Atomic – Earlybirds Invest https://earlybirdsinvest.com Latest Crypto News Mon, 15 Sep 2025 20:58:03 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.10 https://i0.wp.com/earlybirdsinvest.com/wp-content/uploads/2024/12/cropped-New-Project-2024-12-17T235703.455.png?fit=32%2C32&ssl=1 Atomic – Earlybirds Invest https://earlybirdsinvest.com 32 32 240146708 AMF warns MICA of “atomic weapons” and France threatens to break the EU crypto market https://earlybirdsinvest.com/amf-warns-mica-of-atomic-weapons-and-france-threatens-to-break-the-eu-crypto-market/ https://earlybirdsinvest.com/amf-warns-mica-of-atomic-weapons-and-france-threatens-to-break-the-eu-crypto-market/#respond Mon, 15 Sep 2025 20:58:03 +0000 https://earlybirdsinvest.com/amf-warns-mica-of-atomic-weapons-and-france-threatens-to-break-the-eu-crypto-market/

The French crypto industry is once again in the spotlight. Reuters reveals that France is once again at the heart of European crypto debate, indicating that it could move to block licensed companies in other EU jurisdictions from operating within the country.

The regulatory warning issued on Monday by Marie-Anne Barbat-Layani, Chairman of the Autorité des Marchés Financiers (AMF), highlights the deep fractures already manifested in the European Union’s groundbreaking market in the European Union’s Crypto Asset Regulation (MICA).

MICA, officially enacted by service providers in December 2024, was billed as the world’s first comprehensive digital asset rulebook.

This framework allows crypto companies to obtain permits in one member country and “passport” their licenses in all 27 countries.

However, since the scheme was rolled out, Ireland, for example, has so far received 17.5 times the number of crypto-passports as France.

For businesses, the passport mechanism is an award and an efficient gateway to the block’s single market. However, regulators like the AMF have made fault lines public for the past nine months.

24 hours7d1Y

Barbat-Layani warned that companies are already “shopping” for their weakest jurisdictions, and have secured light touch licenses before expanding to larger markets such as France. “The possibility of denying an EU passport is not ruled out,” she told Reuters, comparing the option to “atomic weapons” that can be deployed if the director gap continues.

This comment is because France, Italy and Austria jointly seek the European Securities and Markets Agency (ESMA) to envisage direct surveillance of major crypto companies.

In a joint paper, three regulators argued that the implementation of the early MICA revealed a “major difference” in the way national supervisors interpret and enforce rules. They argue that the direct ESMA oversight they argue is essential to protect investors and ensure a level playing field.

That push follows stinging criticism of Malta’s licensing regime. In July, in a peer review of the ESMA, the Malta Financial Services Agency found that it “partially met expectations” when approving the crypto provider, highlighting a decline in risk assessments and slow follow-up of supervision.

Additionally, the report has encouraged concerns that smaller jurisdictions could become regulatory gateways for businesses seeking rapid EU access.

Discover: Best New Cryptocurrencies to Invest in 2025

Are there other reasons why crypto companies are escheating France?

The regulatory debate of the high stakes unfolds against the tense background in France’s own crypto ecosystem. Over the past few months, a series of violent intrigues targeting crypto entrepreneurs and their families has rattled the industry. French police have attempted to acquiring at least half a dozen of them to demand ransom for digital assets, including cases in which victims were cut off to put pressure on millions of payments.

Security experts warn that some of the new EU reporting requirements could make it easier for criminals to identify wealthy targets.

This double pressure, fragmentation of regulations at the EU level and rising domestic security concerns have put Paris in a difficult position as the summer season approaches.

AMF has spent years on blockchain startups that brand France as a jurisdiction of clarity and reliability, especially after granting a license to Binance’s French organization in 2022.

The interests are high for investors and businesses. If France unilaterally refuses to recognize licenses from other EU states, the single market promises supporting MICA could break before they become fully established.

However, it is important to understand that risk is not just reputation but structural. The divergence of EU oversight will undermine confidence at the moment Europe is considering whether Trump can provide a reliable alternative to America.

Discover: 9+ Best High Risk, High Reward Cryptographs for Buying in 2025

Why you can trust 99 Bitcoin?

Over 10 years

Founded in 2013, 99 Bitcoin team members have been experts in crypto since the early days of Bitcoin.

90 hours+

Weekly research

100k+

Monthly Readers

50+

Expert Contributors

2000+

Crypto project reviewed

Google News Icon

Follow 99 Bitcoin on Google News Feed

Provide the latest updates, trends and insights directly to your fingertips. Subscribe now!

Subscribe now

Alex Aeonnu

On-Chain Journalist

Chasing dreams under the Cyprus sun, Alex is a promising author focusing on the more boring aspects of the crypto market. We’re always on the lookout for the next hot story, meme coin pump, or meta trends. Alex is aggressive… Read more

]]> https://earlybirdsinvest.com/amf-warns-mica-of-atomic-weapons-and-france-threatens-to-break-the-eu-crypto-market/feed/ 0 58623 Malicious npm package secretly targets Atomic, Exodus wallets to intercept and reroutes funds https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/ https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/#respond Tue, 15 Apr 2025 06:03:40 +0000 https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/

Researchers have discovered a malicious software package uploaded to npm that secretly alters locally installed versions of crypto wallets and allows attackers to intercept and reroute digital currency transactions, ReversingLabs revealed in a recent report.

The campaign injected trojanized code into locally installed Atomic and Exodus wallet software and hijacked crypto transfers. The attack centered on a deceptive npm package, pdf-to-office, which posed as a library for converting PDF files to Office formats.

When executed, the package silently located and modified specific versions of Atomic and Exodus wallets on victims’ machines, redirecting outgoing crypto transactions to wallets controlled by threat actors.

ReversingLabs said the campaign exemplifies a broader shift in tactics: rather than directly compromising open-source libraries, which often triggers swift community responses, attackers are increasingly distributing packages designed to “patch” local installations of trusted software with stealthy malware.

Targeted file patching

The pdf-to-office package was first uploaded to npm in March and updated multiple times through early April. Despite its stated function, the package lacked actual file conversion features.

Instead, its core script executed obfuscated code that searched for local installations of Atomic Wallet and Exodus Wallet and overwrote key application files with malicious variants.

The attackers replaced legitimate JavaScript files inside the resources/app.asar archive with near-identical trojanized versions that substituted the user’s intended recipient address with a base64-decoded wallet belonging to the attacker.

For Atomic Wallet, versions 2.90.6 and 2.91.5 were specifically targeted. Meanwhile, a similar method was applied to Exodus Wallet versions 25.9.2 and 25.13.3.

Once modified, the infected wallets would continue redirecting funds even if the original npm package was deleted. Full removal and reinstallation of the wallet software were required to eliminate the malicious code.

ReversingLabs also noted the malware’s attempts at persistence and obfuscation. Infected systems sent installation status data to an attacker-controlled IP address (178.156.149.109), and in some cases, zipped logs and trace files from AnyDesk remote access software were exfiltrated, suggesting an interest in deeper system infiltration or evidence removal.

Expanding software supply chain threats

The discovery follows a similar March campaign involving ethers-provider2 and ethers-providerz, which patched the ethers npm package to establish reverse shells. Both incidents highlight the rising complexity of supply chain attacks targeting the crypto space.

ReversingLabs warned that these threats continue to evolve, especially in web3 environments where local installations of open-source packages are common. Attackers increasingly rely on social engineering and indirect infection methods, knowing that most organizations fail to scrutinize already installed dependencies.

According to the report:

“This kind of patching attack remains viable because once the package is installed and the patch is applied, the threat persists even if the source npm module is removed.”

The malicious package was flagged by ReversingLabs’ machine-learning algorithms under Threat Hunting policy TH15502. It has since been removed from npm, but a republished version under the same name and version 1.1.2 briefly reappeared, indicating the threat actor’s persistence.

Investigators published hashes of affected files and wallet addresses used by the attackers as indicators of compromise (IOCs). These include wallets used for illicit fund redirection, as well as the SHA1 fingerprints of all infected package versions and associated trojanized files.

As software supply chain attacks become more frequent and technically refined, especially in the digital asset space, security experts are calling for stricter code auditing, dependency management, and real-time monitoring of local application changes.

Mentioned in this article
]]> https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/feed/ 0 30863