7*24

Hot topic

Market

Activities

On May 12, blockchain independent investigator tanuki42 tweeted that a North Korean recruiter recently reached out, offering to pay $300 per month for a US identity (or $150 for a EU identity) in exchange for assistance in registering and maintaining an Upwork account, with an additional 15% cut after four months. The recruiter requested to remotely control the individual's computer via AnyDesk to evade Upwork's IP monitoring. After tanuki42 agreed to connect, the recruiter only browsed for a moment before abruptly exiting the session and quickly blocking them. Tanuki42 warned that intermediaries for US/EU identities are becoming an increasingly relied-upon money laundering channel for North Korea, and such actions could indirectly fund the North Korean regime.

[Independent Investigator Exposes North Korean Recruiter Purchasing US/EU Upwork Identities]On May 12, blockchain independent investigator tanuki42 tweeted that a North Korean recruiter recently reached out, offering to pay $300 per month for a US identity (or $150 for a EU identity) in exchange for assistance in registering and maintaining an Upwork account, with an additional 15% cut after four months. The recruiter requested to remotely control the individual's computer via AnyDesk to evade Upwork's IP monitoring. After tanuki42 agreed to connect, the recruiter only browsed for a moment before abruptly exiting the session and quickly blocking them. Tanuki42 warned that intermediaries for US/EU identities are becoming an increasingly relied-upon money laundering channel for North Korea, and such actions could indirectly fund the North Korean regime.

Independent Investigator Exposes North Korean Recruiter Purchasing US/EU Upwork Identities

On May 12, according to an official announcement, Huobi HTX has launched AVGO/USDT, QCOM/USDT, and ORCL/USDT perpetual contracts, with a maximum leverage of 10 times. Additionally, from May 12, 16:00 to May 19, 16:00 (UTC+8), Huobi HTX is hosting a trading party for AVGO, QCOM, and ORCL contracts, with a total prize pool of up to $20,000. During the event, users who register and participate in AVGO/USDT, QCOM/USDT, and ORCL/USDT contract trading with a cumulative valid trading volume of ≥5,000 USDT will be eligible to share the prize pool based on their trading volume rankings. New users trading AVGO/USDT, QCOM/USDT, and ORCL/USDT contracts will also receive exclusive benefits.

[Huobi HTX Launches AVGO, QCOM, ORCL Perpetual Contracts and Starts Trading Party]On May 12, according to an official announcement, Huobi HTX has launched AVGO/USDT, QCOM/USDT, and ORCL/USDT perpetual contracts, with a maximum leverage of 10 times. Additionally, from May 12, 16:00 to May 19, 16:00 (UTC+8), Huobi HTX is hosting a trading party for AVGO, QCOM, and ORCL contracts, with a total prize pool of up to $20,000. During the event, users who register and participate in AVGO/USDT, QCOM/USDT, and ORCL/USDT contract trading with a cumulative valid trading volume of ≥5,000 USDT will be eligible to share the prize pool based on their trading volume rankings. New users trading AVGO/USDT, QCOM/USDT, and ORCL/USDT contracts will also receive exclusive benefits.

Huobi HTX Launches AVGO, QCOM, ORCL Perpetual Contracts and Starts Trading Party

According to reports, on May 12, eBay rejected GameStop's unsolicited acquisition proposal.

[eBay Rejects GameStop's Acquisition Proposal]According to reports, on May 12, eBay rejected GameStop's unsolicited acquisition proposal.

eBay Rejects GameStop's Acquisition Proposal

On May 12, Arkham reported that the Ethereum address pension-usdt.eth established short positions of approximately $125 million in BTC and ETH, with over $90 million shorted around $67,000 for BTC and about $45 million shorted around $2,100 for ETH. Currently, the unrealized loss stands at approximately $15.73 million. The liquidation price for BTC is around $101,000, while for ETH it is approximately $3,300.

[Pension-usdt.eth's BTC and ETH Short Positions Face Over $15 Million Loss]On May 12, Arkham reported that the Ethereum address pension-usdt.eth established short positions of approximately $125 million in BTC and ETH, with over $90 million shorted around $67,000 for BTC and about $45 million shorted around $2,100 for ETH. Currently, the unrealized loss stands at approximately $15.73 million. The liquidation price for BTC is around $101,000, while for ETH it is approximately $3,300.

Pension-usdt.eth's BTC and ETH Short Positions Face Over $15 Million Loss

On May 12, the market widely expects that the CPI data will reinforce expectations for the Federal Reserve to maintain interest rates unchanged in the short term. Traders have ruled out the possibility of rate cuts this year; prior to the outbreak of the Iran war, two rate cuts were anticipated. Sarah Hammoud, a foreign exchange strategist at the Commonwealth Bank of Australia, stated, "The risk is that, due to the spillover effects of energy prices on other prices such as airfare and food, US core inflation may be higher than the market consensus. If US core inflation exceeds expectations, it will push up US yields and the dollar exchange rate." (Jin Shi)

[Commonwealth Bank of Australia Forecasts US CPI: Core Inflation May Exceed Market Consensus]On May 12, the market widely expects that the CPI data will reinforce expectations for the Federal Reserve to maintain interest rates unchanged in the short term. Traders have ruled out the possibility of rate cuts this year; prior to the outbreak of the Iran war, two rate cuts were anticipated. Sarah Hammoud, a foreign exchange strategist at the Commonwealth Bank of Australia, stated, "The risk is that, due to the spillover effects of energy prices on other prices such as airfare and food, US core inflation may be higher than the market consensus. If US core inflation exceeds expectations, it will push up US yields and the dollar exchange rate." (Jin Shi)

Commonwealth Bank of Australia Forecasts US CPI: Core Inflation May Exceed Market Consensus

According to monitoring by Dongcha Beating, OpenAI announced a modification to its cooperation agreement with Microsoft two weeks ago. The Information exclusively revealed hidden financial details: the total revenue share cap that OpenAI pays to Microsoft is locked at $38 billion. Based on current revenue growth rates, OpenAI expects to reach this cap by 2028. Compared to the previous unlimited '20% revenue share' plan, the new agreement saves OpenAI approximately $97 billion in the long run. However, this long-term savings comes at the cost of short-term cash flow pressure. The new agreement eliminates OpenAI's previous privilege of deferring part of the revenue share payment until 2032. Based on this year's expected revenue of $30 billion, OpenAI must pay Microsoft approximately $6 billion in full this year, nearly $4 billion more than previously expected. As a result, OpenAI's cash consumption expectations for this year and next have been raised to approximately $27 billion and $63 billion, respectively. Microsoft has given up hundreds of billions in potential revenue caps in exchange for the certainty of mitigating 'AGI risk.' The original agreement stipulated that once OpenAI announced the achievement of AGI, Microsoft's commercialization rights would be severed. The new agreement clarifies that regardless of when AGI arrives, Microsoft will proportionally receive revenue shares until 2030 and retain resale rights to OpenAI's technology until 2032.

[OpenAI Caps Microsoft Revenue Share at $38 Billion, Saving $97 Billion Long-Term but Pressuring Short-Term Cash Flow]According to monitoring by Dongcha Beating, OpenAI announced a modification to its cooperation agreement with Microsoft two weeks ago. The Information exclusively revealed hidden financial details: the total revenue share cap that OpenAI pays to Microsoft is locked at $38 billion. Based on current revenue growth rates, OpenAI expects to reach this cap by 2028. Compared to the previous unlimited '20% revenue share' plan, the new agreement saves OpenAI approximately $97 billion in the long run. However, this long-term savings comes at the cost of short-term cash flow pressure. The new agreement eliminates OpenAI's previous privilege of deferring part of the revenue share payment until 2032. Based on this year's expected revenue of $30 billion, OpenAI must pay Microsoft approximately $6 billion in full this year, nearly $4 billion more than previously expected. As a result, OpenAI's cash consumption expectations for this year and next have been raised to approximately $27 billion and $63 billion, respectively. Microsoft has given up hundreds of billions in potential revenue caps in exchange for the certainty of mitigating 'AGI risk.' The original agreement stipulated that once OpenAI announced the achievement of AGI, Microsoft's commercialization rights would be severed. The new agreement clarifies that regardless of when AGI arrives, Microsoft will proportionally receive revenue shares until 2030 and retain resale rights to OpenAI's technology until 2032.

OpenAI Caps Microsoft Revenue Share at $38 Billion, Saving $97 Billion Long-Term but Pressuring Short-Term Cash Flow

On May 12, Bernstein announced that it maintains a target price of $190 for Circle (CRCL). Despite a decline in reserve income by 11% quarter-over-quarter due to falling interest rates, Q1 revenue of $694 million was slightly below expectations, while adjusted EBITDA reached $151 million, exceeding consensus by about 10%. Analysts noted that Circle's $222 million ARC token presale, completed at a fully diluted valuation of $3 billion, along with robust growth in USDC supply reaching $77 billion (a year-on-year increase of 28%), provides a buffer for the company.

[Bernstein Maintains Circle Target Price at $190, Still Offers Approximately 44% Upside Potential]On May 12, Bernstein announced that it maintains a target price of $190 for Circle (CRCL). Despite a decline in reserve income by 11% quarter-over-quarter due to falling interest rates, Q1 revenue of $694 million was slightly below expectations, while adjusted EBITDA reached $151 million, exceeding consensus by about 10%. Analysts noted that Circle's $222 million ARC token presale, completed at a fully diluted valuation of $3 billion, along with robust growth in USDC supply reaching $77 billion (a year-on-year increase of 28%), provides a buffer for the company.

Bernstein Maintains Circle Target Price at $190, Still Offers Approximately 44% Upside Potential

According to monitoring by Dongcha Beating, a reverse analysis of the worm payload router_init.js by Socket.dev reveals the complete attack chain. This obfuscated file, approximately 2.3 MB in size, disguises itself as a TanStack router initialization module. Upon installation, it steals high-privilege credentials from environments such as GitHub Actions, AWS, Vault, and Kubernetes, and attempts to further contaminate other packages under the maintainer's account. The first step is CI contamination. The attacker infiltrates TanStack's GitHub Actions environment through pull_request_target, embedding malicious code in the dependency cache. When the maintainer triggers a release normally, the contaminated cache is restored, and the malicious code extracts the OIDC token from the memory of the GitHub Actions runner process, directly publishing to npm. The entire process does not steal the npm long-term token but still completes the poisoning with a legitimate source proof. The second step is parasitic development tools. Socket states that the worm copies itself to .claude/router_runtime.js, .claude/settings.json, .claude/setup.mjs, .vscode/setup.mjs, and .vscode/tasks.json. Among these, Claude Code hooks will re-execute the malicious code during file edits, bash, and other tool events, while the VS Code task configuration provides another resurrection path. A simple npm uninstall cannot complete the cleanup. The third step is spreading by impersonating an AI robot. After obtaining the GitHub token, the worm calls the GitHub GraphQL API to write files such as .github/workflows/, .claude/, and .vscode/ to the victim's repository, disguising the commit author as claude@users.noreply.github.com. In repositories that have already allowed Claude Code integration, such submissions are more likely to blend in with normal AI agent activities. The fourth step is exfiltrating data using the Session network. Socket claims that the payload has a built-in Session decentralized communication protocol stack, which transmits the stolen credentials through filev2.getsession[.]org and the Session service node network. For enterprise security devices, this type of traffic is closer to encrypted chat protocol traffic, making it harder to intercept by domain and characteristics compared to traditional hacker C2 callbacks.

[Impersonating Claude Robot to Insert Backdoors: Analyzing the npm Worm Mini Shai-Hulud Attack Chain]According to monitoring by Dongcha Beating, a reverse analysis of the worm payload router_init.js by Socket.dev reveals the complete attack chain. This obfuscated file, approximately 2.3 MB in size, disguises itself as a TanStack router initialization module. Upon installation, it steals high-privilege credentials from environments such as GitHub Actions, AWS, Vault, and Kubernetes, and attempts to further contaminate other packages under the maintainer's account. The first step is CI contamination. The attacker infiltrates TanStack's GitHub Actions environment through pull_request_target, embedding malicious code in the dependency cache. When the maintainer triggers a release normally, the contaminated cache is restored, and the malicious code extracts the OIDC token from the memory of the GitHub Actions runner process, directly publishing to npm. The entire process does not steal the npm long-term token but still completes the poisoning with a legitimate source proof. The second step is parasitic development tools. Socket states that the worm copies itself to .claude/router_runtime.js, .claude/settings.json, .claude/setup.mjs, .vscode/setup.mjs, and .vscode/tasks.json. Among these, Claude Code hooks will re-execute the malicious code during file edits, bash, and other tool events, while the VS Code task configuration provides another resurrection path. A simple npm uninstall cannot complete the cleanup. The third step is spreading by impersonating an AI robot. After obtaining the GitHub token, the worm calls the GitHub GraphQL API to write files such as .github/workflows/, .claude/, and .vscode/ to the victim's repository, disguising the commit author as claude@users.noreply.github.com. In repositories that have already allowed Claude Code integration, such submissions are more likely to blend in with normal AI agent activities. The fourth step is exfiltrating data using the Session network. Socket claims that the payload has a built-in Session decentralized communication protocol stack, which transmits the stolen credentials through filev2.getsession[.]org and the Session service node network. For enterprise security devices, this type of traffic is closer to encrypted chat protocol traffic, making it harder to intercept by domain and characteristics compared to traditional hacker C2 callbacks.

Impersonating Claude Robot to Insert Backdoors: Analyzing the npm Worm Mini Shai-Hulud Attack Chain

On May 12, Anthropic warned that unauthorized tokenized stock exposures and special purpose vehicle (SPV) transfers are invalid and will not be recognized, stating that many third-party products may be fraudulent or worthless under their share restrictions. Nevertheless, token platforms such as PreStocks still suggest their valuations are between $1.37 trillion and $1.5 trillion.

[Anthropic Warns Against Unauthorized Stock Trading]On May 12, Anthropic warned that unauthorized tokenized stock exposures and special purpose vehicle (SPV) transfers are invalid and will not be recognized, stating that many third-party products may be fraudulent or worthless under their share restrictions. Nevertheless, token platforms such as PreStocks still suggest their valuations are between $1.37 trillion and $1.5 trillion.

Anthropic Warns Against Unauthorized Stock Trading

Huobi Global data showed that BTC fell below 36000 USDT and is now at 35998.08 USDT, with a decrease of 2.46% in 24H.

[BTC fell below 36000 USDT] Huobi Global data showed that BTC fell below 36000 USDT and is now at 35998.08 USDT, with a decrease of 2.46% in 24H.

BTC fell below 36000 USDT

Top Ethereum Holder Makes Bold Move Says ETH Is Close to Generational Run, Here’s When

Coinbase裁员14%，熊市和AI哪个才是主因？

David Schwartz Says Ripple Stock Is His Real Bet, Not XRP

租来的轨道：这一波稳定币 FX 热钱，到底在为什么买单？

MegaETH 如何让 TVL 在 TGE 一周内达到 700m？拆解包装手法

Bulls Approach the Ceiling

The Bitcoin Vector #54

Roobet Launches Prediction Markets on May 6, The First Major Crypto Casino to Integrate the Format

Pre-ETF Era Bitcoin Whales Surface To Cash In On $80,000 Rally

Article

OSMO Current Price at $0.0886, 24-Hour Increase of 68.32%

Intel (INTC.O) Pre-Market Gains Expand to 8%

BTC fell below 36000 USDT

Disclaimer：The content above does not represent HTX's positions.，HTX does not provide any trading recommendations.。

Related Articles

All Comments0LatestHot

Trending Topics

Related Articles