The North Korean state-sponsored hackers known as Kimsuky has reportedly suffered a data breach after two hackers, who describe themselves as the opposite of Kimsuky’s values, stole the group’s data and leaked it publicly online.

The two hackers, named ‘Saber’ and ‘cyb0rg,’ cited ethical reasons for their actions, saying Kimsuky is “hacking for all the wrong reasons,” claiming they’re driven by political agendas and follow regime orders instead of practicing the art of hacking independently.

“Kimsuky, you are not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda,” reads the hackers’ address to Kimsuky published in the latest issue of Phrack, which was distributed at the DEF CON 33 conference.

“You steal from others and favour your own. You value yourself above the others: You are morally perverted.”

The hackers dumped a portion of Kimsuky’s backend, exposing both their tooling and some of their stolen data that could provide insight into unknown campaigns and undocumented compromises.

The 8.9GB dump currently hosted on the ‘Distributed Denial of Secrets” website contains, among others:

• Phishing logs with multiple dcc.mil.kr (Defense Counterintelligence Command) email accounts.
• Other targeted domains: spo.go.kr, korea.kr, daum.net, kakao.com, naver.com.
• .7z archive containing the complete source code of South Korea’s Ministry of Foreign Affairs email platform (“Kebi”), including webmail, admin, and archive modules.
• References to South Korean citizen certificates and curated lists of university professors.
• PHP “Generator” toolkit for building phishing sites with detection evasion and redirection tricks.
• Live phishing kits.
• Unknown binary archives (voS9AyMZ.tar.gz, Black.x64.tar.gz) and executables (payload.bin, payload_test.bin, s.x64.bin) not flagged in VirusTotal.
• Cobalt Strike loaders, reverse shells, and Onnara proxy modules found in VMware drag-and-drop cache.
• Chrome history and configs linking to suspicious GitHub accounts (wwh1004.github.io, etc.), VPN purchases (PureVPN, ZoogVPN) via Google Pay, and frequent use of hacking forums (freebuf.com, xaker.ru).
• Google Translate use for Chinese error messages and visits to Taiwan government and military sites.
• Bash history with SSH connections to internal systems.

The hackers note that some of the above are already known or previously documented, at least partially.

However, the dump gives a new dimension to the data and provides interlinking between Kimsuky’s tools and activities, exposing and effectively “burning” the APT’s infrastructure and methods.

BleepingComputer has contacted various security researchers to confirm the veracity of the leaked documents and its value and will update the story if we receive a response.

While the breach will likely not have long-term impact on Kimsuky’s operations, it could lead to operational difficulties for Kimsuky and disruptions to ongoing campaigns.

The latest issue of Phrack (#72) is currently only available in a limited physical copy, but the online version should be ready for people to read for free in the following days from here.

This week, a casual IPO poll from Ripple CTO David Schwartz took an unexpected turn when one user seized the opportunity to renew a familiar accusation: that Kraken’s cofounder, Jesse Powell, has long held a negative view of Ripple and XRP. Schwartz was not having it. In his opinion, Powell’s stance has always been more nuanced.

You Might Also Like

This comment prompted closer scrutiny of Powell’s XRP history, revealing that the relationship is far from straightforward. Powell has been vocal about the legal ambiguity surrounding XRP for years, often pointing out how its early ties to Ripple Labs (then OpenCoin) could create complications for regulators. 

However, his tone has not been one of disdain but rather one of caution layered with technical nuance.

In one notable thread, he argued that if XRP were found to be a security, exchanges such as Kraken could be held liable, even if they operated in good faith. He described this as an “asymmetrical risk” that made listing decisions difficult. 

Later, when Kraken suspended XRP trading for U.S. customers, Powell made it clear that it was a business decision, not a personal one, describing the legal uncertainty as “too risky from a business perspective.”

Kraken aims for $15 billion IPO

Now, that debate is resurfacing just as Kraken reenters IPO territory. The company is reportedly raising $100 million ahead of a potential public listing, aiming for a valuation of over $15 billion. The funding round is expected to close by the end of the year and, if successful, would revive IPO plans that were shelved after Coinbase’s turbulent debut.

You Might Also Like

Kraken remains one of the world’s most active exchanges, posting over $1.37 billion in daily trading volume and supporting more than 1,100 trading pairs.

President Trump has filed a defamation lawsuit against The Wall Street Journal and its parent company News Corp, alleging they falsely claimed he sent a lewd birthday card to Jeffrey Epstein in 2003.

The lawsuit, filed in Florida federal court, centers on a July 17, 2025 WSJ article titled “Jeffrey Epstein’s Friends Sent Him Bawdy Letters for a 50th Birthday Album. One was from Donald Trump.” Trump seeks $10 billion in damages, claiming the story was fabricated to “malign President Trump’s character and integrity.”

According to the complaint, the WSJ article described a card allegedly containing “several lines of typewritten text framed by the outline of a naked woman” with Trump’s signature placed “below her waist, mimicking pubic hair.” The article claimed the card included a theatrical-style dialogue between Trump and Epstein, with lines like “We have certain things in common, Jeffrey” and ending with “A pal is a wonderful thing. Happy Birthday — and may every day be another wonderful secret.”

Trump’s lawyers say they warned the WSJ before publication that the story was false, writing in an email that “President Trump did not author the purported letter.” The complaint states the Journal “failed to attach the letter, failed to attach the alleged drawing, failed to show proof that President Trump authored or signed any such letter, and failed to explain how this purported letter was obtained.”

The lawsuit names WSJ parent company News Corp, its owner Rupert Murdoch, CEO Robert Thomson, and the article’s authors Khadeeja Safdar and Joseph Palazzolo as defendants. It claims the story has been viewed by “hundreds of millions of people” and caused “overwhelming financial and reputational damages to President Trump.”

“The reason for those failures is because no authentic letter or drawing exists,” the lawsuit states.

The WSJ has yet to respond to the lawsuit. My guess is they are well-prepared to deal with it.

Russian professional basketball player Daniil Kasatkin was arrested in France at the request of the United States for allegedly acting as a negotiator for a ransomware gang.

Daniil Kasatkin is a Russian basketball player who briefly played NCAA basketball at Penn State before returning to Russia in 2019. In four seasons with MBA-MAI, he appeared in 172 games before he left the team.

According to French media, Kasatkin was arrested at Paris’s Charles de Gaulle airport on June 21st after landing in France with his fiancée.

The arrest was made as part of a United States international arrest warrant for his role as an alleged negotiator for a ransomware gang.

Kasatkin is now under custody while the US seeks to have him extradited to face charges of “conspiracy to commit computer fraud” and “computer fraud conspiracy.”

His lawyer alleges that Kasatkin is not guilty of these crimes and that they are instead linked to a second-hand computer that he purchased.

“He bought a second-hand computer. He did absolutely nothing. He’s stunned ,” his lawyer, Frédéric Bélot, told the media.

“He’s useless with computers and can’t even install an application. He didn’t touch anything on the computer: it was either hacked, or the hacker sold it to him to act under the cover of another person.”

While the name of the ransomware gang was not disclosed, it is reported to have been behind attacks on more than 900 companies, including two federal agencies, between 2020 and 2022.

This description closely matches similar language used by the Department of Justice to refer to the notorious Conti ransomware gang, which emerged as a successor to Ryuk in 2020 and shut down in 2022, following a data breach.

However, it was not previously reported that Conti breached any federal agencies, though they are linked to attacks on state governments.

Last month, French police also arrested four alleged operators of the BreachForums hacking forum, including threat actors using the alias IntelBroker and ShinyHunters.

A 42-year-old man who is accused of running a $30 million scam targeting elderly Americans has reportedly just been arrested in Canada.

Gareth West was arrested in Quebec on behalf of American authorities and is now facing extradition to the United States to face fraud charges, reports CBC/Radio-Canada.

West is alleged to have posed as a wealthy real estate developer while running a complex “grandparent scam network” that employed more than 20 people and included multiple call centers in the Montreal area.

He faces charges in the US of conspiracy to commit wire fraud and conspiracy to commit money laundering, according to the Royal Canadian Mounted Police (RCMP).

West is alleged to have been the mastermind behind grandparent scammers since at least 2021. The scammers would allegedly phone older Americans, pretend they were their grandchildren who had been arrested or hurt, and say they needed cash right away. Scammers would connect the elderly victims to fake lawyers or bail agents and arrange for cash pickups.

Some 23 of West’s alleged scammer employees were arrested in March.

Police allege that documents they’ve recovered from the suspected scammers show they scammed $30 million during a span of about 67 weeks.

West faces up to 40 years in prison if extradited to the US and convicted of the crimes.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Hackers reportedly stole $100 million from the Central Bank of Brazil using security credentials purchased from an alleged insider.

According to a new AP report, the cyberattack targeted Brazil’s popular instant payment system, known as PIX, to steal the massive nine-figure sum.

Hackers were able to pull off the scheme by infiltrating the C&M system, the software company that facilitates connections between financial institutions and the central bank to enable PIX payment transactions.

Police say the hackers used security credentials they allegedly purchased from C&M employee João Roque, who they just arrested. Roque allegedly told investigators he was recruited by the hackers last year and sold them his credentials. The AP was unable to reach Roque’s attorneys for comment.

After gaining access to the C&M system, the hackers initiated fake PIX operations, making off with $100 million in a single night from financial institutions that are plugged into the C&M network.

Police say they are attempting to identify the hackers and that at least four other people participated in the crime. Authorities are also attempting to freeze the suspected stolen assets, and say they have blocked about half the stolen funds connected to the scheme.

In a statement published by local media, C&M says that it is cooperating with authorities and that the breach was likely due to unauthorized access to security credentials, not system flaws.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney