Author: rb809rb

Counterfeit wallet apps are not a new threat, but Operation ASTERIX shows how much more precise these schemes have become. Rapid7 uncovered a campaign built around roughly 885,000 phone numbers, crypto account-validation tools, phishing emails, vishing calls, and fake Trezor, Ledger, and Exodus apps designed to capture recovery phrases, according to the original report.

The most striking detail is not the volume of phone numbers. It is the validation layer. In one German dataset, operators identified 43,066 CryptoCom accounts from 316,002 phone numbers. That is a hit rate high enough to justify the infrastructure. After confirming which numbers were tied to exchange accounts, the group enriched those targets with personal details, making support impersonation calls much harder to detect. A public list of phone numbers is a nuisance; a list that has been cross-checked against exchange account data is an operational asset.

AI tools compressed the production cycle

Rapid7 found signs that the operators used GitHub Copilot and Claude Code across multiple stages of the campaign. Those tools were applied to process target data, develop and debug malicious software, and build phishing infrastructure. That matters because it shrinks the distance between target discovery and an active fake wallet app or phone scam. Tasks that once required a dedicated developer can now be handled by smaller crews using AI coding assistants.

The sector’s broader AI adoption is not limited to hostile actors. Rankings of Top 10 Blockchains by Developer Activity This Week track code contributions across major chains, and those workflows increasingly include AI-assisted development. The same productivity gains that help legitimate teams ship faster also make malicious wallet apps easier to produce, which is precisely the dual-use problem Operation ASTERIX exposes. AI tooling now runs through legitimate Web3 infrastructure too, including scalable AI-driven Web3 applications.

The jailbreak question remains open

One interaction stands out. When Claude refused requests related to code obfuscation, the operator switched to Kimi and attempted to bypass its safety controls with a custom jailbreak prompt. Rapid7 could not confirm whether the attempt succeeded. That uncertainty is relevant because it separates a simple misuse of general-purpose tools from a more deliberate effort to defeat model restrictions. The former is a moderation gap; the latter is a red-team exercise run by criminals.

Without confirmation, the report avoids overstating the jailbreak result. It does, however, confirm that the campaign treated AI model refusals as an obstacle to route around rather than a reason to stop. Security researchers and platform providers will likely scrutinize that behavior when deciding how aggressively to restrict coding assistance around wallet-related software.

What users and platforms should watch

The counterfeit apps named in the report target the same recovery phrase users are told never to enter anywhere. Fake Trezor, Ledger, and Exodus apps create a direct path from a convincing interface to a drained wallet. That is why download source matters more than app appearance. Official hardware wallet vendors do not ask users to enter recovery phrases into software, and exchange support lines do not call customers with a full personal profile already loaded.

The operation also sharpens a hard truth for exchanges. If account validation is cheap enough to run against hundreds of thousands of numbers, then user data leaks and public breach corpora become a higher-value input for vishing campaigns. The report does not allege an exchange breach; it shows how seemingly thin data can be enriched into actionable targeting information.

Lawmakers weighing crypto market structure rules may find this kind of disclosure hard to ignore. Banking groups have already been pressing against the biggest crypto bill in US history, and cybercrime incidents involving retail wallets could sharpen the debate over liability, consumer protection, and platform responsibility. Whether Operation ASTERIX becomes a regulatory data point depends on how quickly similar campaigns are detected elsewhere.

Circle has expanded Circle Mint to support direct local-currency $USDC on- and off-ramps across eight currencies. The company said in an Aug. 18 post that foreign exchange is handled inside Mint, removing the need for a separate conversion step or pre-funding additional accounts.

Alongside USD and EUR, Circle listed the Brazilian real, British pound, Hong Kong dollar, Mexican peso, offshore Chinese yuan and Singapore dollar among the local currencies supported for eligible Mint account holders.

How the proposed flow works

Circle says customers can activate cross-currency exchange, link a bank account for the local-currency side and register that account for the currency they intend to trade. The company describes each transaction as a quote, trade and settlement process, with $USDC arriving in the Mint balance after conversion.

Circle says settlement uses local payment rails nearly around the clock where supported. Availability remains subject to jurisdiction and account eligibility, and the company notes that some account-registration steps are handled offline.

Not a retail bank account

The update is directed at businesses and eligible Mint customers, including payment providers, financial institutions and fintechs. Circle states that Circle Mint is not a bank account and that funds are not protected by FDIC, SIPC or comparable government insurance.

The announcement is a Circle product update. It does not mean all currencies, regions or users have identical access, so institutions need to check Mint eligibility and local requirements before relying on the new routes.

Centrifuge [$CFG] declined more than 14% in the past 24 hours at press time, extending the double-digit decline in market cap over the past week. The daily trading volume increased, supporting the selling pressure experienced across multiple altcoins.

However, the sharper decline in $CFG points to a coin-specific weakness with its real-world asset (RWA) niche.

Centrifuge’s RWA sees negative sentiment

As per data from Token Terminal, Centrifuge’s RWA activity declined on multiple fronts.

For instance, the Monthly Asset Transfer Volume on the chain fell by 10%. This week alone, the metric has decreased from a peak of $11.67 million to $281K, indicating very low usage of the ecosystem in the RWA sector.

Additionally, the Monthly Asset Transfer Count lost more than 58% of its share. Since the start of August, this count has plummeted from 6.7K to 2.2K, representing a 67% loss.

Apart from its RWA niche’s underperformance, $CFG faced a broader, weaker altcoin market. To be specific, the Centrifuge ecosystem saw net USD outflows of more than $2.25 million.

Moreover, the Total Value Locked (TVL) was flat at around $1.709 billion after a sharp drop from its highs attained when the RWA narrative was thriving. The TVL of $CFG in April was above the $2 billion mark.

Furthermore, the activity on the chain was low, evident from the fees generated. As per DefiLlama, the ecosystem generated about $200.9K in the past 24 hours as of writing.

Will $CFG price crash lower?

Even the market structure of $CFG was bearish since mid-July.

The altcoin was falling inside a wedge pattern and broke below the lower trendline support. Over the past 24 hours, the $CFG price has fallen from $0.1672 to $0.1379 as of writing.

Momentum indicators reinforced the bearish control with the reading of Bull Bear Power (BBP) bars at -0.0243. Moreover, Chaikin Money Flow (CMF) crashed to -0.22, indicating capital flight.

Looking at the market structure and overall RWA sentiment, $CFG may continue dipping. It could even lose its all-time low (ATL) at $0.06712.

However, the altcoin is closer to $0.1257, which is the demand zone that pushed it to a peak value of $0.3497. This level could be the start of a recovery if bulls return.

---

Final Summary

• Centrifuge fell by more than 14% in the past 24 hours as multiple fronts affected its RWA niche.
• $CFG price has been falling inside a wedge pattern, with indicators suggesting it could be just the beginning.

Strategy [MSTR] shares jumped more than 12% on Wednesday as Bitcoin’s sudden recovery spilled into crypto-linked stocks.

The price of the stock was around $103.76 after it briefly got to the $106.90 level, as Bitcoin gained a more modest 5.59%.

For Strategy shareholders, though, the strong session comes after months of pain due to the price fall. The stock traded near $190 in May and recently fell towards $90, and Michael Saylor is still telling investors not to expect an easy ride from here.

Bitcoin puts MSTR back above $100

MSTR started Wednesday at $94.54. By the end of trading, it had gained 12.15%, with 33.85 million shares changing hands.

The Bitcoin price rise provided the backdrop for the stock price move, with $BTC moving from below $65,000 to nearly $70,000 before dropping to around $68,297.

That price move tends to matter more for Strategy than for other companies because of its relationship with $BTC.

Strategy owns 840,447 $BTC, so MSTR has become a way for stock-market investors to gain exposure to Bitcoin without buying it directly. The relationship can exaggerate moves in both directions.

Wednesday showed the upside of that relationship, while the past few months showed the other side.

But even after the rally that it saw today, MSTR still remains well below its May levels.

Saylor tells investors to prepare for difficult years

Meanwhile, Saylor has offered shareholders a much longer timeline.

In response to concerns about Strategy’s falling share price and continued issuance of MSTR stock, he warned that investors should be prepared for potentially “difficult years.” He suggested common shareholders may need to think over a period as long as ten years.

In the last few weeks, there have been changes to Strategy’s Bitcoin holdings, with the company selling 1,690 $BTC for $108.6 million between August 3 and 9, using the money to repurchase STRC preferred shares.

It separately raised $653.1 million from MSTR share sales and increased its dollar reserve to $4.65 billion.

With Wednesday’s Bitcoin price, the remaining $BTC that Strategy holds were worth roughly $57.4 billion, and so far the company has spent $63.36 billion to purchase $BTC.

MSTR may have returned above $100, but both the decline $BTC witnessed earlier and Strategy’s increasingly complex financing structure continue to weigh on the investment case.

---

Final Summary

• MSTR gained 12.15% as Bitcoin’s rise towards $70,000 helped crypto-linked stocks to move higher.
• Saylor is asking shareholders to take a long view as Strategy sells shares and occasionally Bitcoin to raise capital.

---

The issue matters because Luke Dashjr and other BIP-110 supporters are discussing a hard fork that would replace the minority chain’s SHA-256d mining algorithm with BLAKE2b. Such a move would permanently create a whole new design, but the two networks would still share their transaction history from before the split.

What Exactly Is a Replay Attack?

Imagine someone holds 1 bitcoin before a hard fork. When the blockchain divides, the same historical unspent transaction output, or UTXO, exists on both networks. In practical terms, the owner controls corresponding coins on each chain with the same private key.

Trouble begins if both networks also recognize the same transaction and signature rules. Suppose the owner sends the coin to an exchange on Chain A. If that signed transaction is also valid on Chain B, another party can copy it and broadcast it there. Chain B may accept the transaction because, cryptographically, nothing distinguishes the authorization from one intended for its network.

That is a replay. Nobody steals the private key or breaks Bitcoin’s cryptography. The problem is simpler: the user created one valid authorization, but two blockchains recognize it. And while the BIP-110 chain sits at block height 961636, people spending BTC are moving BIP-110 coins, or whatever they will be called going forward, at the same time, without even knowing.

“The overwhelming majority of these [BIP-110 minority chain] blocks are just replaying days-old transactions from the main chain,” Mempool.space developer Mononaut wrote on X. This replay protection or replay attack subject has caused a viral conversation on X over the last few days.

Replay Protection Builds a Wall Between the Chains

Replay protection prevents that crossover by making transactions on the competing networks distinguishable. One method changes the signature hash, commonly called sighash, so a transaction signed for one chain fails the consensus rules of the other.

Mandatory protection makes this distinction part of the fork itself. Opt-in protection leaves ordinary transactions potentially compatible with both chains and requires users to deliberately use a chain-specific mechanism when they want to separate their coins.

That distinction has become important for BIP-110. The emerging plan does not appear to provide automatic, comprehensive two-way replay protection. Instead, at least according to Discord discussions, Bitcoin Knots is implementing a new sighash option that can create a transaction valid on the RDTS chain but invalid under Bitcoin Core.

Dashjr Says Protection Is the Other Chain’s Problem

Dashjr has taken an unusual position on which network should bear responsibility. Asked Aug. 18 about replay protection for the proposed hard fork, he said, “Replay protection was Spamcoin’s responsibility since it’s the airdrop altcoin.”

He added that there would be ways to separate transactions but argued that “legitimate Bitcoin transactions need to remain valid on Bitcoin.” His reasoning rests on his assertion that the BIP-110/RDTS minority network is Bitcoin, while the overwhelmingly dominant SHA-256d Bitcoin blockchain is the breakaway network.

Dashjr has repeatedly used derogatory names for the dominant Bitcoin chain, including “Spamcoin” and “Bpedo,” a reference incorporating “pedo.” He has characterized that network as the altcoin while continuing to describe the BIP-110 branch as the legitimate Bitcoin.

The Network Numbers Tell a Very Different Story

That characterization collides with observable network activity. BIP-110 miner signaling peaked at roughly 2.53%, and when its consensus rules took effect Aug. 8, its minority branch produced only two immediate blocks before stalling. Bitcoin’s dominant chain continued operating while the gap widened by hundreds of blocks. A few other BIP-110 blocks have been mined at an extremely slow rate.

The majority network retained essentially all meaningful Bitcoin hashrate, the longest chain, weight of work, liquidity, and economic recognition. The BIP-110 proposal was subsequently marked closed, while supporters moved toward plans for a BLAKE2b proof-of-work (PoW) change intended to revive the minority network.

Moreover, the Bitcoin community is frustrated with Dashjr’s repeated claims and the intended opt-in styled replay protection being discussed is a bone of contention. “Lol. Luke isn’t gonna launch his sh**coin with replay protection, is he? I guess it won’t be listed on exchanges then,” one X user wrote on Wednesday.

Another X user argued:

“This has crossed the line from nonsense into bad-actor behavior. Spreading false information like this can cause real financial harm to Bitcoiners.”

Opt-In Protection Leaves Responsibility With Users

Under the approach now being discussed on the Bitcoin Knots Discord channel, ordinary transactions may remain replayable because RDTS intends to maintain compatibility with Bitcoin Core’s existing sighash types. Users wanting RDTS-specific protection would need to use the new sighash, requiring supporting wallet software or hardware-signing firmware.

Users can also attempt to split their coins manually. A Bitcoin transaction containing data that RDTS rejects could create an output existing only on the dominant chain. Conversely, the proposed RDTS-specific sighash could produce a transaction that RDTS accepts, but Bitcoin Core rejects.

The result looks far more like opt-in replay protection than the automatic firewall users expect from a contentious hard fork. That leaves wallets, exchanges, and holders responsible for knowing exactly which transactions can bleed across chains. The decision is strange, especially for a new chain and crypto asset with zero exchange support. Infrastructure providers, particularly crypto exchanges, are unlikely to touch a chain that chooses opt-in protection over a universal replay barrier.

If the BLAKE2b fork proceeds around Sept. 1, replay protection will therefore be more than an obscure technical detail. It will become a practical test of whether users can safely separate assets inherited from the same Bitcoin history, even as Dashjr continues making the far larger claim that the network carrying virtually all of Bitcoin’s hashrate, liquidity and economic activity is somehow the altcoin.