north

Payment giant Fiserv announced that its digital asset platform has officially launched for financial institution clients, with the first case being the dollar-backed stablecoin Roughrider Coin introduced by a bank in North Dakota.VersaBank is responsible for issuing, custody, and reserve asset management, while Fireblocks provides digital asset infrastructure and tokenization services, with transactions processed through the Solana blockchain.Roughrider Coin will connect to Fiserv's Commercial Center system, providing interbank fund transfer services for over 90 participating banks and credit unions in North Dakota.The platform also supports applications such as stablecoin cards, cross-border payments, programmable commerce, fund management automation, and tokenized deposits.

According to The Block, shareholders of Armada Acquisition Corp. II have approved its business combination with XRP Treasury company Evernorth, clearing a key step for the latter's listing on Nasdaq.The transaction is expected to raise approximately $300 million in total cash proceeds, with investors also contributing in physical XRP. Upon completion of the transaction, Evernorth is expected to hold approximately 473 million XRP. The transaction is expected to be completed on October 7, and the combined company plans to trade under the ticker XRPN starting October 8.

CoinBureau cites on-chain investigator ZachXBT, stating that suspected North Korean attackers are using Zcash to obscure the stolen funds from Bitget. Approximately 2,700 ZEC, worth about 3.8 million dollars, have begun to be transferred to Zcash's Ironwood.These stolen ZEC are being moved into a shielding pool, where transaction details can be hidden. In a security incident involving various assets totaling about 388 million dollars, approximately 18,900 ZEC, worth about 28.3 million dollars, were stolen. Previously, Bitget's CEO Gracy Chen expressed that she is "not very optimistic" about recovering the stolen funds.

According to Insurance Journal, blockchain analysis company Elliptic disclosed that it has tracked over 50 security incidents related to North Korea, with a total of approximately $1.2 billion stolen this year.Some of the stolen funds from Bitget overlap with the associated addresses from last year's $1.5 billion theft incident at Bybit exchange. Initial on-chain money laundering patterns indicate that the Bitget incident was carried out by the hacker organization TraderTraitor.

Charles Wu, the Head of Client Strategy for Alternative Investments at JPMorgan Chase in Asia Pacific, stated that foreign investors are providing funding for the development of artificial intelligence computing infrastructure in North America.Institutional investors such as foreign banks, pension funds, sovereign wealth funds, and insurance companies from Asia and the Gulf region play a significant role in the expansion of this sector. Currently, capital expenditures in the AI industry are approaching $1 trillion.

According to on-chain analyst Specter, North Korea is laundering funds across multiple chains, including underlying chains such as dYdX, Noble, and Osmosis, and has opened perpetual contract positions on dYdX.

According to a report by South Korea's Small and Medium Business News on September 28, industry insiders stated that SK Hynix has initiated the foundational engineering required for establishing a semiconductor factory in the Tohoku region of Japan. One insider mentioned that it is still unclear whether the project will be an independent factory or a joint venture with Kioxia, but local groundwork is underway, and SK Hynix has also requested domestic component suppliers in South Korea to expand their supply.The report noted that as of a month ago, SK Hynix's stance on building a memory semiconductor factory in Japan was still "under research," and they stated that "there are no specific decisions." In response to this news, SK Hynix indicated that the Japanese memory semiconductor factory is still in the research phase, with no further advancements at this time.The report also mentioned that SK Group Chairman Chey Tae-won stated in August this year that they are studying the establishment of a joint venture memory semiconductor factory in Japan, with the Tohoku region subsequently seen as a strong candidate. The Tohoku region of Japan and Iwate Prefecture have gathered semiconductor and material component companies such as Kioxia's Kitakami factory, Japan Semiconductor, Ancor Technology, Denso, and Tokyo Electron.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

Bitget CEO Gracy Chen stated during a live Q&A on platform security incidents that preliminary investigations found that some related IP addresses matched a VPN service used by a North Korean hacker organization, and the attack patterns were similar to previous actions by North Korean hackers. Therefore, the involvement of this organization in the attack, which involves approximately $351.6 million, cannot be ruled out. The relevant attribution is still in the preliminary investigation stage.Gracy Chen indicated that Bitget currently does not believe this incident was caused by internal personnel. The attackers directly infiltrated the platform's system and transferred funds, without forging user withdrawal requests, and did not obtain the private keys of cold wallets or hot wallets. Investigators are still confirming the specific affected systems and the method of the attackers' intrusion.

According to Fortune, MoonPay announced the acquisition of North Capital Investment Technology, a brokerage service company based in Utah, USA, which provides custody, secondary market trading, and asset tokenization services for debt, equity, and other assets.MoonPay did not disclose the transaction amount, but sources familiar with the matter revealed that the deal is an all-stock transaction valued at over $60 million. North Capital holds several licenses related to the U.S. Securities and Exchange Commission (SEC), including broker-dealer, alternative trading system (ATS), transfer agent, and investment advisor licenses. MoonPay plans to leverage this to expand its tokenization business for stocks and more.

According to BBX data, last weekend, global publicly listed treasury and mining companies in the U.S. announced their latest accounts regarding digital asset allocation, note financing, and liquidity management. The core updates are as follows:Evernorth Holdings plans to issue $30 million in convertible senior notes, specifically for increasing its holdings in XRP and ecological expansion: The treasury company Evernorth Holdings submitted an 8-K filing to the U.S. SEC, disclosing that it has signed a subscription agreement with a trust under South Korea's NH Investment & Securities, planning to issue convertible senior payment-in-kind (PIK) notes with a scale of $30 million, an annual interest rate of 4%, and maturing in 2031. The formal effectiveness of the notes is contingent upon the completion of the business merger transaction between Evernorth and the SPAC company Armada Acquisition Corp. II (expected to close in the fourth quarter of 2026). The proceeds will be fully used to purchase XRP in the secondary market and participate in XRP-related ecological businesses. Noteholders can convert the notes into the company's Class A common stock one year after the effective date, with an initial conversion price of approximately $10.20 per share.Bitdeer (NASDAQ: $BTDR) disclosed weekly mining data, producing 287.2 BTC fully liquidated: The Nasdaq-listed Bitcoin mining company Bitdeer announced its latest Bitcoin holdings data. As of the week of September 18, its self-operated Bitcoin mining output was 287.2 BTC, and it sold 287.2 BTC in the open market during the same period, resulting in a net addition of 0 BTC for the week. The balance sheet continues to implement a liquidity strategy of immediate sale upon production, maintaining zero Bitcoin retention.

The North Korean hacker group WaterPlum disguises itself as a cryptocurrency, AI, and NFT company recruiter, deploying malware disguised as programming tasks or video conference repair files to software developers and IT professionals.The organization has infected at least 30,000 devices in over 100 countries and extracted funds or account credentials from more than 7,000 cryptocurrency wallets between December 2025 and July 2026, stealing at least $10.7 million.

According to Forbes, a warning jointly issued by multiple agencies including the Federal Bureau of Investigation (FBI) and the National Police Agency (NPA) of Japan indicates that the North Korea-linked hacker group WaterPlum (also known as Contagious Interview) will launch attacks on global IT developers from December 2025 to July 2026 by disguising itself as companies in the AI, cryptocurrency, or NFT sectors and offering fake job positions.Attackers contact job seekers on social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or programming tests. They successfully infected over 30,000 devices, covering more than 100 countries and regions, and stole data from over 7,000 cryptocurrency wallets. Related funds of at least $10.71 million have flowed into wallets controlled by the attackers.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

According to CoinDesk, XRP treasury management company Evernorth has raised $30 million through the issuance of convertible bonds, with investment from South Korean institutional investor NH Investment & Securities.This financing is contingent upon the successful merger of Evernorth with a SPAC, and the raised funds will be used to purchase XRP spot in advance before its listing on Nasdaq. After the merger is completed, the company plans to list under the code "XRPN" on Nasdaq.

According to Cointelegraph, a report by Chainalysis shows that in the past 12 months, the number of times attackers stored malware instructions or infrastructure information on public blockchains has surged by 420%, with state-sponsored hackers contributing about two-thirds of the new activity each quarter. Chainalysis linked previously unattributed activities on Tron, Aptos, and BNB Smart Chain to the North Korean-backed organization UNC5342.The report points out that the encoded pointers in Tron and Aptos transactions direct infected devices to the same BSC transaction, which contains encrypted server addresses and configuration data used to connect to remote access and data theft infrastructure. Information on public blockchains remains accessible even after domain names, servers, or code repositories are shut down, enhancing the persistence of malware activities. In 2025, North Korean hackers used similar technology called EtherHiding to implant coin theft code into smart contracts.Additionally, since July 2025, the volume of malicious blockchain writes has increased by 440%, when high-capacity open-source Chinese AI models began to have the ability to generate malicious code. Eric Jardine, head of cybercrime research at Chainalysis, stated that a clear temporal correlation was found, but it could not be proven that the attackers used these models.Chainalysis also identified threat actors suspected of being linked to the Iranian Ministry of Intelligence, writing encoded command and control routing data into the Bitcoin blockchain and sending small payments to well-known addresses historically associated with Satoshi Nakamoto, which are unrelated to the attackers and serve only as a permanent public location for infected devices to receive update instructions.

According to NBC, North Korea is utilizing remote IT workers from third countries such as Iran and Lebanon to assist in infiltrating American companies and obtaining funds to finance its weapons programs. Alerts issued by the U.S. and several foreign agencies in July indicated that North Korean IT workers "seek to sign contracts with the intention of remitting salaries back to relevant North Korean agencies," while also posing internal threats to companies, involving data leaks, cryptocurrency theft, and sensitive information theft.As governments like the United States increase countermeasures, North Korea is increasingly leveraging third-country IT workers to secure job interviews, and after obtaining work contracts, the relevant positions are typically taken over by North Korean agents. Reports indicate that these foreign IT workers are scouted on LinkedIn, with some earning about $500 per month in cryptocurrency to work part-time as "interview assistants."Cointelegraph reported in May, citing data from cybersecurity company CrowdStrike, that state-affiliated North Korean hackers and threat actors caused cryptocurrency losses exceeding $2 billion in 2025, a 51% increase year-on-year. The Bank of Korea estimates that despite facing global sanctions, North Korea's GDP will still grow by 3.5% in 2025.

According to Catcher Predict monitoring, in the market prediction event on Polymarket "LoL: Cupid Esports vs. Maryville University - North American Challenger League Playoffs," the "Yes" option for the sub-market "Both sides kill Baron Nashor" has experienced a dramatic fluctuation in winning probability, soaring from 50% an hour ago to the current 90.5% (a fluctuation of 40.5%). Please note the impact of related breaking news.