the 2026 midterms.
President Donald Trump carried the Tar Heel State comfortably in 2024, Republicans have a registration edge, and sitting Republican Sen. Thom Tillis survived a brutal 2020 cycle by the skin of his teeth. And yet, with Tillis retiring, prediction markets are showing this as a pretty solid Democratic flip opportunity.
It’s a key race in the push for the Democrats to retake the Senate, along with states like Ohio and Maine. Heading into the midterms, the state seemed like a safe bet to stay Red. Now, both polls and markets are showing it as a likely blue flip.
So far, the race is a masterclass in candidate quality from former Democratic Gov. Roy Cooper. It is exactly the kind of race where prediction markets have consistently stayed ahead of conventional wisdom.
Prediction markets on North Carolina senate
Polymarket‘s North Carolina Senate Election Winner contract sits at Democrats 83%, Republicans 17%, albeit on just $56K in volume. Kalshi’s North Carolina Senate market is a bit more defined with over $237K in volume, and aligns at a similar 85% to 15% probability.
Volume is slowly building post-primary as traders are locking in on the Cooper lead.
Kalshi also lists North Carolina among the cycle’s notable Senate contests, which gives it a presence in the broader closest races layer, even though the odds suggest this one may not be close at all.
How this race came together
The opening came when Tillis announced he would not seek re-election. That handed Democrats their most recruitable opportunity in North Carolina in several cycles. Cooper, a two-term governor, had spent eight years building a crossover brand in Raleigh, winning re-election in 2020 even as Trump carried the state.
Now, the Senate vacancy was too good to pass up.
Republicans went the opposite direction. Republican National Committee Chair Michael Whatley, Trump’s hand-picked RNC chair and a North Carolina native, cleared the GOP primary decisively.
On paper, a Trump-backed national party chairman running for Senate in a red-leaning state against a former governor should be competitive.
The polling picture is lopsided and consistent
What makes the Cooper-Whatley matchup interesting is that the polling gap has not just been consistent, it has been consistent across multiple polling outfits over several months. That kind of durability can move market odds.
High Point University and YouGov had Cooper up 50% to 42% in early April. In the most recent poll, Opinion Diagnostics showed 50.4% to 41.4% in late April, confirming a steady 9-point Cooper lead.
Elon University’s poll added important context. Cooper’s name recognition sits at 70%, compared to Whatley’s 35%. That gap matters because late-deciding voters in a purple state tend to break toward the candidate they actually know, and right now that is Cooper by a wide margin.
And perhaps more importantly, in a time of an unpopular Republican president, independents are breaking 15 to 20 points for the former governor. That could play out to be a structural advantage that sustains leads in North Carolina beyond Election Day.
Republican counterpunching: The probe
The GOP’s response has followed a familiar pattern. With Whatley struggling to generate his own momentum, Republican lawmakers launched a formal probe into Cooper’s gubernatorial record. They are alleging mismanagement and ethical concerns.
It is the playbook you would expect from a party that recognizes its candidate is underwater. It’s a pitch in hopes that a favorable partisan environment eventually corrects the gap.
The probe may still land blows as opposition research can move a race, but so far, the polls are holding. And beyond the polls, the markets are not pricing in a meaningful Whatley comeback.
Why North Carolina senate race matters
Tillis won this seat in 2020 by 1.8 points in a Democratic wave year. North Carolina, in theory, carries a substantial GOP partisan lean. Still, markets are pricing a double-digit polling edge for the Democrats. They aren’t just a bet on Cooper’s strength but on Whatley’s ceiling being genuinely low.
North Carolina is the cleanest argument that candidate quality is a dominant variable in 2026’s most competitive Senate races. Cooper is not running as a national Democrat. He is running as a known, trusted governor with a bipartisan record in a state that has regularly split its tickets. Whatley is running as the face of the national Republican party in a cycle where that brand carries real baggage outside deep-red areas.
Prediction markets picked up on that dynamic early, and the polling has continued to validate the move.
Over the weekend, hackers stole more than $290 million in cryptocurrency from Kelp DAO, a protocol that allows users to earn yields on idle crypto investments.
By Monday, LayerZero, one of the projects affected by the hack, accused North Korea of carrying out the heist. The hack is now the largest crypto theft of the year so far, following an earlier hack at crypto exchange Drift in April that netted hackers around $285 million.
Per its post on X, LayerZero said the hackers exploited Kelp DAO via its LayerZero bridge, which allows different blockchains to send instructions to each other. The hackers then took advantage of Kelp’s own security configuration, which did not require multiple verifications before approving transactions. That allowed the hackers to siphon off the funds with fraudulent transactions.
The company cited “preliminary indicators” that point to North Korea as the culprit, in particular its hacking group that targets crypto known as TraderTraitor.
Kelp DAO responded to LayerZero blaming it for the theft instead.
In the last few years, North Korean hackers working for Kim Jong Un’s regime have become highly successful at stealing crypto. Last year, North Korean hackers stole more than $2 billion in crypto. Overall, since 2017, the total amount of stolen crypto by North Korea is said to be around $6 billion.
Drone Data Services
Market Overview
The global Drone Data Services Market reached US$ 2.46 billion in 2024 and is projected to reach US$ 24.58 billion by 2032, growing at an impressive CAGR of 33.34% during the forecast period (2025-2032). Drone data services leverage unmanned aerial vehicles (UAVs) equipped with high-resolution cameras, sensors, and LiDAR systems to collect, process, and analyze aerial data. These services enhance operational efficiency, reduce project costs, and improve accuracy in critical decision-making across industries such as agriculture, construction, mining, energy, logistics, and environmental monitoring. By enabling real-time data acquisition and 3D mapping, drone data solutions are becoming integral to precision-driven industries seeking enhanced visibility and resource optimization.
Get a Free Sample PDF Of This Report (Get Higher Priority for Corporate Email ID):-https://www.datamintelligence.com/download-sample/drone-data-services-market?juli
Market expansion is fueled by the growing need for accurate, efficient, and scalable data collection solutions, especially in sectors embracing digital transformation and automation. For example, in agriculture, drones are increasingly used for precision farming, monitoring crop health, irrigation patterns, and yield estimation. In the construction sector, drones streamline project planning, surveying, and progress tracking, while in logistics and energy, they enable asset inspection and infrastructure management.
Regulatory advancements such as Federal Aviation Administration (FAA) frameworks in the United States and European Union Aviation Safety Agency (EASA) rules have also played a pivotal role in expanding commercial drone operations. By providing structured operational guidelines and safety protocols, these frameworks have increased enterprise confidence and accelerated large-scale adoption of drone-based data solutions globally.
Recent Developments:
✅ January 2026 – United States: A leading drone analytics provider launched an AI-enhanced data processing platform that integrates real-time aerial imagery with predictive insights for construction progress and safety monitoring.
✅ November 2025 – Europe: A major drone services company unveiled a cloud-based data management suite for agriculture and infrastructure sectors, enabling cross-platform integration with GIS and farm-management systems.
✅ September 2025 – Japan: A tech consortium implemented autonomous flight scheduling and automated data capture services for energy grid inspections, reducing manual intervention and improving asset reliability.
✅In February 2024, Skyports Drone Services (Skyports) and Ground Control have announced a new drone survey and AI data capture service with Network Rail. By collecting important environmental data like vegetation growth, tree health and type, the service helps UK railway infrastructure owners make informed decisions about vegetation management.
Mergers & Acquisitions:
✅ January 2026 – United States: A leading drone data analytics company acquired a U.S.-based aerial intelligence platform provider to expand its turnkey services in construction, agriculture, and energy sectors.
✅ October 2025 – Europe: A major European unmanned systems firm completed the acquisition of a drone GIS and mapping services specialist, enhancing its end-to-end data collection and analytics capabilities.
✅ August 2025 – Japan: A regional technology integrator acquired a drone operations and data interpretation startup to strengthen its presence in autonomous inspection services for industrial infrastructure.
Buy Now & Unlock 360° Market Intelligence:-https://www.datamintelligence.com/buy-now-page?report=drone-data-services-market?Juli
Key Players:
4DMapper, Agribotix, DJI, Delair-Tech SAS, Hexcel Corporation, Pyrotek Inc., SABIC, Teijin Ltd., Toray Industries, Inc., and Victrex plc.
Market Segmentation:
By Service:
Mapping and Surveying services dominate the market with a 35% share, driven by strong demand in construction, mining, and agriculture for accurate topographical data and 3D modeling. Inspection and Monitoring account for 25%, primarily used in infrastructure, energy, and utility asset management. Aerial Photography and Videography hold 20%, with rising adoption in real estate, tourism, and media production. Other services-such as data processing, modeling, and consulting-make up the remaining 20%, catering to niche industrial and research applications.
By Platform:
Cloud-based platforms lead the market with a 55% share, as enterprises increasingly prefer scalable and accessible data storage and analytics solutions that enable real-time collaboration. On-premise platforms represent 30%, favored by organizations requiring high data security and control. Hybrid platforms, integrating local processing with cloud-based analytics, hold 15%, offering flexibility and performance optimization for large-scale industrial projects.
By Application:
Construction and Infrastructure hold the largest share at 32%, leveraging drones for surveying, site monitoring, and project progress tracking. Agriculture follows with 25%, where drone data supports precision farming, irrigation analysis, and crop health monitoring. Energy and Utilities contribute 18%, using drones for pipeline, powerline, and wind turbine inspections. Environmental Monitoring and Disaster Management represent 15%, aiding in terrain analysis and post-disaster assessments. The remaining 10% comes from Logistics, Mining, and Real Estate, where drones are deployed for asset mapping and performance analytics.
By End-User:
Commercial enterprises dominate with a 45% share, using drone data services to optimize operations and improve productivity. Government and Defense sectors account for 25%, adopting drones for surveillance, border monitoring, and disaster management. Agriculture and Forestry hold 20%, integrating drones for yield analysis and land resource planning. The remaining 10% is contributed by research institutions and environmental organizations employing drones for scientific data collection and analysis.
Speak to Our Analyst and Get Customization in the report as per your requirements:-https://www.datamintelligence.com/customize/drone-data-services-market?Juli
Regional Insights:
North America:
North America dominates the global drone data services market, accounting for approximately 38% of the total share in 2024. The region’s growth is fueled by early adoption of drone technologies across construction, agriculture, and energy sectors, supported by well-established regulatory frameworks such as the Federal Aviation Administration (FAA) Part 107 regulations. The United States leads the market, with enterprises leveraging drone-based data analytics for infrastructure inspection, precision farming, and logistics monitoring. The presence of leading drone manufacturers and data service providers, coupled with government initiatives promoting unmanned aerial systems (UAS) innovation, continues to drive market expansion across the region.
Europe:
Europe holds around 26% of the global market share, driven by strong growth in infrastructure monitoring, environmental management, and renewable energy projects. Countries like Germany, France, and the United Kingdom are at the forefront of adopting drone data solutions, supported by the European Union Aviation Safety Agency (EASA) regulations that ensure safe and standardized drone operations. The growing focus on smart city initiatives, climate monitoring, and precision agriculture further accelerates adoption.
Asia-Pacific:
Asia-Pacific is the fastest-growing region, with a market share of approximately 25%, propelled by rapid industrialization, urban expansion, and the integration of drone technologies in agriculture and construction. China, Japan, India, and Australia are key contributors. Governments in the region are actively promoting Drone-as-a-Service (DaaS) business models and digital transformation initiatives. For instance, India’s Drone Shakti program and Japan’s urban air mobility initiatives are catalyzing the regional drone ecosystem.
Market Dynamics:
Driver: Cost-Effective and High-Precision Data Collection
The global drone data services market is expanding rapidly due to the increasing need for accurate, efficient, and cost-effective data acquisition across multiple industries such as agriculture, construction, mining, and environmental monitoring. According to the International Civil Aviation Organization (ICAO), drone data services are emerging as a vital component of digital transformation strategies, supporting operational visibility and resource optimization.
Service providers are integrating artificial intelligence (AI) and machine learning (ML) algorithms into their platforms to analyze large datasets in real time, improving accuracy and data interpretation. These innovations enable applications such as precision farming, infrastructure assessment, and resource exploration. The development of high-performance drones equipped with LiDAR, multispectral, and thermal imaging sensors is also enhancing the value proposition of drone data services, particularly in environmental management and disaster response.
Moreover, drones are increasingly capable of operating in challenging environments from high altitudes to extreme weather conditions broadening their use cases. Research published in the Journal of Remote Sensing demonstrated that LiDAR-equipped drones can achieve up to 95% accuracy in terrain mapping, even in dense vegetation. This level of precision and adaptability is becoming indispensable as industries prioritize operational efficiency, environmental safety, and data reliability for strategic decision-making.
Restraint: High Cost of Deployment and Stringent Government Regulations
Despite its rapid adoption, the drone data services market faces challenges related to high deployment costs and regulatory constraints. The cost of acquiring and operating professional-grade drones varies significantly, with commercial units ranging between US$ 10,000 and US$ 50,000, depending on payload capacity and sensor sophistication. Additionally, advanced imaging sensors such as LiDAR and thermal cameras can cost US$ 1,000 to US$ 5,000 each, further elevating operational expenses for service providers and end users.
Regulatory frameworks add another layer of complexity. In the United States, the Federal Aviation Administration (FAA) imposes strict operational and safety requirements, including Remote Pilot certification, airspace authorization, and flight operation limits under Part 107. Compliance often leads to additional administrative and training costs. Similarly, in Europe, the General Data Protection Regulation (GDPR) enforces stringent data handling and privacy standards, affecting how aerial imagery and geospatial data are stored and utilized.
📌 Request for 2 Days FREE Trial Access: https://www.datamintelligence.com/reports-subscription
☛ Power your decisions with real-time competitor tracking, strategic forecasts, and global investment insights all in one place.
✅ Competitive Landscape
✅ Sustainability Impact Analysis
✅ KOL / Stakeholder Insights
✅ Unmet Needs & Positioning, Pricing & Market Access Snapshots
✅ Market Volatility & Emerging Risks Analysis
✅ Quarterly Industry Report Updated
✅ Live Market & Pricing Trends
✅ Import-Export Data Monitoring
☛ Have a look at our Subscription Dashboard: https://www.youtube.com/watch?v=x5oEiqEqTWg?Juli
Contact Us –
Company Name: DataM Intelligence
Contact Person: Sai Kiran
Email: Sai.k@datamintelligence.com
Phone: +1 877 441 4866
Website: https://www.datamintelligence.com
About Us –
DataM Intelligence is a Market Research and Consulting firm that provides end-to-end business solutions to organizations from Research to Consulting. We, at DataM Intelligence, leverage our top trademark trends, insights and developments to emancipate swift and astute solutions to clients like you. We encompass a multitude of syndicate reports and customized reports with a robust methodology.
Our research database features countless statistics and in-depth analyses across a wide range of 6300+ reports in 40+ domains creating business solutions for more than 200+ companies across 50+ countries; catering to the key business research needs that influence the growth trajectory of our vast clientele.
This release was published on openPR.
Joerg Hiller
Jan 02, 2026 19:03
Bitfarms has announced the sale of its Paso Pe site in Paraguay for up to $30 million, marking its complete exit from Latin America to focus on HPC/AI infrastructure in North America.
Bitfarms Ltd. (NASDAQ/TSX: BITF), a prominent North American energy and digital infrastructure company, has announced its strategic decision to exit the Latin American market by selling its 70 MW Paso Pe site in Paraguay. This move is part of Bitfarms’ broader strategy to focus its efforts and resources on expanding its high-performance computing (HPC) and artificial intelligence (AI) infrastructure in North America, according to GlobeNewswire.
Strategic Sale and Reinvestment
The sale agreement, which involves the Sympatheia Power Fund (SPF), a Singapore-based crypto infrastructure fund managed by Hawksburn Capital, values the Paso Pe site at up to $30 million. Bitfarms is set to receive $9 million in cash at the closing of the transaction, expected in the first quarter of 2026, alongside up to $21 million over the following 10 months, contingent on certain milestones.
Bitfarms CEO Ben Gagnon expressed satisfaction with the sale, highlighting its role in rebalancing the company’s energy portfolio to be 100% North American. “This transaction accelerates our plans to reinvest capital into our North American HPC/AI energy infrastructure in 2026, where we anticipate stronger returns,” Gagnon stated.
Impact on Bitfarms’ Operations
With this sale, Bitfarms aims to enhance its liquidity profile and expedite the monetization of its operations, which will now be concentrated entirely in North America. The company’s updated energy portfolio will include a 341 MW energized capacity, 430 MW under active development, and a 2.1 GW multi-year pipeline, predominantly based in the United States.
The transition is expected to enable Bitfarms to focus more on its core capabilities in digital infrastructure for HPC/AI, a sector where the company expects to see significant growth and profitability.
About Bitfarms and Sympatheia Power Fund
Founded in 2017, Bitfarms has established itself as a leader in digital infrastructure, operating state-of-the-art data centers and energy infrastructure for high-performance computing and Bitcoin mining across the Americas. The company is headquartered in New York, NY, and Toronto, ON, and is publicly traded on the Nasdaq and Toronto Stock Exchange.
Sympatheia Power Fund, the buyer of the Paso Pe site, is focused on expanding its regional presence in Latin America. SPF representative Josh Murchie emphasized the importance of a seamless transition, ensuring operational continuity at the site as SPF embarks on its next phase of growth.
Image source: Shutterstock
A new cyber threat is emerging from North Korea as its state-backed hackers experiment with embedding malicious code directly into blockchain networks.
Google’s Threat Intelligence Group (GTIG) reported on October 17 that the technique, called EtherHiding, marks a new evolution in how hackers hide, distribute, and control malware across decentralized systems.
Sponsored
Sponsored
What is EtherHiding?
GTIG explained that EtherHiding allows attackers to weaponize smart contracts and public blockchains like Ethereum and BNB Smart Chain by using them to store malicious payloads.
Once a piece of code is uploaded to these decentralized ledgers, removing or blocking it becomes nearly impossible due to their immutable nature.
“Although smart contracts offer innovative ways to build decentralized applications, their unchangeable nature is leveraged in EtherHiding to host and serve malicious code in a manner that cannot be easily blocked,” GTIG wrote.
In practice, the hackers compromise legitimate WordPress websites, often by exploiting unpatched vulnerabilities or stolen credentials.
After gaining access, they insert a few lines of JavaScript—known as a “loader”—into the website’s code. When a visitor opens the infected page, the loader quietly connects to the blockchain and retrieves malware from a remote server.
GTIG pointed out that this attack often leaves no visible transaction trail and requires little to no fees because it happens off-chain. This, in essence, allows the attackers to operate undetected.
Sponsored
Sponsored
Notably, GTIG traced the first instance of EtherHiding to September 2023, when it appeared in a campaign known as CLEARFAKE, which tricked users with fake browser update prompts.
How to Prevent the Attack
Cybersecurity researchers say this tactic signals a shift in North Korea’s digital strategy from merely stealing cryptocurrency to using blockchain itself as a stealth weapon.
“EtherHiding represents a shift toward next-generation bulletproof hosting, where the inherent features of blockchain technology are repurposed for malicious ends. This technique underscores the continuous evolution of cyber threats as attackers adapt and leverage new technologies to their advantage,” GTIG stated.
John Scott-Railton, a senior researcher at Citizen Lab, described EtherHiding as an “early-stage experiment.” He warned that combining it with AI-driven automation could make future attacks much harder to detect.
“I expect attackers to also experiment with directly loading zero click exploits onto blockchains targeting systems & apps that process blockchains… especially if they are sometimes hosted on the same systems & networks that handle transactions / have wallets,” he added.
This new attack vector could have severe implications for the crypto industry, considering North Korean attackers are significantly prolific.
Data from TRM Labs shows that North Korean-linked groups have already stolen more than $1.5 billion in crypto assets this year alone. Investigators believe those funds help finance Pyongyang’s military programs and efforts to evade international sanctions.
Given this, GTIG advised crypto users to reduce their risk by blocking suspicious downloads and restricting unauthorized web scripts. The group also urged security researchers to identify and label malicious code embedded within blockchain networks.
North Korean hackers have adopted a method of deploying malware designed to steal crypto and sensitive information by embedding malicious code into smart contracts on public blockchain networks, according to Google’s Threat Intelligence Group.
The technique, called “EtherHiding,” emerged in 2023 and is typically used in conjunction with social engineering techniques, such as reaching out to victims with fake employment offers and high-profile interviews, directing users to malicious websites or links, according to Google.
Hackers will take control of a legitimate website address through a Loader Script and embed JavaScript code into the website, triggering a separate malicious code package in a smart contract designed to steal funds and data once the user interacts with the compromised site.
The compromised website will communicate with the blockchain network using a “read-only” function that does not actually create a transaction on the ledger, allowing the threat actors to avoid detection and minimize transaction fees, Google researchers said.
The report highlights the need for vigilance in the crypto community to keep users safe from scams and hacks commonly employed by threat actors attempting to steal funds and valuable information from individuals and organizations alike.
Related: CZ’s Google account targeted by ‘government-backed’ hackers
Know the signs: North Korea social engineering campaign decoded
The threat actors will set up fake companies, recruitment agencies and profiles to target software and cryptocurrency developers with fake employment offers, according to Google.
After the initial pitch, the attackers move the communication to messaging platforms like Discord or Telegram and direct the victim to take an employment test or complete a coding task.
“The core of the attack occurs during a technical assessment phase,” Google Threat Intelligence said. During this phase, the victim is typically told to download malicious files from online code repositories like GitHub, where the malicious payload is stored.
In other instances, the attackers lure the victim into a video call, where a fake error message is displayed to the user, prompting them to download a patch to fix the error. This software patch also contains malicious code.
Once the malicious software is installed on a machine, second-stage JavaScript-based malware called “JADESNOW” is deployed to steal sensitive data.
A third stage is sometimes deployed for high-value targets, allowing the attackers long-term access to a compromised machine and other systems connected to its network, Google warned.
Magazine: Inside a 30,000 phone bot farm stealing crypto airdrops from real users
