Slips – Earlybirds Invest https://earlybirdsinvest.com Latest Crypto News Fri, 25 Jul 2025 04:36:59 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.7 https://i0.wp.com/earlybirdsinvest.com/wp-content/uploads/2024/12/cropped-New-Project-2024-12-17T235703.455.png?fit=32%2C32&ssl=1 Slips – Earlybirds Invest https://earlybirdsinvest.com 32 32 240146708 DOGE slips to $0.234 after 6-month high https://earlybirdsinvest.com/doge-slips-to-0-234-after-6-month-high/ https://earlybirdsinvest.com/doge-slips-to-0-234-after-6-month-high/#respond Fri, 25 Jul 2025 04:36:58 +0000 https://earlybirdsinvest.com/doge-slips-to-0-234-after-6-month-high/
.234 after 6-month high” width=”100%” height=”100%” data-lazy-src=”https://coinjournal.net/wp-content/uploads/2025/06/Dogecoin-price-prediction-as-DOGE-drops-below-0.2.png”>
  • Short-term holders trigger correction by locking in gains.
  • DOGE trades at $0.234, below key resistance at $0.245.
  • Price could test $0.198 if $0.220 support fails.

Dogecoin has shed 15% of its value after reaching a six-month high earlier this month, as a wave of profit-taking among short-term holders triggered a reversal in the memecoin’s recent rally.

The downturn reflects a broader pattern of sell-offs across the cryptocurrency market, where traders are taking gains off the table amid uncertain macroeconomic signals and resistance at key price levels.

At the time of writing, Dogecoin is trading at $0.234, down from recent highs and sitting below the key resistance level of $0.245.

The pullback marks a significant change in sentiment after a period of renewed optimism.

Dogecoin price
Source: CoinMarketCap

Investor behaviour signals short-term weakness

The realised profit/loss ratio for Dogecoin surged this week, reaching its highest level in six months. This metric tracks the profit or loss recorded by investors at the time of selling.

A sharp rise in this indicator suggests a large number of holders are exiting positions in profit, indicating that confidence in further gains is weakening.

This wave of profit-taking has mostly come from short-term investors, who contributed heavily to DOGE’s recent price correction.

The decision to lock in gains at current levels has put downward pressure on the coin’s price action, suggesting a reluctance to hold through potential near-term volatility.

Market participants are closely watching the $0.220 support level.

If DOGE drops below this zone, it could fall further to around $0.198—a key area last seen in earlier trading cycles.

Long-term holders remain steady amid volatility

Despite the short-term selling, Dogecoin’s long-term outlook may not be entirely compromised.

One key indicator, Liveliness—which measures the activity of long-term holders (LTHs)—continues to decline.

This trend suggests that LTHs are not moving their DOGE, implying they are not joining the sell-off.

This reluctance to liquidate positions has previously served as a stabilising force for Dogecoin during periods of intense market activity.

The declining Liveliness could act as a cushion, slowing the pace of the current correction and potentially preventing a full breakdown in price.

Market analysts often view the behaviour of LTHs as a bellwether for a coin’s resilience.

Their current stance suggests that Dogecoin may still have underlying strength, provided the support levels hold and broader sentiment doesn’t worsen further.

Critical resistance could define next move

Dogecoin’s short-term trajectory will likely hinge on whether it can reclaim the $0.245 resistance level.

A breakout above this threshold could invalidate the current bearish setup and open the door to a recovery towards $0.268.

On the other hand, continued profit-taking without fresh buying momentum could see DOGE extend its losses.

If the $0.220 support gives way, the market could quickly test lower support at $0.198.

As it stands, Dogecoin’s future price action will depend on whether long-term holders can provide enough support to offset the current selling pressure from short-term investors.


Share this article

Categories

Tags

]]>
https://earlybirdsinvest.com/doge-slips-to-0-234-after-6-month-high/feed/ 0 49535
Ethereum Price Slips on Profit-Taking – Limited Downside as Whale Demand Holds https://earlybirdsinvest.com/ethereum-price-slips-on-profit-taking-limited-downside-as-whale-demand-holds/ https://earlybirdsinvest.com/ethereum-price-slips-on-profit-taking-limited-downside-as-whale-demand-holds/#respond Thu, 24 Jul 2025 06:48:48 +0000 https://earlybirdsinvest.com/ethereum-price-slips-on-profit-taking-limited-downside-as-whale-demand-holds/

Ethereum price started a downside correction from the $3,850 zone. ETH is now moving lower but might find bids near the $3,520 support zone.

  • Ethereum started a downside correction below the $3,770 level.
  • The price is trading below $3,680 and the 100-hourly Simple Moving Average.
  • There is a key bearish trend line forming with resistance at $3,670 on the hourly chart of ETH/USD (data feed via Kraken).
  • The pair could start a fresh increase if it remains supported above the $3,550 zone in the near term.

Ethereum Price Holds Support

Ethereum price failed to extend gains above the $3,850 level and started a downside correction, like Bitcoin. ETH price traded below the $3,800 and $3,770 support levels.

There was a move below the 50% Fib retracement level of the upward move from the $3,480 swing low to the $3,859 high. The decline was such that the price even dived below the $3,660 level and the 100-hourly Simple Moving Average.

However, the bulls were active near the 76.4% Fib retracement level of the upward move from the $3,480 swing low to the $3,859 high. Ethereum price is now trading below $3,680 and the 100-hourly Simple Moving Average.

On the upside, the price could face resistance near the $3,670 level. There is also a key bearish trend line forming with resistance at $3,670 on the hourly chart of ETH/USD. The next key resistance is near the $3,770 level. The first major resistance is near the $3,800 level. A clear move above the $3,800 resistance might send the price toward the $3,850 resistance.

Ethereum Price
Source: ETHUSD on TradingView.com

An upside break above the $3,850 resistance might call for more gains in the coming sessions. In the stated case, Ether could rise toward the $4,000 resistance zone or even $4,200 in the near term.

Another Decline In ETH?

If Ethereum fails to clear the $3,670 resistance, it could start a downside correction. Initial support on the downside is near the $3,600 level. The first major support sits near the $3,570 zone.

A clear move below the $3,570 support might push the price toward the $3,520 support. Any more losses might send the price toward the $3,450 support level in the near term. The next key support sits at $3,320.

Technical Indicators

Hourly MACDThe MACD for ETH/USD is losing momentum in the bearish zone.

Hourly RSIThe RSI for ETH/USD is now below the 50 zone.

Major Support Level – $3,520

Major Resistance Level – $3,670

]]>
https://earlybirdsinvest.com/ethereum-price-slips-on-profit-taking-limited-downside-as-whale-demand-holds/feed/ 0 49362
US House sees hiccups as free caucus objects in Crypto Bills procedure slips https://earlybirdsinvest.com/us-house-sees-hiccups-as-free-caucus-objects-in-crypto-bills-procedure-slips/ https://earlybirdsinvest.com/us-house-sees-hiccups-as-free-caucus-objects-in-crypto-bills-procedure-slips/#respond Tue, 15 Jul 2025 19:42:10 +0000 https://earlybirdsinvest.com/us-house-sees-hiccups-as-free-caucus-objects-in-crypto-bills-procedure-slips/

It won Crypto Week on Tuesday, and it suddenly stopped digital asset bills invoices on a procedural vote as U.S. House members opposed the way they developed under Senate control.

The non-flammability in the procedural vote quickly denounced the crypto market as the House moved towards passing industry top priorities for uncertainty about this week’s good news. The legislation still has strong bipartisan support, with more votes scheduled for late Tuesday afternoon, suggesting that the procedural accident could be overcome. More than dozens of Republicans joined the Democrats and voted against the motion.

The two, who are well-versed in the issue, told Coindesk that they are aiming for an ET at 5pm. This means that this confusion can be resolved on Wednesday and Thursday without delaying more important votes than are currently expected.

US President Donald Trump urged Republicans to vote in favor of the rules early Tuesday in the post on True Society.

Bitcoin (BTC) and Ether (ETH) were each kneeling around 0.5% in the news, but both have recovered most of these declines. High-flying Stablecoin Issuer Circle (CRCL) moved to session decline by 5.3% that day. Since the IPO last month, stock has remained about six times higher.

Procedural disruptions can become the norm for legislative processes. As the genius act headed for passage in the Senate, Democrats denounced the break, opposed certain provisions and forced more debate. It is unclear whether similar delays could be forced by unfortunate Republicans in this week’s bill.

]]>
https://earlybirdsinvest.com/us-house-sees-hiccups-as-free-caucus-objects-in-crypto-bills-procedure-slips/feed/ 0 47823
Hacker Slips Malicious Code Into Ethereum Dev Tool ETHcode https://earlybirdsinvest.com/hacker-slips-malicious-code-into-ethereum-dev-tool-ethcode/ https://earlybirdsinvest.com/hacker-slips-malicious-code-into-ethereum-dev-tool-ethcode/#respond Fri, 11 Jul 2025 17:06:14 +0000 https://earlybirdsinvest.com/hacker-slips-malicious-code-into-ethereum-dev-tool-ethcode/

Cybersecurity researchers at ReversingLabs recently found that a hacker injected harmful code into ETHcode, a toolset for Ethereum
ETH


$2,962.49

developers.

ETHcode is a VS Code extension that helps developers build and test Ethereum-compatible smart contracts and apps.

The suspicious code was added on June 17 by a GitHub user named Airez299, who had no earlier contributions to the project.

What is Staking Crypto? (Rewards & Risks Explained SIMPLY)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

The update included 43 separate changes and about 4,000 edited lines, which mainly described a new testing system and additional features. Inside this large batch, two lines of malicious code were hidden.

The update was reviewed by GitHub’s automated AI tool and also checked by 7finney, the team that manages ETHcode. Neither spotted the problem, and only small edits were requested before approval.

According to ReversingLabs, the harmful code was disguised in a way that made it hard to notice. The first line was placed in a file with a name almost identical to an existing one and written in a scrambled style to make it harder to read.

The second line was designed to activate the first. When triggered, it launched a PowerShell script that downloaded and ran a batch file from a public file-sharing site.

ReversingLabs noted that it was likely designed to steal cryptocurrency stored on the victim’s computer or interfere with Ethereum projects being developed using the tool.

Recently, Sentinel Labs discovered a hacking campaign linked to groups in North Korea that uses malware called NimDoor. How does the malware work? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.


]]>
https://earlybirdsinvest.com/hacker-slips-malicious-code-into-ethereum-dev-tool-ethcode/feed/ 0 47061
Bank Insider Reportedly Forges Names and Fills Out Fake Withdrawal Slips, Drains $75,000 From Accounts of Eight Customers https://earlybirdsinvest.com/bank-insider-reportedly-forges-names-and-fills-out-fake-withdrawal-slips-drains-75000-from-accounts-of-eight-customers/ https://earlybirdsinvest.com/bank-insider-reportedly-forges-names-and-fills-out-fake-withdrawal-slips-drains-75000-from-accounts-of-eight-customers/#respond Sun, 06 Jul 2025 02:50:47 +0000 https://earlybirdsinvest.com/bank-insider-reportedly-forges-names-and-fills-out-fake-withdrawal-slips-drains-75000-from-accounts-of-eight-customers/

A Cleveland bank teller has reportedly been accused of forging names and other documents to drain tens of thousands of dollars out of customers’ bank accounts.

According to a new report by a local news outlet, federal prosecutors say that Denice James, a teller at First Federal Savings of Lorain, allegedly stole approximately $75,000 from eight different victims by faking documents and embezzled $1,000 from the bank itself.

The report says that James stole the money between July 25, 2023, and November 2, 2023, by forging customers’ names on bank slips and submitting them right before the bank closed, as no customers were inside. She would then process the withdrawals and take the cash for herself.

She has been charged with eight counts of bank fraud, eight counts of aggravated identity theft, and one count of embezzlement, to which she has pleaded not guilty.

This incident is the latest in a string of fraud schemes involving bank tellers. In May, a bank teller in Maryland pleaded guilty to stealing $255,000 from his employer’s elderly clients by having conspirators impersonate victims to make fraudulent bank withdrawals.

In March, a bank teller from New York, whose job it was to tally up money at the end of the day, was accused of stealing $1,000,000 in cash from his bank’s vault by forging signatures.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

]]>
https://earlybirdsinvest.com/bank-insider-reportedly-forges-names-and-fills-out-fake-withdrawal-slips-drains-75000-from-accounts-of-eight-customers/feed/ 0 46022
NimDoor Malware Slips into Macs via Fake Video Meetings https://earlybirdsinvest.com/nimdoor-malware-slips-into-macs-via-fake-video-meetings/ https://earlybirdsinvest.com/nimdoor-malware-slips-into-macs-via-fake-video-meetings/#respond Sat, 05 Jul 2025 04:13:46 +0000 https://earlybirdsinvest.com/nimdoor-malware-slips-into-macs-via-fake-video-meetings/

Sentinel Labs has discovered a hacking campaign that uses fake video meetings and disguised software updates to plant malware on Apple computers.

The attacks, linked to groups in North Korea, focus on stealing information from cryptocurrency companies by exploiting trust and targeting macOS users.

The scheme began when a hacker reached out through messaging apps like Telegram as a trusted contact. Then, they suggested a quick video call and sent a Google Meet link, followed by what appears to be a Zoom update file. When opened, the file installs a malware called “NimDoor” on the victim’s Mac.

Proof of Work vs Proof of Stake: Which is Better? (ANIMATED)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

Once installed, NimDoor searches for cryptocurrency wallet keys, saved browser passwords, and other private data. It also runs a script that collects Telegram’s encrypted local database and the keys needed to unlock it.

The malware waits about ten minutes before starting its activity to avoid immediate detection.

The malware was written in Nim, a programming language rarely used in macOS attacks. Nim allows the same malicious code to run on Mac, Windows, and Linux, which means hackers do not need separate versions for each system. It also produces lightweight files that launch fast and leave fewer traces.

Researchers noted that while the social-engineering tactic is familiar, using Nim binaries on macOS is unusual and harder for security tools to recognize.

Recently, Kaspersky researchers Sergey Puzan and Dmitry Kalinin found a new type of malware called SparkKitty. How does the malware work? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.


]]>
https://earlybirdsinvest.com/nimdoor-malware-slips-into-macs-via-fake-video-meetings/feed/ 0 45842
Bitcoin Price Slips Below $100K, Hinting Oil-Led Risk-Off on Wall Street https://earlybirdsinvest.com/bitcoin-price-slips-below-100k-hinting-oil-led-risk-off-on-wall-street/ https://earlybirdsinvest.com/bitcoin-price-slips-below-100k-hinting-oil-led-risk-off-on-wall-street/#respond Sun, 22 Jun 2025 15:58:58 +0000 https://earlybirdsinvest.com/bitcoin-price-slips-below-100k-hinting-oil-led-risk-off-on-wall-street/

Bitcoin

fell below $100,000 on Sunday, its lowest point since May, signalling risk aversion on Wall Street on Monday amid reports that Iran is leaning towards blocking the Strait of Hormuz.

The Strait, located between Oman and Iran, connects the Persian Gulf with the Gulf of Oman and the Arabian Sea, handling roughly 20% of the global oil trade.

Reports of Iranian politicians mulling the closure of the Strait had observers worried about a significant spike in oil prices early Monday.

“After US strikes on Iran last night, 50+ large oil tankers were scrambling to leave the Strait of Hormuz. Markets have been closed, but an immediate drop in supply is expected to send prices higher. JP Morgan described this as their worst-case scenario in the Israel-Iran war,” The Kobeissi Letter said on X.

According to JPMorgan, oil could surge to $120-$130 per barrel in that scenario. That could potentially lift the U.S. inflation rate to 5%, the highest since March 2023. At the time, the Federal Reserve was raising interest rates.

The losses in BTC weighed heavily over the broader crypto market, as usual, dragging major altcoins such as XRP, SOL, and ETH lower. The payments-focused XRP slipped 6% to $1.935, the lowest since April 10. Ethereum’s ether token slipped to levels seen in early May, according to CoinDesk data.

]]>
https://earlybirdsinvest.com/bitcoin-price-slips-below-100k-hinting-oil-led-risk-off-on-wall-street/feed/ 0 43492
Ethereum Price Slips Below $2,500 — Sell Volume Suggests Mounting Bearish Pressure https://earlybirdsinvest.com/ethereum-price-slips-below-2500-sell-volume-suggests-mounting-bearish-pressure/ https://earlybirdsinvest.com/ethereum-price-slips-below-2500-sell-volume-suggests-mounting-bearish-pressure/#respond Sat, 21 Jun 2025 21:49:25 +0000 https://earlybirdsinvest.com/ethereum-price-slips-below-2500-sell-volume-suggests-mounting-bearish-pressure/

Trusted Editorial content, reviewed by leading industry experts and seasoned editors. Ad Disclosure

The Ethereum price struggled to break out of the $2,500 – $2,700 range over the past week, mirroring the sluggish condition of the general market. On Friday, June 20, the altcoin succumbed to a fresh wave of bearish pressure, falling toward the $2,400 mark to close the week.

Unsurprisingly, this latest downturn appears to be forcing the hands of investors who have been banking on the $2,500 support level over the past few weeks. Here’s how the falling ETH price and the resulting sell-off could affect the altcoin’s future trajectory.

ETH Price At Risk As Taker Sellers Unload Their Tokens 

In a recent post on the social media platform X, on-chain analyst Maartunn revealed that a set of Ethereum traders might be on the move again. This on-chain observation revolves around a jump in the Taker Sell Volume, a metric that estimates the total volume of sell orders filled by takers in perpetual swaps of a specific cryptocurrency (ETH, in this case).

To provide some context, a taker refers to a market participant who places an order matched with an existing order on the order book. With this definition, the Taker Sell Volume represents the total amount of a cryptocurrency offloaded or sold by these market participants within a specific period.

In the post on X, Maartunn highlighted in his post that sell pressure is mounting in the Ethereum market, as taker sellers are beginning to dominate the buyers on exchanges. According to data from CryptoQuant, the ETH Taker Sell Volume on all centralized exchanges surged to around $321.3 million within a minute on Friday.

Ethereum

Source: @JA_Maartun on X

Typically, significant spikes in the Taker Sell Volume have often been followed by a period of downward pressure on the price of Ethereum. If history is anything to go by, investors might expect the second-largest cryptocurrency to struggle over the next few days.

Ethereum Price Overview

As of this writing, the price of ETH sits just above the $2,410 level, reflecting an almost 5% decline in the past 24 hours. According to data from CoinGecko, the altcoin is down by nearly 6% over the last seven days.

The Ethereum price has been stuck in consolidation within the $2,500 – $2,800 range over the past few weeks. With the token’s price now beneath a major support in $2,500 and the rising bearish pressure, the odds of ETH embarking on a sustained rally look slimmer.

Ethereum

The price of ETH on the daily timeframe | Source: ETHUSDT chart on TradingView

Featured image from iStock, chart from TradingView

Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.

]]>
https://earlybirdsinvest.com/ethereum-price-slips-below-2500-sell-volume-suggests-mounting-bearish-pressure/feed/ 0 43360
SOL Slips Below $144 Even as Sol Strategies Eyes Nasdaq to Deepen Its Bet https://earlybirdsinvest.com/sol-slips-below-144-even-as-sol-strategies-eyes-nasdaq-to-deepen-its-bet/ https://earlybirdsinvest.com/sol-slips-below-144-even-as-sol-strategies-eyes-nasdaq-to-deepen-its-bet/#respond Fri, 20 Jun 2025 02:49:35 +0000 https://earlybirdsinvest.com/sol-slips-below-144-even-as-sol-strategies-eyes-nasdaq-to-deepen-its-bet/

Solana’s native token, SOL

, dropped to $143.38 Tuesday, down 1.21%, closing near the day’s low after failing to hold above $147, according to CoinDesk Research’s technical analysis model.

The weakness came even as the ecosystem drew fresh institutional backing: Canadian blockchain investor Sol Strategies filed with the U.S. Securities and Exchange Commission on June 18 to pursue a Nasdaq listing under the ticker STKE.

While the filing itself is not an immediate market mover, it highlights a growing institutional commitment to Solana’s long-term outlook. Sol Strategies disclosed earlier this month that it holds more than 420,000 SOL, worth over $61 million, and has made SOL the centerpiece of its treasury strategy. The firm is also seeking regulatory approval in Canada to raise up to $1 billion, in addition to an earlier $500 million convertible note issuance in April used to acquire and stake SOL.

Despite these bullish signals, SOL continues to trade defensively. Price action has been confined to a horizontal band for much of the past week, with the most recent breakout attempt above $147.80 failing to generate follow-through. Bears regained control during the final hours of trading, pushing SOL below the $144 psychological support. With price trending below major moving averages and volume tapering off mid-session, sentiment remains fragile even as long-term backing intensifies.

Technical Analysis Highlights

  • SOL traded in a 24-hour range from $143.23 to $147.80, a 2.83% swing.
  • Resistance held at $147.80 after a failed breakout during the 22:00 UTC candle on June 18.
  • Price declined steadily to $143.38, closing near the low after weak recovery attempts.
  • Sellers were active between 13:46–14:00 UTC, with a drop from $144.62 to $143.38 on strong downside momentum.
  • The $144–$145 zone remains critical; failure to reclaim it may open a path toward deeper support near $140.

Disclaimer: Parts of this article were generated with the assistance from AI tools and reviewed by our editorial team to ensure accuracy and adherence to our standards. For more information, see CoinDesk’s full AI Policy.

]]>
https://earlybirdsinvest.com/sol-slips-below-144-even-as-sol-strategies-eyes-nasdaq-to-deepen-its-bet/feed/ 0 43034
North Korean dev hijacks dormant Waves repositories, slips credential-stealing code in wallet updates https://earlybirdsinvest.com/north-korean-dev-hijacks-dormant-waves-repositories-slips-credential-stealing-code-in-wallet-updates/ https://earlybirdsinvest.com/north-korean-dev-hijacks-dormant-waves-repositories-slips-credential-stealing-code-in-wallet-updates/#respond Thu, 19 Jun 2025 00:41:00 +0000 https://earlybirdsinvest.com/north-korean-dev-hijacks-dormant-waves-repositories-slips-credential-stealing-code-in-wallet-updates/

A North Korean developer gained elevated privileges inside Waves Protocol’s Keeper-Wallet codebase, according to a June 18 report by Ketman.

The report highlighted routine scans for Democratic People’s Republic of Korea (DPRK) activity on GitHub, which uncovered the account “AhegaoXXX” pushing updates to Keeper-Wallet. 

The wallet’s repositories showed no legitimate commits after August 2023, yet they received multiple dependency bumps beginning in May 2025. 

Repository analytics indicated that the user can open branches, create releases, and publish to the Node Package Manager (NPM) registry, giving the operator complete control over the organization.

The report then linked “AhegaoXXX” to contracting rings of DPRK IT workers, which had previously used freelance channels to infiltrate software projects.

The account’s reach extended beyond simple maintenance. Redirect rules inside the main Waves Protocol namespace now point to identical packages inside the newly active Keeper-Wallet namespace, suggesting an insider moved code from the core organization to the wallet project.

Suspicious code changes

The report also mentioned one commit inside “Keeper-Wallet/Keeper-Wallet-Extension” that adds a function exporting wallet logs and runtime errors to an external database. 

The modified routine captures mnemonic phrases and private keys before transmission, raising the likelihood of credential exfiltration. The branch remains unmerged, but its presence indicates an intent to include the code in a production release.

The NPM registry records reflect related activity. Versions of “@waves/provider-keeper,” “@waves/waves-transactions,” and four other packages suddenly advanced after two years of dormancy. 

Each publication lists “msmolyakov-waves” as a maintainer. GitHub history shows that the account belonged to former Waves engineer Maxim Smolyakov and exhibited no activity since 2023 until it approved a pull request from “AhegaoXXX” and triggered a new NPM release in under four minutes. 

The report assessed that the engineer’s credentials now fall under DPRK control, providing the attacker with a second trusted path to distribute malicious builds.

Supply-chain exposure and countermeasures

The shift from isolated freelancing to direct repository control marks what the report called an “unusual cross-over” between ordinary DPRK contract work and an overt hacking campaign.

Download counts for affected packages remain low, but any Waves user who installs or updates Keeper-Wallet risks importing code that forwards secret phrases to a hostile server.

The publication advised development teams to tighten supply-chain defenses, including audit contributor privileges, removing inactive members from GitHub organizations, tracking who can trigger package releases, and monitoring repository redirects across ecosystems such as npm and Docker. 

Lastly, the firm encouraged regular reviews of publisher e-mail domains to detect dormant accounts that could approve rogue updates.

]]>
https://earlybirdsinvest.com/north-korean-dev-hijacks-dormant-waves-repositories-slips-credential-stealing-code-in-wallet-updates/feed/ 0 42823