The source code for version 3 of the ERMAC Android banking trojan has been leaked online, exposing the internals of the malware-as-a-service platform and the operator’s infrastructure.

The code base was discovered in an open directory by Hunt.io researchers while scanning for exposed resources in March 2024.

They located an archive named Ermac 3.0.zip, which contained the malware’s code, including backend, frontend (panel), exfiltration server, deployment configurations, and the trojan’s builder and obfuscator.

The researchers analyzed the code, finding that it significantly expanded the targeting capabilities compared to previous versions, with more than 700 banking, shopping, and cryptocurrency apps.

ERMAC was first documented in September 2021  by ThreatFabric – a provider of online payment fraud solutions and intelligence for the financial services sector, as an evolution of the Cerberus banking trojan operated by a threat actor known as ‘BlackRock.’

ERMAC v2.0 was spotted by ESET in May 2022, rented to cybercriminals for a monthly fee of $5,000, and targeting 467 apps, up from 378 in the previous version.

In January 2023, ThreatFabric observed BlackRock promoting a new Android malware tool named Hook, which appeared to be an evolution of ERMAC.

ERMAC v3.0 capabilities

Hunt.io found and analyzed ERMAC’s PHP command-and-control (C2) backend, React front-end panel, Go-based exfiltration server, Kotlin backdoor, and the builder panel for generating custom trojanized APKs.

According to the researchers, ERMAC v3.0 now targets sensitive user information in more than 700 apps.

Additionally, the latest version expands on previously documented form-injection techniques, uses AES-CBC for encrypted communications, features an overhauled operator panel, and enhances data theft and device control.

Specifically, Hunt.io has documented the following capabilities for the latest ERMAC release:

• Theft of SMS, contacts, and registered accounts
• Extraction of Gmail subjects and messages
• File access via ‘list’ and ‘download’ commands
• SMS sending and call forwarding for communication abuse
• Photo capturing via the front camera
• Full app management (launch, uninstall, clear cache)
• Displaying fake push notifications for deception
• Uninstalls remotely (killme) for evasion

Infrastructure exposed

Hunt.io analysts used SQL queries to identify live, exposed infrastructure currently used by the threat actors, identifying C2 endpoints, panels, exfiltration servers, and builder deployments.

Apart from exposing the malware’s source code, the ERMAC operators had several other major opsec failures, including hardcoded JWT tokens, default root credentials, and no registration protections on the admin panel, allowing anyone to access, manipulate, or disrupt ERMAC panels.

Finally, the panel names, headers, package names, and various other operational fingerprints left little doubt about attribution and made discovery and mapping of the infrastructure a lot easier.

The ERMAC V3.0 source code leak weakens the malware operation, first by eroding customer trust in the MaaS in its ability to protect information from law enforcement or allow running campaigns with low detection risk.

Threat detection solutions are also likely to get better at spotting ERMAC. However, if the source code falls into the hands of other threat actors, it is possible to observe in the future modified variants of ERMAC that are more difficult to detect.

Saucerswap Sauce Crypto jumped 70% in July 2025, defeating the key resistance for $0.43 in the Nvidia-Hedera deal. Defi TVL’s rise and buyback programme is driving demand.

Saucerswap, Hedera’s distributed exchange (DEX), topped the charts after surges by 30% over the weekend and riding high waves on daily charts.

As a source of governance tokens, Defillama data shows that total resistance in the locked (TVL) has risen at about $0.43, which is why it is so high.

By July 14, 2025, Saucerswap’s assets under management had reached nearly $70 million, further increasing its 2025 revenue.

(Source: Defilama’s Saucerswap TVL))

Source Cryptography will increase by 70% in July 2025

On the daily charts, Source (no data) Crypto is in a bullish breakout formation, and prices could continue to rise.

The recent surge has shown strong traders’ interest, accompanied by an increase in trading volume.

In July 2025 alone, sources were on the upward trend, increasing by more than 65% as buyers intervened, pushing tokens beyond their second quarter 2025 high.

The next viable target for optimistic traders is about $0.165, a 2024 high.

However, in order to retest this level, Saucerswap must control Dex’s trading; The best cipher to buyYou need to extend your profits and clear major resistance levels, including Solana and Ethereum.

Discovery: Next 1000x Ciphers: 10+ Ciphers tokens that could hit 1000X in 2025

Saucerswap tvl Rising

In the short to medium term, Saucerswap was able to see more inflows, further increasing revenue and fees. As of July 14, 2025, Defi TVL totaled over $127 million.

Most defi activity occurs in Ethereum, but Hedera lists profits. All Defi protocols on the platform manage nearly $120 million. This has been rising sharply since early July when TVL totaled just $73 million.

While Stader, a liquid staking platform, is the largest on TVL, Saucerswap controls Dex trading on Hedera.

(Source: Defilama))

Last month alone, Saucerswap Total TVL has risen by nearly 50%, reflecting a surge in token prices over the same period.

In line with rapid expansion above major resistance levels over the past two days, Saucerswap’s Dex volume has skyrocketed by nearly 300% of Hedera’s daily average volume.

Source Buyback Program

While increasing Defi activity in Hedera could drive demand, Dex is actively purchasing tokens from the secondary market.

In December 2024, Saucerswap Labs announced that it had purchased 122,045 sauces using a portion of its swap fee and HBAR staking rewards.

Saucerswap is the best Dex in Hedera. Today they bought back 122,045 $Source For Xsauce holders who earned 7.16%! Reply within the next 15 hours and correctly guess the total source of tomorrow’s buyback. I’ll send you 10,000 $Source. Follow to qualify. pic.twitter.com/2f521ntfe3

-sauceman_hts (@sauceman_hts) December 14, 2024

These tokens were distributed to source stakers in the Infinity Pool.

They bought more sauces in April 2025.

$Source Buy back

Another day, another big buyback

18,914 $Source I scooped it up

saucerswap is a daily purchase and send using HBAR rewards and exchange fees. $Source In the infinity pool $Source Staking

Supply is shrinking

Demand is rising

The rockets are fueled. Don’t miss it… pic.twitter.com/hipxhyqpey

– $Source The Defi Alien (@thedefialien) April 7, 2025

Increased token purchases have encouraged more liquidity providers to put funds into the pool, further increasing swap fees.

By purchasing tokens from circulating supplies, Saucerswap reduced the supply directly and puts upward pressure on prices.

Hbar Rally and Nvidia-Hedera trade

A rise in HBAR prices could potentially raise demand prices and lift.

Last month, HBAR rose nearly 70%, up 24% over the last 24 hours, lifting Hedera-based tokens containing sources. At this rate, Hbar surpassed several Top Solanamime Coin.

Hedera Hashgraph

price

Market capitalization

24 hours7d30D1Yeverytime

The rally is driven by news that Nvidia, one of the world’s most valuable companies, has integrated Hedera technology into a Blackwell chipset.

https://www.youtube.com/watch?v=nqgm4gy4a0a

In this agreement, Hedera provides a platform for logging calculations for the invariance and timestamps of Nvidia’s verifiable computation solutions.

This integration could attract more institutions to explore Hedera, boost network activity and, as a result, increase the volume of saucer wap trading.

Discover: 8 High-Risk High-Reward Codes for 2025

Why you can trust 99 Bitcoin?

Over 10 years

Founded in 2013, 99 Bitcoin team members have been experts in crypto since the early days of Bitcoin.

90 hours+

Weekly research

100k+

Monthly Readers

50+

Expert Contributors

2000+

Crypto project reviewed

Follow 99 Bitcoin on Google News Feed

Provide the latest updates, trends and insights directly to your fingertips. Subscribe now!

Subscribe now

Journalist

Hassan Shittu

Journalist

Hassan Shittu

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in…

Share

Last updated: 

June 24, 2025

Turkey’s Ministry of Treasury and Finance is tightening regulations on crypto asset service providers in a bid to clamp down on illicit financial activities. According to the Ministry, digital asset platforms must now collect and verify more detailed information about user transactions.

This information includes obtaining a written explanation of at least 20 characters describing the purpose of each transfer, along with verifying the origin of funds involved.

Per AA, the government believes this measure will enhance transparency and help identify suspicious activity earlier in the transaction process.

Turkey Impose Withdrawal Restrictions to Disrupt Illicit Flows

In a major shift, the new regulation imposes a delay on crypto asset withdrawals. Any crypto purchased, exchanged, or deposited will be subject to a 48-hour waiting period before it can be withdrawn.

For new users making their first withdrawal, the waiting period will extend to a minimum of 72 hours. Authorities believe these delays will reduce the ability of criminal actors to quickly transfer illicit funds outside the system before they are detected or blocked.

Stablecoins are also under scrutiny in the new regulatory framework. The Ministry will impose a daily transfer cap of $3,000 and a monthly limit of $50,000 for these digital assets.

These restrictions are designed to prevent the rapid movement of large sums of money that may be connected to illegal betting, fraud, or other criminal proceeds.

However, platforms that fully comply with the travel rule, which requires collecting identifiable information about both sender and receiver will be allowed to operate with limits twice as high.

While the regulations are strict, the Ministry emphasized that they do not aim to stifle legitimate activities within the crypto space. Treasury and Finance Minister Mehmet Şimşek stated that transactions linked to market making, liquidity provision, and arbitrage will be permitted without restriction.

Notably, the Ministry issued a clear warning to platforms that fail to comply with the new rules. Sanctions may include administrative penalties, financial fines, or even the denial or cancellation of operational licenses.

Turkey Continues to Tighten Crypto Legal Framework

The latest enforcement actions build on Turkey’s broader regulatory overhaul published on March 13, 2025, through amendments to Capital Markets Law No. 6362. These changes placed crypto platforms under the oversight of the Capital Markets Board (CMB).

Two communiqués, III-35/B.1 and III-35/B.2 set out new rules for platform structure, capital requirements, internal audits, and customer protection. Platforms must be joint-stock companies with minimum capital and approved management.

Aside from this, they are also required to conduct proof-of-reserve audits, partner with CMB-approved custodians, and maintain separate accounts for user funds.

Additional rules govern asset listings, conflict of interest policies, risk disclosures, and dispute resolution processes to enhance user safety and platform transparency.

Prior to then, Turkey introduced tighter crypto rules in February 2025 to strengthen anti-money laundering (AML) compliance and align with global standards. Announced in the last week of 2024, the regulations require crypto service providers to collect user identification for transactions over 15,000 lira (about $425).

Modeled after the EU’s MiCA framework, the rules aim to curb money laundering and terror financing, as Turkey’s presence in global crypto markets continues to grow.

Crypto Reporter

Shalini Nagarajan

Crypto Reporter

Shalini Nagarajan

About Author

Shalini is a crypto reporter who provides in-depth reports on daily developments and regulatory shifts in the cryptocurrency sector.

Share

Last updated: 

June 1, 2025

Silk Road founder Ross Ulbricht received a donation of 300 Bitcoin, worth over $31m, to his official donation wallet on Sunday.

The transaction, flagged by blockchain analysts and tracked by platforms such as Lookonchain and Arkham Intelligence, has sparked a wave of speculation across the crypto community.

The funds appear to have passed through Jambler, a centralized Bitcoin mixing service, rather than more widely used decentralized privacy tools like Wasabi or Samourai.

Blockchain investigator ZachXBT noted that two dormant addresses, active as far back as 2014 and 2019, deposited large sums into Jambler between April and May. These deposits coincided with the transfer to Ulbricht’s wallet, casting doubt on theories that the donation was a self-transfer from hidden pre-arrest funds.

ZachXBT Links Ross Ulbricht Donation to Flagged Bitcoin Address

According to ZachXBT, the donation likely was not a self-transfer as some had speculated, though it appears to have originated from a “questionable source.”

The unusually large size of the gift, coupled with its obscure origin, has raised eyebrows.

One of the addresses linked to the transaction, 1CNDW, had previously been flagged in compliance tools, adding to the concerns.

Ulbricht Reflects on Prison and Freedom

Ulbricht walked free in Jan. 2025 after serving 12 years of a double life sentence. His release followed a controversial pardon issued by US President Donald Trump.

Since then, Ulbricht has re-entered public life, speaking at the Bitcoin 2025 conference in Nashville and auctioning personal memorabilia, including prison-era art and possessions.

The donation arrived shortly after Ulbricht’s auction concluded, which had raised over $1.3m in Bitcoin. However, despite the timing, the 300 BTC transfer was not connected to the sale. This disconnect has only deepened the mystery surrounding its origin.

The donation wallet, managed by the FreeRoss.org campaign, funds legal advocacy and public education around sentencing reform. While the money greatly supports these causes, its unclear path, especially through a centralized mixer, has cast a shadow over what might have been a celebratory moment.

Meanwhile, Ulbricht addressed a packed audience in Nashville. He reflected on the dramatic shift in his life, recalling moments when he thought he might die in that “awful cage.” Still, he said he fought to find joy, even in the darkest times.

The reference was included in a court filing by Olivia Chen, a data scientist at the company, as part of its defense against a lawsuit from major music publishers.

Universal Music Group, Concord, ABKCO, and others filed the suit in October 2023, claiming that Anthropic used song lyrics without permission to train its AI model, Claude. The list of artists whose work was allegedly used includes Beyoncé, The Rolling Stones, and The Beach Boys.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is NEO in Crypto? Chinese Ethereum Explained (ANIMATED)

Chen’s filing referred to a paper said to be published in The American Statistician. She said it helped show that Claude only repeats copyrighted lyrics in rare situations.

However, at a hearing in San Jose on May 13, the publishers’ lawyer, Matt Oppenheim, said the article was completely made up. He noted that he did not think Chen invented the source herself, but may have used Claude to generate it.

Anthropic’s legal representative, Sy Damle, responded that the issue seemed to be a mistake in referencing, not a made-up source. He also criticized the plaintiffs for bringing it up late in the process.

Judge Susan van Keulen pointed out that a simple mistake is very different from an AI-generated false source. The judge did not allow immediate questioning of Chen but ordered Anthropic to file a formal response by May 15.

On May 12, Jamie Lee Curtis, an American actress, criticized Meta and its CEO, Mark Zuckerberg. What happened? Read the full story.