7*24

Hot topic

Market

Activities

According to monitoring by Dongcha Beating, a reverse analysis of the worm payload router_init.js by Socket.dev reveals the complete attack chain. This obfuscated file, approximately 2.3 MB in size, disguises itself as a TanStack router initialization module. Upon installation, it steals high-privilege credentials from environments such as GitHub Actions, AWS, Vault, and Kubernetes, and attempts to further contaminate other packages under the maintainer's account. The first step is CI contamination. The attacker infiltrates TanStack's GitHub Actions environment through pull_request_target, embedding malicious code in the dependency cache. When the maintainer triggers a release normally, the contaminated cache is restored, and the malicious code extracts the OIDC token from the memory of the GitHub Actions runner process, directly publishing to npm. The entire process does not steal the npm long-term token but still completes the poisoning with a legitimate source proof. The second step is parasitic development tools. Socket states that the worm copies itself to .claude/router_runtime.js, .claude/settings.json, .claude/setup.mjs, .vscode/setup.mjs, and .vscode/tasks.json. Among these, Claude Code hooks will re-execute the malicious code during file edits, bash, and other tool events, while the VS Code task configuration provides another resurrection path. A simple npm uninstall cannot complete the cleanup. The third step is spreading by impersonating an AI robot. After obtaining the GitHub token, the worm calls the GitHub GraphQL API to write files such as .github/workflows/, .claude/, and .vscode/ to the victim's repository, disguising the commit author as claude@users.noreply.github.com. In repositories that have already allowed Claude Code integration, such submissions are more likely to blend in with normal AI agent activities. The fourth step is exfiltrating data using the Session network. Socket claims that the payload has a built-in Session decentralized communication protocol stack, which transmits the stolen credentials through filev2.getsession[.]org and the Session service node network. For enterprise security devices, this type of traffic is closer to encrypted chat protocol traffic, making it harder to intercept by domain and characteristics compared to traditional hacker C2 callbacks.

[Impersonating Claude Robot to Insert Backdoors: Analyzing the npm Worm Mini Shai-Hulud Attack Chain]According to monitoring by Dongcha Beating, a reverse analysis of the worm payload router_init.js by Socket.dev reveals the complete attack chain. This obfuscated file, approximately 2.3 MB in size, disguises itself as a TanStack router initialization module. Upon installation, it steals high-privilege credentials from environments such as GitHub Actions, AWS, Vault, and Kubernetes, and attempts to further contaminate other packages under the maintainer's account. The first step is CI contamination. The attacker infiltrates TanStack's GitHub Actions environment through pull_request_target, embedding malicious code in the dependency cache. When the maintainer triggers a release normally, the contaminated cache is restored, and the malicious code extracts the OIDC token from the memory of the GitHub Actions runner process, directly publishing to npm. The entire process does not steal the npm long-term token but still completes the poisoning with a legitimate source proof. The second step is parasitic development tools. Socket states that the worm copies itself to .claude/router_runtime.js, .claude/settings.json, .claude/setup.mjs, .vscode/setup.mjs, and .vscode/tasks.json. Among these, Claude Code hooks will re-execute the malicious code during file edits, bash, and other tool events, while the VS Code task configuration provides another resurrection path. A simple npm uninstall cannot complete the cleanup. The third step is spreading by impersonating an AI robot. After obtaining the GitHub token, the worm calls the GitHub GraphQL API to write files such as .github/workflows/, .claude/, and .vscode/ to the victim's repository, disguising the commit author as claude@users.noreply.github.com. In repositories that have already allowed Claude Code integration, such submissions are more likely to blend in with normal AI agent activities. The fourth step is exfiltrating data using the Session network. Socket claims that the payload has a built-in Session decentralized communication protocol stack, which transmits the stolen credentials through filev2.getsession[.]org and the Session service node network. For enterprise security devices, this type of traffic is closer to encrypted chat protocol traffic, making it harder to intercept by domain and characteristics compared to traditional hacker C2 callbacks.

Impersonating Claude Robot to Insert Backdoors: Analyzing the npm Worm Mini Shai-Hulud Attack Chain

On May 12, Anthropic warned that unauthorized tokenized stock exposures and special purpose vehicle (SPV) transfers are invalid and will not be recognized, stating that many third-party products may be fraudulent or worthless under their share restrictions. Nevertheless, token platforms such as PreStocks still suggest their valuations are between $1.37 trillion and $1.5 trillion.

[Anthropic Warns Against Unauthorized Stock Trading]On May 12, Anthropic warned that unauthorized tokenized stock exposures and special purpose vehicle (SPV) transfers are invalid and will not be recognized, stating that many third-party products may be fraudulent or worthless under their share restrictions. Nevertheless, token platforms such as PreStocks still suggest their valuations are between $1.37 trillion and $1.5 trillion.

Anthropic Warns Against Unauthorized Stock Trading

Ray Dalio, founder of Bridgewater Associates, stated that Bitcoin has not acted as a safe haven asset due to its high correlation with tech stocks, lack of privacy, and relatively small market size. 'There is only one gold.'

[Dalio: Bitcoin Has Not Functioned as a Safe Haven Asset, There Is Only One Gold]Ray Dalio, founder of Bridgewater Associates, stated that Bitcoin has not acted as a safe haven asset due to its high correlation with tech stocks, lack of privacy, and relatively small market size. 'There is only one gold.'

Dalio: Bitcoin Has Not Functioned as a Safe Haven Asset, There Is Only One Gold

The onshore RMB against the USD officially closed at 6.7946 at 16:30 Beijing time, an increase of 8 points from the previous trading day's official closing price, and up 17 points from the previous night's closing.

[Onshore RMB Against USD Officially Closed at 6.7946]The onshore RMB against the USD officially closed at 6.7946 at 16:30 Beijing time, an increase of 8 points from the previous trading day's official closing price, and up 17 points from the previous night's closing.

Onshore RMB Against USD Officially Closed at 6.7946

On May 12, Wccftech reported that the Trump administration is exerting ongoing pressure on Tesla to move the manufacturing of its AI 6.5 chip from TSMC to Intel.

[Tesla's AI 6.5 Chip May Shift Production to Intel]On May 12, Wccftech reported that the Trump administration is exerting ongoing pressure on Tesla to move the manufacturing of its AI 6.5 chip from TSMC to Intel.

Tesla's AI 6.5 Chip May Shift Production to Intel

On May 11, WTI crude oil rose 3% intraday, currently priced at $101.58 per barrel. Brent crude surpassed $105 per barrel, increasing by 2.49% during the day.

[WTI Crude Oil Rises 3% Intraday, Brent Crude Surpasses $105 per Barrel]On May 11, WTI crude oil rose 3% intraday, currently priced at $101.58 per barrel. Brent crude surpassed $105 per barrel, increasing by 2.49% during the day.

WTI Crude Oil Rises 3% Intraday, Brent Crude Surpasses $105 per Barrel

On May 12, Morgan Stanley Wealth Management predicted that incoming Federal Reserve Chair Walsh will implement policies such as reducing the balance sheet and weakening forward guidance after taking office.

[Morgan Stanley: Walsh Expected to Implement Balance Sheet Reduction After Taking Office]On May 12, Morgan Stanley Wealth Management predicted that incoming Federal Reserve Chair Walsh will implement policies such as reducing the balance sheet and weakening forward guidance after taking office.

Morgan Stanley: Walsh Expected to Implement Balance Sheet Reduction After Taking Office

On May 12, the crypto financing market has shown a significant recovery since April, with a total fundraising amount of approximately $2.359 billion, primarily driven by a few large transactions. In the prediction market sector, Kalshi stood out with a single new financing of $1 billion, bringing the total financing for the sector to over $1 billion. Other financing in the prediction market includes $6 million from startup XO Market and $5 million raised by live prediction market Pumpcade in its seed round. VC funds also performed strongly, with Haun Ventures completing a $1 billion new fundraise and expanding its investment scope to the AI agency sector. Meanwhile, South Korean crypto venture firm Hashed Ventures raised $2.2 million during the same period. The stablecoin and payment infrastructure sector showed robust performance, with a total financing amount of approximately $128 million. Among them, payment infrastructure company Fun raised $72 million, and Latin American digital wallet platform Belo secured $14 million. The $12 million financing of Paxos Labs attracted market attention, led by long-term crypto venture firm Blockchain Capital, with participation from Robot Ventures, family office Maelstrom, and DeFi development company Uniswap Labs. Financing in the DeFi and RWA sectors amounted to about $88 million, with Galaxy Digital leading the $20 million financing for credit market Fence, which became the largest financing in the sector. Other financings included $17 million for on-chain RWA lending and stablecoin project OpenTrade, $3.75 million for lending platform Votre, and $8 million for asset tokenization company KAIO. The intersection of AI and crypto saw smaller financing amounts, totaling $24 million. AI + blockchain land registration platform Balcony raised $12.7 million, AI digital asset trading agency platform Fere AI raised $1.3 million, and AI quantitative trading platform AlphaNet secured $10 million.

[Significant Recovery in Crypto Financing Since April, Strong Performance in Prediction Markets, VC Funds, Stablecoins, and RWA]On May 12, the crypto financing market has shown a significant recovery since April, with a total fundraising amount of approximately $2.359 billion, primarily driven by a few large transactions. In the prediction market sector, Kalshi stood out with a single new financing of $1 billion, bringing the total financing for the sector to over $1 billion. Other financing in the prediction market includes $6 million from startup XO Market and $5 million raised by live prediction market Pumpcade in its seed round. VC funds also performed strongly, with Haun Ventures completing a $1 billion new fundraise and expanding its investment scope to the AI agency sector. Meanwhile, South Korean crypto venture firm Hashed Ventures raised $2.2 million during the same period. The stablecoin and payment infrastructure sector showed robust performance, with a total financing amount of approximately $128 million. Among them, payment infrastructure company Fun raised $72 million, and Latin American digital wallet platform Belo secured $14 million. The $12 million financing of Paxos Labs attracted market attention, led by long-term crypto venture firm Blockchain Capital, with participation from Robot Ventures, family office Maelstrom, and DeFi development company Uniswap Labs. Financing in the DeFi and RWA sectors amounted to about $88 million, with Galaxy Digital leading the $20 million financing for credit market Fence, which became the largest financing in the sector. Other financings included $17 million for on-chain RWA lending and stablecoin project OpenTrade, $3.75 million for lending platform Votre, and $8 million for asset tokenization company KAIO. The intersection of AI and crypto saw smaller financing amounts, totaling $24 million. AI + blockchain land registration platform Balcony raised $12.7 million, AI digital asset trading agency platform Fere AI raised $1.3 million, and AI quantitative trading platform AlphaNet secured $10 million.

Significant Recovery in Crypto Financing Since April, Strong Performance in Prediction Markets, VC Funds, Stablecoins, and RWA

On May 11, according to monitoring by Arkham, Bhutan is selling Bitcoin and has just transferred 100 BTC (worth $8.1 million) from its holding wallet. At the current selling rate, its BTC will be depleted by the end of September. Since the beginning of the year, Bhutan has sold a total of $230.39 million in BTC, with remaining BTC valued at $252 million, selling approximately $50 million per month. If all remaining BTC is sold at the current price, the on-chain profit will reach $767 million.

[Bhutan Transfers Another 100 BTC, Total Sales Reach $230 Million Since January]On May 11, according to monitoring by Arkham, Bhutan is selling Bitcoin and has just transferred 100 BTC (worth $8.1 million) from its holding wallet. At the current selling rate, its BTC will be depleted by the end of September. Since the beginning of the year, Bhutan has sold a total of $230.39 million in BTC, with remaining BTC valued at $252 million, selling approximately $50 million per month. If all remaining BTC is sold at the current price, the on-chain profit will reach $767 million.

Bhutan Transfers Another 100 BTC, Total Sales Reach $230 Million Since January

Crypto ATMs — one of the key infrastructure pillars for the mass adoption of cryptocurrencies — have seen a drastic reduction this year. In the first two months of 2023, the net cryptocurrency ATMs installed globally reduced by 412 machines.
Since 2014, the total number of crypto ATMs maintained a steady upward trajectory while catering to millions of users worldwide for seamless crypto-fiat conversions. For ov a year, between December 2020 to January 2022, more than 1000 crypto and Bitcoin 
BTC ATMs were being installed every month. However, the bear market had an immediate impact on its growth.

Detail

【Bitcoin ATM decline: Over 400 machines went off the grid under 60 days】Crypto ATMs — one of the key infrastructure pillars for the mass adoption of cryptocurrencies — have seen a drastic reduction this year. In the first two months of 2023, the net cryptocurrency ATMs installed globally reduced by 412 machines.
Since 2014, the total number of crypto ATMs maintained a steady upward trajectory while catering to millions of users worldwide for seamless crypto-fiat conversions. For ov a year, between December 2020 to January 2022, more than 1000 crypto and Bitcoin 
BTC ATMs were being installed every month. However, the bear market had an immediate impact on its growth.

Bitcoin ATM decline: Over 400 machines went off the grid under 60 days

Top Ethereum Holder Makes Bold Move Says ETH Is Close to Generational Run, Here’s When

Coinbase裁员14%，熊市和AI哪个才是主因？

David Schwartz Says Ripple Stock Is His Real Bet, Not XRP

租来的轨道：这一波稳定币 FX 热钱，到底在为什么买单？

MegaETH 如何让 TVL 在 TGE 一周内达到 700m？拆解包装手法

Bulls Approach the Ceiling

The Bitcoin Vector #54

Roobet Launches Prediction Markets on May 6, The First Major Crypto Casino to Integrate the Format

Pre-ETF Era Bitcoin Whales Surface To Cash In On $80,000 Rally

Article

OSMO Current Price at $0.0886, 24-Hour Increase of 68.32%

Bitcoin ATM decline: Over 400 machines went off the grid under 60 days

Disclaimer：The content above does not represent HTX's positions.，HTX does not provide any trading recommendations.。

Related Articles

All Comments0LatestHot

Trending Topics

Related Articles