Secretly – Earlybirds Invest https://earlybirdsinvest.com Latest Crypto News Tue, 05 Aug 2025 14:29:41 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.11 https://i0.wp.com/earlybirdsinvest.com/wp-content/uploads/2024/12/cropped-New-Project-2024-12-17T235703.455.png?fit=32%2C32&ssl=1 Secretly – Earlybirds Invest https://earlybirdsinvest.com 32 32 240146708 Bitcoin Is Secretly Tracking This Market Signal: Weiss Crypto https://earlybirdsinvest.com/bitcoin-is-secretly-tracking-this-market-signal-weiss-crypto/ https://earlybirdsinvest.com/bitcoin-is-secretly-tracking-this-market-signal-weiss-crypto/#respond Tue, 05 Aug 2025 14:29:41 +0000 https://earlybirdsinvest.com/bitcoin-is-secretly-tracking-this-market-signal-weiss-crypto/

Reason to trust

Strict editorial policy that focuses on accuracy, relevance, and impartiality

Created by industry experts and meticulously reviewed

The highest standards in reporting and publishing

Strict editorial policy that focuses on accuracy, relevance, and impartiality

Morbi pretium leo et nisl aliquam mollis. Quisque arcu lorem, ultricies quis pellentesque nec, ullamcorper eu odio.

A thread posted late on 4 August 2025 by Weiss Crypto analyst Juan Villaverde has ignited debate about a rarely discussed harbinger of Bitcoin price cycles. In a thread on X, the quantitative researcher argued that an “overlooked asset class”—one he says almost no-one monitors in a crypto context—consistently pivots months before Bitcoin does, offering what he calls “a sneak peek at major turning points.” Villaverde’s proprietary back-testing suggests the lag is approximately six months, enough lead time, he claims, to anticipate the apex of the current bull market in late November.

How Gold’s Trendlines Map The Bitcoin Price

“Many are aware that Bitcoin tends to follow global liquidity—with a roughly twelve-week lag,” Weiss Crypto wrote, setting the stage for the reveal. “But Juan Villaverde has quietly tracked a different early indicator… one that can signal where BTC is headed six months in advance.” In a follow-up post he teased, “That little-known indicator? [ … ]. Turns out, its price action often leads Bitcoin by several months—providing a sneak peek at major turning points.”

Related Reading

Villaverde’s thesis rests on a data series stretching back to the advent of modern crypto markets. He points to the trough of December 2018, which, in his reconstruction, was foreshadowed by a significant low in the mystery market some weeks earlier. “After analysing years of data, Juan spotted a consistent pattern,” Weiss Crypto stated, quoting the analyst to the effect that “major lows [there] tend to precede major lows in Bitcoin.”

The same lead-lag cadence, Villaverde notes, flashed red in November 2021 when Bitcoin printed its all-time high even as the benchmark asset he tracks refused to break higher—an omen that presaged the 2022 bear market.

Bitcoin vs gold in 2021
Bitcoin vs gold in 2021 | Source: X @WeissCrypto

The model is not without blemishes. Weiss Crypto acknowledged “one exception in recent years—during the Russia–Ukraine invasion—where the Bitcoin relationship temporarily inverted due to macro chaos.” Yet Villaverde maintains the anomaly reinforces rather than weakens his conviction: exogenous geopolitical shocks can distort correlations, but once the shock dissipates the historic rhythm reasserts itself.

Related Reading

Where does that leave the market in mid-2025? “According to Juan’s analysis,” the firm wrote, “the indicator is pointing to a major high in Bitcoin around late November 2025. That aligns perfectly with his Crypto Timing Model.” Villaverde cautions that the signal is dynamic, not deterministic. If the benchmark asset he watches “rallies above its April high,” it would imply “Bitcoin could march higher into 2026.” Conversely, any decisive breakdown would “be an early warning that crypto’s bull market may be nearing its end after November.”

Bitcoin vs gold in 2025
Bitcoin vs gold in 2025 | Source: X @WeissCrypto

Villaverde insists the relationship he has identified is robust because it focuses on magnitude rather than direction alone. “It’s not only the turns that matter,” he said in a direct message to this outlet, “but the amplitude of those turns.” By quantifying both, he argues, the signal captures investor psychology cycling from fear to greed and back again.

At press time, BTC traded at $114,522.

Bitcoin price
BTC stabilizes above the 50-day EMA, 1-day chart | Source: BTCUSDT on TradingView.com

Featured image created with DALL.E, chart from TradingView.com

]]>
https://earlybirdsinvest.com/bitcoin-is-secretly-tracking-this-market-signal-weiss-crypto/feed/ 0 51618
Sanctioned nations are secretly mining Bitcoin and the clues are in the hash rate https://earlybirdsinvest.com/sanctioned-nations-are-secretly-mining-bitcoin-and-the-clues-are-in-the-hash-rate/ https://earlybirdsinvest.com/sanctioned-nations-are-secretly-mining-bitcoin-and-the-clues-are-in-the-hash-rate/#respond Sat, 02 Aug 2025 07:20:07 +0000 https://earlybirdsinvest.com/sanctioned-nations-are-secretly-mining-bitcoin-and-the-clues-are-in-the-hash-rate/

HIVE Digital co-founder Frank Holmes stated this week that several sanctioned nations are actively mining Bitcoin (BTC) in secret, turning to the crypto as an alternative revenue stream in the face of U.S. financial restrictions.

Holmes made the claims during a recent interview with the Roundtable. He tied a recent drop in global mining difficulty to military strikes targeting power infrastructure in Iran, suggesting the country’s military was using energy resources to mine Bitcoin and generate hard currency.

The comments reflect a broader trend in which governments cut off from traditional financial systems are leveraging crypto mining to fill economic gaps.

Holmes said this is not limited to Iran, implying that other countries facing US sanctions are also participating in similar operations, though much of it remains undisclosed.

He further claimed that Bitcoin has become a strategic asset, especially for nations struggling to access dollars. Mining provides a direct route to accumulate value outside the traditional financial ecosystem.

Holmes said that disruptions to mining facilities can now be observed in network-level data such as hash rate fluctuations.

HIVE ramping up production

While pointing to adversaries of the US using crypto mining as a financial lifeline, HIVE Digital is pursuing growth in U.S.-aligned nations.

The company recently expanded its footprint in Paraguay, acquiring infrastructure to scale operations more rapidly. The decision required divesting a portion of its Bitcoin holdings, but Holmes described it as a strategic trade-off to accelerate production.

Paraguay’s supportive regulatory stance and energy resources make it a key location for HIVE’s expansion, particularly compared to more politically volatile countries in the region.

The move comes amid growing sentiment that Bitcoin mining will continue to flourish in jurisdictions aligned with U.S. economic interests, particularly under the current administration.

HIVE has now surpassed 14 exahashes per second (EH/s) in mining capacity, with a goal of reaching 25 EH/s by the end of November. At current output, the company is generating approximately $315 million in annualized revenue, placing it among the top contenders in terms of efficiency and scale.

The remarks highlight a shifting landscape where mining activity is not just about profitability, but increasingly intertwined with global alliances, sanctions evasion, and power projection through digital infrastructure.

Mentioned in this article
]]>
https://earlybirdsinvest.com/sanctioned-nations-are-secretly-mining-bitcoin-and-the-clues-are-in-the-hash-rate/feed/ 0 51007
In North Korea, your phone secretly takes screenshots every 5 minutes for government surveillance https://earlybirdsinvest.com/in-north-korea-your-phone-secretly-takes-screenshots-every-5-minutes-for-government-surveillance/ https://earlybirdsinvest.com/in-north-korea-your-phone-secretly-takes-screenshots-every-5-minutes-for-government-surveillance/#respond Mon, 02 Jun 2025 19:03:01 +0000 https://earlybirdsinvest.com/in-north-korea-your-phone-secretly-takes-screenshots-every-5-minutes-for-government-surveillance/

The big picture: A smartphone smuggled out of North Korea is offering a rare – and unsettling – glimpse into the extent of control Kim Jong Un’s regime exerts over its citizens, down to the very words they type. While the device appears outwardly similar to any modern smartphone, its software reveals a far more oppressive reality.

The phone was featured in a BBC video, which showed it powering on with an animated North Korean flag waving across the screen. While the report did not specify the brand, the design and user interface closely resembled those of a Huawei or Honor device.

It’s unclear whether these companies officially sell phones in North Korea, but if they do, the devices are likely customized with state-approved software designed to restrict functionality and facilitate government surveillance.

One of the more revealing – and darkly amusing – features was the phone’s automatic censorship of words deemed problematic by the state. For instance, when users typed oppa, a South Korean term used to refer to an older brother or a boyfriend, the phone automatically replaced it with comrade. A warning would then appear, admonishing the user that oppa could only refer to an older sibling.

Typing “South Korea” would trigger another change. The phrase was automatically replaced with “puppet state,” reflecting the language used in official North Korean rhetoric.

Then came the more unsettling features. The phone silently captured a screenshot every five minutes, storing the images in a hidden folder that users couldn’t access. According to the BBC, authorities could later review these images to monitor the user’s activity.

The device was smuggled out of North Korea by Daily NK, a Seoul-based media outlet specializing in North Korean affairs. After examining the phone, the BBC confirmed that the censorship mechanisms were deeply embedded in its software. Experts say this technology is designed not only to control information but also to reinforce state messaging at the most personal level.

Smartphone usage has grown in North Korea in recent years, but access remains tightly controlled. Devices cannot connect to the global internet and are subject to intense government surveillance.

The regime has reportedly intensified efforts to eliminate South Korean cultural influence, which it views as subversive. So-called “youth crackdown squads” have been deployed to enforce these rules, frequently stopping young people on the streets to inspect their phones and review text messages for banned language.

Some North Korean escapees have shared that exposure to South Korean dramas or foreign radio broadcasts played a key role in their decision to flee the country. Despite the risks, outside media continues to be smuggled in – often via USB sticks and memory cards hidden in food shipments. Much of this effort is supported by foreign organizations.

Image credit: BBC

]]>
https://earlybirdsinvest.com/in-north-korea-your-phone-secretly-takes-screenshots-every-5-minutes-for-government-surveillance/feed/ 0 39750
Malicious npm package secretly targets Atomic, Exodus wallets to intercept and reroutes funds https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/ https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/#respond Tue, 15 Apr 2025 06:03:40 +0000 https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/

Researchers have discovered a malicious software package uploaded to npm that secretly alters locally installed versions of crypto wallets and allows attackers to intercept and reroute digital currency transactions, ReversingLabs revealed in a recent report.

The campaign injected trojanized code into locally installed Atomic and Exodus wallet software and hijacked crypto transfers. The attack centered on a deceptive npm package, pdf-to-office, which posed as a library for converting PDF files to Office formats.

When executed, the package silently located and modified specific versions of Atomic and Exodus wallets on victims’ machines, redirecting outgoing crypto transactions to wallets controlled by threat actors.

ReversingLabs said the campaign exemplifies a broader shift in tactics: rather than directly compromising open-source libraries, which often triggers swift community responses, attackers are increasingly distributing packages designed to “patch” local installations of trusted software with stealthy malware.

Targeted file patching

The pdf-to-office package was first uploaded to npm in March and updated multiple times through early April. Despite its stated function, the package lacked actual file conversion features.

Instead, its core script executed obfuscated code that searched for local installations of Atomic Wallet and Exodus Wallet and overwrote key application files with malicious variants.

The attackers replaced legitimate JavaScript files inside the resources/app.asar archive with near-identical trojanized versions that substituted the user’s intended recipient address with a base64-decoded wallet belonging to the attacker.

For Atomic Wallet, versions 2.90.6 and 2.91.5 were specifically targeted. Meanwhile, a similar method was applied to Exodus Wallet versions 25.9.2 and 25.13.3.

Once modified, the infected wallets would continue redirecting funds even if the original npm package was deleted. Full removal and reinstallation of the wallet software were required to eliminate the malicious code.

ReversingLabs also noted the malware’s attempts at persistence and obfuscation. Infected systems sent installation status data to an attacker-controlled IP address (178.156.149.109), and in some cases, zipped logs and trace files from AnyDesk remote access software were exfiltrated, suggesting an interest in deeper system infiltration or evidence removal.

Expanding software supply chain threats

The discovery follows a similar March campaign involving ethers-provider2 and ethers-providerz, which patched the ethers npm package to establish reverse shells. Both incidents highlight the rising complexity of supply chain attacks targeting the crypto space.

ReversingLabs warned that these threats continue to evolve, especially in web3 environments where local installations of open-source packages are common. Attackers increasingly rely on social engineering and indirect infection methods, knowing that most organizations fail to scrutinize already installed dependencies.

According to the report:

“This kind of patching attack remains viable because once the package is installed and the patch is applied, the threat persists even if the source npm module is removed.”

The malicious package was flagged by ReversingLabs’ machine-learning algorithms under Threat Hunting policy TH15502. It has since been removed from npm, but a republished version under the same name and version 1.1.2 briefly reappeared, indicating the threat actor’s persistence.

Investigators published hashes of affected files and wallet addresses used by the attackers as indicators of compromise (IOCs). These include wallets used for illicit fund redirection, as well as the SHA1 fingerprints of all infected package versions and associated trojanized files.

As software supply chain attacks become more frequent and technically refined, especially in the digital asset space, security experts are calling for stricter code auditing, dependency management, and real-time monitoring of local application changes.

Mentioned in this article
]]>
https://earlybirdsinvest.com/malicious-npm-package-secretly-targets-atomic-exodus-wallets-to-intercept-and-reroutes-funds/feed/ 0 30863
Triada Trojan Secretly Draining Crypto from Android Devices https://earlybirdsinvest.com/triada-trojan-secretly-draining-crypto-from-android-devices/ https://earlybirdsinvest.com/triada-trojan-secretly-draining-crypto-from-android-devices/#respond Sun, 06 Apr 2025 15:24:41 +0000 https://earlybirdsinvest.com/triada-trojan-secretly-draining-crypto-from-android-devices/

Android smartphones sold online at discounted prices are being shipped with hidden malware that can steal crypto and personal data, according to an April 1 report from the cybersecurity firm Kaspersky.

The malware, known as Triada, allows attackers to access nearly everything on the phone. It can read text messages, gather login details, and change cryptocurrency wallet addresses during transactions. This lets the attackers quietly move funds to their own accounts without the user noticing.

Kaspersky found that around $270,000 of digital assets had already been moved to wallets linked to the attackers. However, this number may be higher, especially since they also targeted Monero
XMR


$212.80

, a type of cryptocurrency that is difficult to trace.

What is Monero? XMR Animated Explainer

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What makes the threat harder to detect is that the malware is installed before the phone ever reaches the buyer. Some sellers may be unaware that the devices they offer are already compromised. Kaspersky’s experts believe that somewhere along the supply chain—perhaps during production or shipment—the phones are being tampered with.

Over 2,600 infections have been confirmed, mostly in Russia, and all reported within the first three months of 2025. Triada, which has been around since 2016, was initially used to target financial apps and messaging platforms like WhatsApp and Gmail, which often spread through fake apps or misleading links.

According to Dmitry Kalinin from Kaspersky, Triada remains one of the most serious threats to Android users, as it gives attackers ongoing access without the victim realizing it.

On March 28, ThreatFabric, a cybersecurity company, discovered an Android malware called Crocodilus. How does this malware work? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.


]]>
https://earlybirdsinvest.com/triada-trojan-secretly-draining-crypto-from-android-devices/feed/ 0 29339
Billion-Dollar Bank’s Employee Secretly Transfers $123,000 From Customer Accounts to His Associates: FDIC https://earlybirdsinvest.com/billion-dollar-banks-employee-secretly-transfers-123000-from-customer-accounts-to-his-associates-fdic/ https://earlybirdsinvest.com/billion-dollar-banks-employee-secretly-transfers-123000-from-customer-accounts-to-his-associates-fdic/#respond Sat, 15 Mar 2025 23:58:03 +0000 https://earlybirdsinvest.com/billion-dollar-banks-employee-secretly-transfers-123000-from-customer-accounts-to-his-associates-fdic/

An employee at a billion-dollar bank transferred a massive pile of cash from customer accounts without permission for his own purposes, according to the Federal Deposit Insurance Corporation (FDIC).

In a new filing, the FDIC alleges that while working as an international sales representative at the International Bank of Commerce in Laredo, Texas, Martin Fernandez, Jr. “made unauthorized transfers of approximately $123,563” from the accounts of two customers between July of 2018 and August of 2021.

According to the FDIC, Fernandez moved the money to three of his known associates.

The US banking regulator says that one of Fernandez’s victims was an International Bank of Commerce customer who wanted to open a new account. After the account was opened, Fernandez then helped the customer transfer funds to the newly created account on or about July 18th of 2019. The following day, Fernandez made multiple transfers from the customer’s newly created account to an associate without authorization.

Between five and seven months later, Fernandez made multiple unauthorized transfers from the same account to another associate without the customer’s permission.

Fast forward to between July 20th of 2020 and August 12th of 2021, Fernandez also initiated multiple unauthorized transfers from the account of another customer to yet another associate.

The banking regulator says that the former International Bank of Commerce employee has already been criminally charged.

“On October 19, 2023, Respondent entered a guilty plea in the District Court of Webb County, Texas, to one count of third degree felony theft based on the misconduct just summarized.”

The FDIC says Fernandez’s actions, which caused the International Bank of Commerce a financial loss, violated the law and constituted unsafe and unsound banking practices. Consequently, Fernandez is barred from working in US-based banks and other financial institutions regulated by the FDIC.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

]]>
https://earlybirdsinvest.com/billion-dollar-banks-employee-secretly-transfers-123000-from-customer-accounts-to-his-associates-fdic/feed/ 0 25357