Pixeos

☕️ BTC flatlines, Bitget's hot wallet drained, $9.3M strolls out of Neutron

BTC parked at $84,225.68, up 0.06% in 24h — a flatline so limp it barely qualifies as a market. ETH sits at $2,681.01, down 0.35%. All the pumps and all the blood happened in alts.

▪️ Gainers: XPL +26.8% ($44M), ONDO +25.0% ($136M), BROCCOLI714 +17.1%, FET +13.9%, XLM +8.5%. ONDO's volume is triple XPL's — that's real money, not a wick.
▪️ Losers: SAGA -29.4% ($71M), NIL -16.9%, NOM -8.8%, LSK -6.9%, PENGU -5.1%. SAGA bled out on the day's heaviest volume — somebody was leaving fast.
▪️ Bitget's hot wallet: roughly $19.7M in USDT swapped into ETH in under six minutes. No reimbursement plan, no attacker named.
▪️ A Brooklyn man got 12 years for stealing $16M from Coinbase users. Legal win; the coins are still gone.
▪️ Neutron passed proposal #9 on Sept 22 — 11 'Update Admin' actions that let governance flip control of a contract's admin.
▪️ Same day, SlowMist logged $4.9M gone at Astroport and $4.4M at Drop: $9.3M combined, tied to that governance batch.

Fear & Greed reads 71 — Greed, identical to yesterday. Two flat days in a row means nobody's panicking and nobody's euphoric, which is exactly when one headline liquidates the crowd. Watch whether Bitget makes users whole, and whether anyone links that Neutron admin batch to the $9.3M — right now it's implication and silence.

🔮 Six minutes to move $19.7M out of Bitget, still no statement. Ask who eats that loss. Hint: not them.

@pixeos

🪤 Neutron DAO nodded through 11 admin swaps — and $9.3M walked off Astroport and Drop the same day

Proposal #9, Sept 22. Neutron DAO waves it through, and wouldn't you know it — the same day SlowMist clocks $9.3M gone on that chain. Astroport on one side, Drop on the other. And the proposal payload? Right there on the explorer, no decoder ring needed: 11 "Update Admin" actions. That's the exact switch that lets governance hand a contract's administrator role to somebody else. Not a bug. A built-in feature, and you're the exit liquidity.

▪️ Neutron's docs themselves call its DAO the network's top governing authority — able to execute messages via governance. Admin keys sit above the apps, not inside them.
▪️ Proposal title, straight off the explorer: "AIATO: AI Agent Takeover. Phase 1: Agent Admin Registration." Yeah. That's the one that passed.
▪️ You meet Astroport and Drop as separate products. On the chain layer, one governance action reaches the administrator of either one. Two apps, one master key — cute, huh?
▪️ Protos, Sept 23: network halts stranded most of the affected assets, but the attacker had already walked off with roughly one-fifth of it. Poof.
▪️ Combined $9.3M is an estimate across two incidents, not a settled loss. Contained assets aren't returned assets, and a halt isn't a refund. Write that on your monitor.

📊 Astroport: $4.9M
📊 Drop: $4.4M

If you're LPing or farming on Neutron, the audit you read on Astroport covered none of this — the chain's governance sits above the app contracts with admin power, and that's the door nobody locks. Halts contained most of the funds, but freezing isn't restoring, and whatever the attacker pulled is gone. Watch the recovery math: which assets stayed contained, which got restored, which left defenders' reach. That's the only number victims actually care about. Everything else is damage-control PR.

🔮 An "AI Agent Takeover" proposal passed and millions vanished the same day. Total coincidence, I'm sure. Check who holds admin on your chain. On any chain, honestly.

@pixeos

📉 BTC slides to $84K while a fake wallet app skims $580K

BTC is down 3.12% to $84,224, ETH down 2.85% to $2,692 — and the pain ain't evenly spread: alt bags are getting gutted. An iPhone app sold as a read-only wallet monitor, FomoPeek, quietly drained nearly $580K from the wallets it was watching. Zcash, meanwhile, ripped past $1,600 for the first time since 2016.

▪️ NIL +35.2% on just $36M of volume — the top gainer, and that thin tape means it moves on air.
▪️ Losers: UNI -10.9% on $148M volume, PEPE -11.6% on $77M, ARB -11.4%, MUBARAK -27.2%, TRUMP -10.3%.
▪️ ZEC: 21shares listed Europe's first Zcash ETP on Euronext Paris and Amsterdam; the token cleared $1,600 for the first time since 2016, now ~$1,622, +8%.
▪️ FomoPeek posed as a read-only wallet monitor but carried code that could reach other apps and wallet data; the attacker's wallet pulled in nearly $580K.
▪️ BlackRock ETF clients bought $51M of ETH — institutions keep buying the dip retail is dumping.
▪️ Also green: ZRO +10.8% ($38M), LTC +6.7% ($73M), SAGA +4.4% ($24M), INJ +1.8% ($23M).

Fear & Greed sits at 71 — Greed, unchanged from yesterday: the crowd hasn't capitulated, so there's still fuel for the flush. If this level cracks, leveraged longs in PEPE and ARB get liquidated first. Note who's buying what retail dumps: BlackRock's ETF clients just took $51M of ETH.

🔮 FomoPeek sailed through App Store review while skimming wallets. Read-only, my ass — audit the app, not the pitch.

@pixeos

📱 Apple approved this 'read-only' wallet monitor twice. It shipped malware.

FomoPeek was sold as a read-only on-chain monitor — connect nothing, hand over no seed phrase. Cute. Two official App Store builds carried modules that bypass iOS protections, scoop data out of other apps and ship it to a remote server. The wallet SlowMist tags as the attacker's has taken in 579,984.34 USDT across several blockchain networks since it went live on Sept 15.

▪️ SlowMist and OKX's security team opened the case after reports of stolen assets and exposed private keys, and published the analysis on Sept 20. So the cleanup started only after the damage was done.
▪️ The app and the malicious modules share one Apple developer signature and kept their App Store encryption records — proof it shipped through Apple, not a sideloaded copy.
▪️ One module pulled an encrypted command server address from Bitbucket, phoned home with the iPhone's specs, then waited for orders on what to grab. Classic staging.
▪️ Exploitation was off in the test; researchers flipped it on in an isolated box, got a hit list of 19 wallet and note-taking apps, and captured an Apple Notes upload.
▪️ Buried in the code: a strategy named DarkSwordStrategy, same name as the DarkSword iOS exploit chain Google Threat Intelligence Group documented in March. Because why not reuse branding.
▪️ SlowMist's figure is the wallet's total receipts across chains, not a confirmed tally of what FomoPeek stole — and funds were still arriving when the report dropped.

📊 Attacker wallet live since: Sept 15
📊 Malicious builds: 1.1 (Sept 9), 1.2 (Sept 12)
📊 Cleaned in: 1.3, Sept 17

Anyone who ran FomoPeek 1.1 or 1.2 is still exposed after deleting it — whatever left the phone can't be recalled, so treat every seed phrase, private key and credential on that device as burned. Apple's review cleared the modules twice. And it's not a one-off: in July three investors blamed a counterfeit Sparrow Wallet app after typing in their recovery phrases, and in April an investigator tied a fake Ledger app to reported thefts. The badge isn't a firewall.

💬 «read-only on-chain monitoring and alerting tool» — FomoPeek's App Store description

🔮 Apple greenlit this thing twice and only pulled it after researchers screamed. Your seed phrase doesn't care about the App Store badge.

@pixeos

🔥 ZEC blasts past $1,600 for the first time since 2016 — Europe just got its first ZEC ETP

ZEC cleared $1,600 Tuesday, first time since 2016 — and the trigger wasn't a perp squeeze, it was Europe. Hours earlier 21shares listed the continent's first physically backed Zcash ETP on Euronext Paris and Amsterdam, while Grayscale's US spot fund is hoovering up cash fast enough to need a 3-for-1 split.

▪️ 21shares listed the ZEC ETP under ISIN CH1608218801, alongside a second product tracking ETHFI, the governance token of staking protocol Ether.fi.
▪️ Both are physically backed — the issuer holds the actual coins, no synthetic paper — and both charge 2.5% a year, several times what mainstream European BTC products cost.
▪️ Grayscale's ZCSH on NYSE Arca absorbed $46.56M in one session, its second-largest daily inflow since launch, lifting net assets near $917M.
▪️ The 3-for-1 forward split: Sept. 28 record date, extra shares Sept. 29, post-split trading Sept. 30 — a cheaper entry price for US buyers.
▪️ Here's the tell — supply: over 30% of all ZEC, roughly 4.9M coins, sits fully shielded now, a record. Holders are eating the usability cost just to get coins into encrypted pools.
▪️ Leverage followed right on cue: one trader's 50x long on Aster DEX, a $224K position, was reportedly up 1,581% as ZEC broke through, per Lookonchain.

📊 ZEC spot: $1,622
📊 24h move: +8%
📊 Market cap: $27.5B, 9th largest crypto asset
📊 1-year run: ~19x

Two regulated wrappers on two continents — that's the pitch being sold to you: privacy just got a compliant door, and the 2.5% fee quietly tells you the plumbing is still expensive. The next test is whether European flows show up in the same size the US ones did. And the tape already showed you the risk once — ZEC hit a year-to-date high of $1,590 on Sept. 18, bled to $1,429, held $1,440, then reclaimed it all Tuesday. Anyone sitting on 50x is one wick from the exit.

💬 «structural trade rather than a seasonal one» — Arthur Hayes and Bitwise's Matt Hougan

🔮 Record shielded supply plus a fat fee means people are paying real money to hide their bags. So who's buying what they're hiding?

@pixeos

🟢 Greed 71, BTC back at $86.9K, and Binance just bought itself a slice of Circle

BTC $86,930.01 (+1.68%), ETH $2,770.56 (+1.43%) — green tape, sure. But Fear & Greed slid 78 → 71, which tells you exactly who's still clicking buy. The real money story is elsewhere: MARSCOIN +33%, Binance dropping $100M on Circle, and Polymarket bleeding $10M to card fraud while it was out chasing growth.

▪️ MARSCOIN +33.2% on $46M volume — a book that thin gets painted by one guy with a phone. BCH +28.6% on $124M is the only mover with real size behind it.
▪️ Also green: MUBARAK +22.7% ($102M), PENGU +21.3% ($42M), ZRO +20.6% ($22M). Red: ONE -25.2% ($27M), PEPE -0.4% on $85M — nobody dumping, nobody buying.
▪️ Ethena's USDe briefly printed $0.65 on Binance before recovering — a centralized-exchange operational issue, not a depeg. Cool story.
▪️ Polymarket ate a $10M fraud attack with stolen debit cards; Checkout.com rejected over 80% of deposits as fraudulent, and the report says growth came before compliance.
▪️ Binance bought 1.24M Circle shares at $80.84 — about $100M — plus a monthly fee on USDC sitting in its wallets, under a five-year promotion deal.
▪️ Galaxy Digital: whitehats moved 52 BTC from the Coldcard hack into a recovery trust, tagged OP_RETURN 'claim:cryptorecoverytrust.com'.

Greed at 71 after 78 means the party's cooling but nobody's scared yet — that's exactly when thin books like MARSCOIN get painted and dumped on the chasers. Your stop is only as good as the matching engine under it, as that $0.65 USDe print just proved. And Binance taking a monthly fee on the USDC it holds tells you which stablecoin gets pushed at you next.

🔮 USDe hit $0.65 for a minute and nobody blinked. Next time it's your stop that eats the fill.

@pixeos

🐕 Doge Ran to Its Highest Price Since June on Leverage and Musk Hopium—Now Guess Who's the Exit Liquidity

Doge printed a months-high intraday spike after X rolled out cashtag trading with Gemini. Cute headline. Now let's see who gets left holding the bag when the leverage unwinds.

▪️ Crypto Briefing credits how whales accumulated and how ETF money kept flowing faster than usual. Translation for the cheap seats: the big wallets loaded up, ETF cash kept coming, and now the retail…
▪️ It opened near nine cents nine nine and hit ten cents fifty nine before sellers showed up. That's a ten-cent-ish spike, not a regime change.
▪️ The daily candle still closed red slightly despite how loud everyone got about that level. So the whole thing was a photo-op breakout.
▪️ Sector rotation got loud too because traders pulled profits from Bitcoin toward wilder tickers. That's not adoption, that's degen musical chairs.
▪️ The chart underneath stays ugly because how fast things moved does not fix slow averages. Fast pumps don't fix slow averages.

📊 Intraday high: ten cents fifty nine
📊 Open interest: three hundred fifty million dollars
📊 RSI: sixty nine point four
📊 ADX: thirty two point five

💬 «So.» — Jose Antonio Lanz

@pixeos

🤝 Binance drops $100M on Circle stock — and gets paid to shill USDC

Binance bought $100 million of Circle stock in a private placement that closed Sept. 17 — 1.24 million Class A shares at $80.84 each — right alongside a five-year deal where Circle pays the exchange a monthly fee tied to how much USDC moves through its rails.

▪️ The shares went out below where Circle was trading at the time — a discount written straight into an unregistered private placement.
▪️ Binance can't sell, transfer or hedge them until two years pass or until it terminates the commercial arrangement first; voting rights stay with Binance.
▪️ That monthly incentive is calculated as a percentage of the USDC held through Circle's Modular Smart Contract Wallet service.
▪️ On top of cashing checks from the issuer, Binance runs promotional activity for USDC across its own platform.
▪️ This replaces their earlier USDC deals from November 2024 and August 2025; either side can walk early if specified events hit.
▪️ Because nothing was registered, Binance can't dump those shares unless they get registered or an exemption applies.

📊 Equity purchase: $100M
📊 Price per share: $80.84
📊 Shares acquired: 1.24M
📊 Lockup: up to 2 years

Read between lines here: this isn't an investment story, it's payroll plus equity in one package for whoever pushes your stablecoin hardest on their own venue.

@pixeos

💳 Stolen debit cards, a drained Polymarket, and a boss saying "just pay the fine"

Polymarket's US platform got farmed for at least $10 million in February 2026 — bad actors linked stolen debit cards to accounts, placed bets, then tried to cash out to clean accounts or separate cards they controlled. Payment processor Checkout.com's fraud system lit up and started rejecting deposits. Per a Wall Street Journal report, when staff brought the mess to CEO Shayne Coplan, his answer was to chase growth — the firm could just pay a fine if regulators ever came.

▪️ One single account made roughly 4,000 separate deposit attempts before anyone at Polymarket moved.
▪️ Checkout.com's automation fired: at peak it rejected over 80% of processed deposits as fraud. Industry norm is around 1%.
▪️ Staff flagged it to CEO Shayne Coplan. His call: chase growth, pay a fine if regulators come. Execs scrapped the rule that withdrawals go back to the same payment source.
▪️ Fallout: compliance chief Andrew Clifford quit in April after a memo on the gaps. Polymarket US CEO Justin Hertzberg was fired. Heads of US regulation and AML left.
▪️ June: hackers used a third-party vendor to inject malicious code into the site, hitting user balances. Polymarket reimbursed those users.
▪️ July: a registration flaw let attackers armed with stolen personal data walk into nearly 500 accounts with no password.

📊 Funding round: $1B at $21B valuation
📊 1789 Capital commitment: $300M
📊 States suing over unlicensed gambling: more than a dozen

If you've got money parked on Polymarket, here's your read: the CFTC is investigating and told staff to preserve records on the fraud and the internal compliance handling, the NYC Council is poking at the marketing, and lawsuits in more than a dozen states call the whole thing unlicensed gambling. The actual fix — capping how many debit cards one account can attach — landed in May, after the damage was done, and fraud dropped back to industry average. Sullivan & Cromwell, hired by the company itself, concluded it complied. Meanwhile they're staffing up with ex-FBI investigator Shauna Batista, ex-Amazon CFO Warren Jenson and ex-Uber exec Travis Vanderzanden as chief growth officer, and laying the groundwork for an IPO. Compliance here is a line item, not a culture.

💬 «Our market integrity framework includes processes to detect, review, and respond to suspicious activity. Polymarket remains committed to maintaining accurate, fair, and transparent markets while cooperating fully with regulators and law enforcement.» — Polymarket spokesperson

🔮 The fine is already priced in. Question is whether the CFTC writes one big enough to hurt before the IPO prints.

@pixeos

🚀 BTC at $85K, $1B liquidated, and a fresh $17M hack for breakfast

Bitcoin ripped to $85,420 (+4.93%) and ETH tagged $2,729 (+2.45%) — and the move ate over $1B in positions, $850M of it shorts getting steamrolled. Extreme Greed is back at 78 and the squeeze is the entire story. You're either on the right side of it or you are the liquidity.

▪️ MUBARAK +63.7% on $22M volume is today's lottery ticket; PEPE +24.5% on $180M is the one with real money behind it.
▪️ PHA +36.4% on $32M and TAO +17.9% on $106M are running while Fetch.AI, NuNet and SingularityNET sit on a $17M token attack.
▪️ Losers: AVAX -6.9%, ZEC -3.8% on $326M, NEAR -3.4% on $272M, ENA -1.8%. Whatever didn't squeeze is bleeding.
▪️ BitMine bought 27,562 ETH for $75M and now holds near 5% of ETH's circulating supply. That's not adoption, that's a bid you don't control.
▪️ BTC printed an 8-month high for the first time since late January despite the Senate killing the CLARITY Act and the Fed hiking. Friday's inflation expectations print is the test, $80K is the line.
▪️ XMR jumped 13% and XRP bounced to $1.45 on falling oil and a looming Trump-Xi summit — macro tourists are back in the pool.

78 Extreme Greed with BTC at $85K means longs are crowded and funding is paying them to sit still. If Friday's inflation report spooks the macro crowd, the same machine that ate $850M of shorts this morning flips and eats the other side. Your stop-loss is the only participant here that cares about your opinion.

🔮 Greed at 78 and everyone's a genius again. Go ask this morning's shorts how that felt.

@pixeos

🍊 Trump team dumps 8.4M TRUMP into OKX — and you're still the buyer

Wallets tied to the Official Trump memecoin team just shoved about 8.4 million TRUMP — roughly $18 million — into OKX deposit addresses in four days, right after the Sept. 18 unlock. TRUMP is trading near $2.13, down 97% from its $73.43 peak in January 2025, and the team is still finding buyers for every batch it ships to the exchange. Spoiler: that's you.

▪️ Sept 21: another 2.4M TRUMP landed on OKX, topping up a 6M move — a two-day total of 6M tokens, or $12.59M.
▪️ The Sept 7 leg: a team address moved 11.25M TRUMP worth $26M, with 3.25M of it already sitting on OKX.
▪️ One wallet still holds 1.6M TRUMP, about $3.4M, and hasn't shipped it to an exchange yet. Yet.
▪️ The Sept 18 unlock released 28.7M TRUMP, 2.9% of supply — one of 34 unlocks through December 2027 that free up roughly 80% of what was locked at launch.
▪️ Aug 23 set the template: two batches worth a reported $21.7M to OKX, then $3.39M in USDC raised in 10 hours by seeding one-sided liquidity pools for buyers to swap into.
▪️ In May it moved $17M in TRUMP into Bitgo custody; by early September over $150M in TRUMP-linked tokens had reached exchanges since April.

📊 Buyers who lost (per Warren/Blumenthal citation): ~1 million
📊 Retail losses cited to SEC: $3.81B
📊 Collected by Trump-linked entities: $636M
📊 Public Citizen estimate for Trump-linked crypto ventures: $4.7B

So yeah, the scoreboard is onchain, and it's screaming: the team sells into strength. BTC is knocking on $85K, and a green day with deep order books is the cheapest moment to unload 2.4M tokens without wrecking the chart. One wallet still holds 1.6M ready to go, and with 34 unlocks running to December 2027 this drip is not ending. Senators Elizabeth Warren and Richard Blumenthal asked the SEC to investigate last month, citing the $3.81B in retail losses and the $636M Trump-linked entities pulled in — so far that's paperwork, not handcuffs. CHART

🔮 Down 97% and they're still selling into your buy orders. The coin's called TRUMP — the exit liquidity's called you.

@pixeos

🚀 Bitcoin rips to $84,000 for the first time in 8 months — and the alts went absolutely feral

Bitcoin bounced off $80,000 and blasted to an eight-month high on Monday, dragging the whole board green and adding $70 billion to total crypto market cap in a single session. Monero led the degen charge, ETH tapped $2,700, XRP sat back above $1.45. And here's the punchline: this came right after the Senate killed the CLARITY Act and the Fed hiked rates for the first time since July 2023 — and the market shrugged like it didn't hear a word.

▪️ Last week: the Senate votes down advancing the CLARITY Act, then the Fed hikes for the first time since July 2023. BTC answers with a dip to $75,000.
▪️ Friday it claws back above $80,000, Saturday it nears $82,000 — then Middle East escalation and fresh Russia-Ukraine strikes park it right there.
▪️ Monday it holds support, reclaims the 50-week MA and rockets to a fresh eight-month high, its first time up there since the end of January.
▪️ XMR is the standout: +13% to nearly $588, though it gave back 4% in the last hour. DOGE +5%, XRP +4%, ETH, SOL and HYPE about +3%, BNB and ZEC +2%, TRX the laggard under 1%.
▪️ Double-digit gainers among bigger caps: XMR, AVAX, TAO, NEAR, SUI, BTW, MORPHO. DOGE, ADA, XLM, BCH and LINK also ran hard; SOL at $115, BNB at $780.
▪️ The real fuel: Brent down a fourth straight session, its longest losing run in three months. S&P futures +0.5%, Nasdaq 100 contracts ~1%, dollar flat.

📊 BTC market cap: $1.670 trillion
📊 BTC dominance: just under 59%
📊 Total crypto market cap: $2.810 trillion

This is a macro trade wearing a crypto costume — oil sliding, stocks bid, everyone front-running a Trump-Xi summit later this week and a possible Trump-Pezeshkian handshake at the UN. Friday's inflation expectations report is the tripwire: a hot print puts $80,000 back in play and settles whether this was a squeeze or a real trend. Cheaper energy is the only thing easing the inflation picture that keeps the Fed hawkish, so the moment Brent turns, this bid gets thinner. Anyone short up here is the exit liquidity — and someone up here needs you to be.

🔮 Retail is buying this candle with both hands. Ask who needs you holding it through Friday's inflation print.

@pixeos

BTC naps at $81.6K while alts rip — and 4,000 BTC ghosted Liquid's reserve

BTC $81,631 (+1.36%), ETH $2,670.93 (+3.60%). Green drift, zero conviction, alts doing the actual running. Meanwhile Liquid's shared BTC reserve got drained of roughly 4,000 BTC — and not one private key was stolen to pull it off.

▪️ Movers: NEAR +26% on $379M volume, SAGA +23.8%, AVAX +19.4% on $146M, SUI +14.9% on $145M, PUMP +11.9%. Alts sprinting while BTC takes its nap.
▪️ Losers: G -49.4% on $50M turnover, ONE -16.6% on $48M. A coin halving on that kind of volume means someone with size already walked.
▪️ Liquid, Sept 6: a software flaw let attackers mint unbacked L-BTC and cash it out against the shared reserve. ~4,000 BTC gone.
▪️ TRM Labs' reconstruction: the network approved a withdrawal that should never have qualified. Protocol-level theft — your seed phrase was never the weak link.
▪️ North Korea baited fake IT job interviews, infected 30,000+ machines in 100+ countries, pulled millions in crypto from late 2025 to July 2026.
▪️ In Venezuela, merchants are getting paid in fake USDT — zero-value tokens dropping into self-custody wallets. The goods left, the money never existed.

Fear & Greed at 70 (Greed), one notch down from 71 — the crowd is comfortable, nobody's hedging. That's the exact tape where protocol drains and fake-token payments keep working: everyone watches the green candles, nobody checks the reserve. Watch alt volumes today — if NEAR and AVAX hold on that turnover, the rotation is real; if it dies, yesterday was the exit liquidity.

🔮 Greed 70 with BTC flat: either alts are front-running something, or the exit liquidity is getting warmed up.

@pixeos

🩸 Liquid bled ~4,000 BTC without anyone stealing private keys

On Sept 6 roughly 4,000 Bitcoin walked out of Liquid’s shared reserve because the network itself approved a withdrawal that should never have qualified — no phished seed phrase involved.

▪️ Quick setup so nobody gets lost

@pixeos

💀 Fake USDT, zero value: Venezuelan shops are getting paid in thin air

Venezuela's got a brand new payment rail and it's called fake money. Scammers are buying real goods with cloned USDT — tokens that show up as USDT in a self-custody wallet and are worth exactly jack shit. Merchant sees the payment land, hands over the merch, scammer walks out with inventory nobody ever paid for. Juan Kassabji, a local tech guy who's been tracking the scheme, knows of one merchant who ate over $5,500 in fake tokens in a single deal.

▪️ The token is a straight clone: it's named USDT, it renders as USDT in the wallet, but its contract address ain't the one Tether issued.
▪️ At checkout the buyer steers the merchant onto an external self-custody wallet — the one place where nothing on that screen verifies the contract for you.
▪️ Payment lands, ticker looks right, the trade reads as settled, the merchant hands over the goods and the scammer is gone.
▪️ Some wallets do flag cloned tokens, but it ain't standard — whether you ever see a warning depends on which wallet you happen to be running.
▪️ Same fake tokens have already been used to stiff people on P2P exchanges, per Kassabji. Physical stores are just the newest venue.

📊 Value actually moved per 'payment': $0

Take stablecoins into a self-custody wallet and you are the compliance department now — and the wallet sure as hell ain't doing that job for you. Kassabji's fix is boring and it works: check that the contract address matches Tether's official one, or just take the payment through Binance, which only credits valid USDT into balances. And after every payment, glance at the dollar balance — fake money reads as zero. Five seconds of paranoia is cheaper than a whole shipment of goods that walked out the door.

🔮 USDT is basically Venezuela's cash register at this point. 'Payment received' on your screen was never the same thing as money — this scam just said the quiet part out loud.

@pixeos

🎣 Fake job interview, real drain: NK crew cleaned out 7,000 wallets

North Korea's Waterplum crew turned fake tech job interviews into a harvesting machine: 30,000+ machines infected across 100+ countries, and $10.71 million in crypto funneled into Pyongyang-controlled wallets between late 2025 and July 2026. The bait was a coding test. The payload was a backdoor. And per the agencies, that money goes to the weapons program. You thought you were interviewing. You were the exit liquidity.

▪️ The setup: 'recruiters' from legit-sounding AI, blockchain and tech staffing firms slide into DMs — developers, web designers, crypto specialists, all fair game on job platforms and socials.
▪️ The hook: mid fake technical interview or coding assessment, you're told to download the test software or a video-call troubleshooting tool 'to proceed'. Sure. To proceed.
▪️ Run it and you're owned — backdoor trojans plus infostealers. No exotic zero-day, no genius exploit. Just you double-clicking their file on your own machine.
▪️ What they take: ID and passport scans plus crypto private keys. That's why it's wallets getting emptied, not just laptops getting bricked. Follow the incentives.
▪️ Domestic enablers faked location verification so North Korean IT workers landed real remote jobs at Japanese and US firms — those workers alone moved hundreds of millions of yen in crypto abroad.
▪️ Japanese police pulled a first: seized and dismantled a local laptop farm that let the operatives work off local IP addresses instead of Pyongyang's.

📊 Devices infected: 30,000+
📊 Crypto wallets compromised: 7,000+
📊 Countries hit: 100+
📊 Campaign window: late 2025 – July 2026

This isn't abstract for you: 7,000 drained wallets means coins that already moved on-chain and got laundered into the exact same liquidity you trade against. The agencies' fix is boring and free — never execute unvetted code outside an isolated sandbox, and use workspace restriction controls before opening some random repo. And if a 'recruiter' asks you to install anything before the interview, that's not hiring, that's payload delivery.

🔮 Nobody cracked your wallet. You installed the malware yourself because you wanted the gig. That's the whole game.

@pixeos

🩸 Majors chop sideways while CELR runs +113%

Bitcoin parked near eighty grand (-0.

▪️ So the big caps are doing their usual thing — chopping sideways, going absolutely nowhere, while the tape gives you nothing to work with. Meanwhile CELR rips +113% right under everyone's nose.
▪️ Ask yourself who's buying CELR up here. Every time an alt prints a triple while BTC sits flat, somebody is handing out exit liquidity with a smile.
▪️ And notice how quiet the majors are while this happens. That's not calm, that's compression. Money doesn't just vanish — it parks somewhere, waits, then rips into whatever's thin enough to move.
▪️ No moral here, no lecture. Just the usual: alts pump, majors chop, and the retail chat fills up with screenshots of the one guy who caught it. Play the tape, not the story.

@pixeos

🐋 2011 wallet wakes up, turns a $324 bag into $8M in one sweep

A wallet born Nov. 2, 2011 just swept out its entire 100 BTC — over $8 million — while bitcoin sat near $82,000. Ten blocks earlier a second cluster of ancient coins moved another 100 BTC. Combined: 200 BTC, $16 million, all on one Saturday, and every single coin older than most of the people trading it.

▪️ Paid $3.24 a coin on Nov. 2, 2011 — $324 for all 100 — then hit send-everything: one P2PKH sweep into a brand new P2WPKH wallet.
▪️ Arkham and every major explorer draw a blank on that receiving wallet. No link to an OTC desk or a CEX. Blockchair gives it a privacy score of 55/100 — sweeps always look tidy.
▪️ Ten blocks earlier, at block 967722, four legacy P2PKH addresses each moved 25 BTC — all born Feb-Mar 2013, when BTC ran from $32 on Mar 1 to $91.95 on Mar 31 as Cyprus banks blew up.
▪️ Those four consolidated into a single P2WPKH wallet Arkham flags as a known Bitgo address, one that has swallowed 100 BTC batches before. Privacy score around 60.
▪️ Onchain heuristics say that entity is a miner: its first Bitgo transfers were 25 BTC batches of March 2013 block rewards, and it has been feeding Bitgo like that since August 2025.

📊 Block of the 2011 sweep: 967732
📊 Nov 2011 entry price: $3.24
📊 2011 unrealized gain: 2,469,035%
📊 2013 miner cost basis: ~$3,200

The 2013 miner isn't panicking — he's been drip-feeding Bitgo since August 2025, and Bitgo is a custodian, so those coins may be parked, not dumped. The 2011 holder is the wildcard: he moved into a wallet nobody can name, which puts an OTC desk or an exchange one hop away — or means nothing happens at all. A September stuffed with waking sleepers plus BTC above $81,000 is exactly how tops get assembled — old hands getting their exit liquidity lined up while you're watching charts.

🔮 Cost basis $324, BTC at $82K: neither guy gives a shit what you paid. The question is whether 100 BTC in an untraceable wallet is headed for a bid.

@pixeos