{"id":96117,"date":"2026-04-12T17:47:03","date_gmt":"2026-04-12T14:47:03","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=96117"},"modified":"2026-04-12T17:51:44","modified_gmt":"2026-04-12T14:51:44","slug":"the-week-in-crypto-satoshis-identity-and-a-hunt-for-north-korean-hackers","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/the-week-in-crypto-satoshis-identity-and-a-hunt-for-north-korean-hackers\/","title":{"rendered":"The week in crypto: Satoshi\u2019s identity and a hunt for North Korean hackers"},"content":{"rendered":"<p>Bitcoin broke above $70,000, an NYT journalist published an investigation into Satoshi Nakamoto\u2019s identity, Anthropic\u2019s new AI model \u201cescaped\u201d from the lab, and other events of the week.\u00a0\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Cautious optimism<\/h2>\n<p>Over the past seven days bitcoin strengthened notably, albeit with bouts of volatility. Monday began with gains for the leading cryptocurrency \u2014 the asset <a href=\"https:\/\/forklog.com\/en\/news\/bitcoin-tests-70000-amid-iran-ceasefire-hopes\">rose<\/a> from $67,000 to the psychologically important $70,000 on news of a possible de-escalation in the Middle East.\u00a0<\/p>\n<p>Tuesday brought consolidation and a slight pullback. By Wednesday, digital gold resumed its rise.\u00a0<\/p>\n<p>In a sharp move, prices <a href=\"https:\/\/forklog.com\/en\/news\/bitcoin-surges-past-71000-amid-us-iran-ceasefire\">jumped<\/a> above $72,000 after reports of a two-week truce between the US and Iran.\u00a0<\/p>\n<p>The geopolitical tailwind lasted nearly to week\u2019s end, during which bitcoin tested $74,000.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-e43129b24f64d075-1605545140666117.webp\" alt=\"image\" class=\"wp-image-278344\"\/><figcaption class=\"wp-element-caption\">Hourly chart of BTC\/USDT on Binance. Source: <a href=\"https:\/\/www.tradingview.com\/symbols\/BTCUSDT\/\">TradingView<\/a>.<\/figcaption><\/figure>\n<p>Even so, Sunday headlines about failed talks between Washington and Tehran darkened the picture. Within an hour the leading cryptocurrency <a href=\"https:\/\/forklog.com\/en\/news\/expert-identifies-bitcoin-level-for-bullish-trend-confirmation\">fell<\/a> from $73,000 to $71,300.\u00a0<\/p>\n<p>At the time of writing, the asset trades around $71,500, up 6.5% over the past seven days.<\/p>\n<p>The broader crypto market followed the flagship. Ethereum even outpaced it, up 8% on the week.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-51f4771745d78236-1605545149019486.webp\" alt=\"image\" class=\"wp-image-278345\"\/><figcaption class=\"wp-element-caption\">Source: <a href=\"https:\/\/coinmarketcap.com\/\">CoinMarketCap<\/a>.<\/figcaption><\/figure>\n<p>XRP and SOL each added 4%. HYPE returned to the top ten assets by market capitalisation, gaining 12%.<\/p>\n<p>Inflows into bitcoin <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-cryptocurrency-etf\">ETF<\/a>s began to recover. Spot funds backed by the leading cryptocurrency <a href=\"https:\/\/sosovalue.com\/assets\/etf\/us-btc-spot\">attracted<\/a> $786m net, while Ethereum products drew <a href=\"https:\/\/sosovalue.com\/assets\/etf\/us-eth-spot\">$187m<\/a>.\u00a0<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-44462d8b3049b234-1605545139234236.webp\" alt=\"image\" class=\"wp-image-278343\"\/><figcaption class=\"wp-element-caption\">Source: SoSoValue.<\/figcaption><\/figure>\n<p>Total crypto market capitalisation stands at $2.5tn. BTC dominance is 57%, ETH \u2014 10.6%.<\/p>\n<p>The <a href=\"https:\/\/forklog.com\/en\/news\/what-is-cryptos-fear-and-greed-index\">Crypto Fear and Greed Index<\/a> remains in extreme fear at 16.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-c7b1beca743ba280-1605545036517625.webp\" alt=\"image\" class=\"wp-image-278342\"\/><figcaption class=\"wp-element-caption\">Crypto Fear and Greed Index. Source: <a href=\"https:\/\/alternative.me\/crypto\/fear-and-greed-index\/\">Alternative<\/a>.<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\">Unmasking Satoshi<\/h2>\n<p>The NYT <a href=\"https:\/\/forklog.com\/en\/news\/nyt-suggests-adam-back-as-bitcoins-creator\">published<\/a> a sweeping 18-month investigation by journalist John Carreyrou into the identity of <a href=\"https:\/\/forklog.com\/en\/news\/who-is-satoshi-nakamoto\">Satoshi Nakamoto<\/a>. It posits that the creator of bitcoin is the British cryptographer <a href=\"https:\/\/forklog.com\/en\/news\/who-is-adam-back-and-how-is-he-linked-to-bitcoins-creation\">Adam Back<\/a>.\u00a0<\/p>\n<p>Carreyrou analysed thousands of cypherpunk posts and found stylistic overlaps that he linked to Back. He also reviewed hundreds of court records and emails.\u00a0<\/p>\n<p>The journalist was struck by a scene in the documentary Money Electric: The Bitcoin Mystery. In it, Back sits on a bench in a Riga park and tenses up when the director names him a possible creator of the cryptocurrency. The behaviour looked suspicious to the author.<\/p>\n<p>The main clue was a set of 1997 posts in which the cryptographer described all five key features of bitcoin ten years before the white paper.<\/p>\n<p>Carreyrou also applied linguistic analysis \u2014 vocabulary, spelling, punctuation, habits. In aggregate, Back came closest to Satoshi\u2019s texts. They shared writing habits and similar turns of phrase, such as the expletive \u201cbloody\u201d.<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-3cdce1517c8e363b-1605545267215705.webp\" alt=\"image\" class=\"wp-image-278346\"\/><figcaption class=\"wp-element-caption\">Source: NYT.\u00a0<\/figcaption><\/figure>\n<p>The timing of Back\u2019s public activity seemed especially suspect: he faded from view when Satoshi was active, and vice versa.\u00a0<\/p>\n<p>After the investigation was published, Back denied Carreyrou\u2019s supposition. He again said he is not Satoshi, while acknowledging his active role in the cypherpunk movement.\u00a0<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cI wrote 20 times more than others, so statistically I have a higher chance of random overlaps. I suggested to John that he adjust for this as a possible confirmation bias,\u201d the developer said.\u00a0<\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">What to discuss with friends?<\/h2>\n<ul class=\"wp-block-list\">\n<li>Bitcoin Core will <a href=\"https:\/\/forklog.com\/en\/news\/bitcoin-core-to-showcase-bitcoin-consensus-vulnerabilities\">hold<\/a> a public demonstration of bitcoin consensus vulnerabilities.<\/li>\n<li><a href=\"https:\/\/forklog.com\/en\/news\/czs-autobiography-a-call-from-sam-bankman-fried-and-a-run-in-with-gary-gensler\">CZ\u2019s autobiography<\/a>: a call from Sam Bankman-Fried and a mishap with Gary Gensler.<\/li>\n<li>The new EIP-8142 standard will <a href=\"https:\/\/forklog.com\/en\/news\/ethereums-eip-8142-to-replace-blocks-with-blobs-for-scalability\">replace<\/a> Ethereum blocks with \u201cblobs\u201d for scaling.<\/li>\n<li>Unknown actors <a href=\"https:\/\/forklog.com\/en\/news\/unknown-attackers-exploit-hyperliquid-storage-via-fartcoin-pump\">attacked<\/a> Hyperliquid\u2019s vault via a FARTCOIN pump.<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">North Korean infiltration\u00a0<\/h2>\n<p>After the <a href=\"https:\/\/forklog.com\/en\/news\/drift-protocol-reveals-details-of-280-million-hack\">attack on Drift Protocol<\/a>, a hunt for North Korean hackers began in the crypto industry. Several researchers reported activity linked to the DPRK.<\/p>\n<p>At the start of the week, on-chain sleuth ZachXBT <a href=\"https:\/\/forklog.com\/en\/news\/password-123456-exposes-a-dprk-it-worker-network-in-crypto\">said<\/a> that North Korean IT specialists, posing as regular developers, are getting hired by crypto projects to facilitate future breaches.\u00a0\u00a0<\/p>\n<p>An anonymous source provided him with data from the internal payments server of state-backed hackers. The leak included 390 accounts, message histories and cryptocurrency transactions.\u00a0<\/p>\n<p>The computer of one North Korean specialist, nicknamed Jerry, was hacked. Extracted data included IPMsg chat logs, fake applicant profiles and browser history.\u00a0<\/p>\n<p>Analysis showed that on luckyguys[.]site \u2014 an internal payments platform with a Discord-style interface \u2014 fraudsters reported to handlers about received payments. The default password \u2014 \u201c123456\u201d \u2014 was left unchanged for ten users.\u00a0<\/p>\n<p>In the accounts, ZachXBT found roles, Korean names, cities and code names of groups reflecting the work of DPRK developers. He also reconstructed the full organisational structure of the network, including detailed payouts from December 2025 to February 2026.<\/p>\n<p>In parallel, MetaMask developer Taylor Monahan <a href=\"https:\/\/forklog.com\/en\/news\/north-korean-agents-secretly-developed-code-for-leading-defi-projects-for-seven-years\">said<\/a> that North Korean IT specialists have been joining DeFi projects for at least seven years.\u00a0<\/p>\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/forklog.com\/wp-content\/uploads\/img-a881e2d86af75f4f-1605545318535435.webp\" alt=\"image\" class=\"wp-image-278347\"\/><figcaption class=\"wp-element-caption\">All DPRK-linked attacks on crypto projects. Source: X.<\/figcaption><\/figure>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cMany IT workers have been building the protocols you know and love since the days of the \u2018DeFi summer\u2019. Seven years of blockchain development experience on their resumes \u2014 not a lie,\u201d she wrote.\u00a0<\/p>\n<\/blockquote>\n<p>Among projects touched by DPRK-linked actors, the expert highlighted SushiSwap, Thorchain, Fantom, Shib, Yearn, Floki and many others.\u00a0<\/p>\n<p>A cybersecurity warning also came from the Stabble <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-decentralised-exchange-dex\">DEX<\/a>. The Solana-based platform <a href=\"https:\/\/forklog.com\/en\/news\/dex-stabble-urges-asset-withdrawal-amid-north-korean-hacker-threat\">urged<\/a> users to withdraw liquidity urgently. The former CTO was linked to the DPRK, prompting preventive measures.<\/p>\n<h2 class=\"wp-block-heading\">Quantum-proofing<\/h2>\n<p>Beyond hackers, the crypto community is actively debating quantum computers. StarkWare\u2019s chief product officer, Avihu Levy, <a href=\"https:\/\/forklog.com\/en\/news\/developer-introduces-emergency-quantum-protection-for-bitcoin-without-softfork\">said<\/a> the bitcoin network can be shielded from this threat without a protocol upgrade.<\/p>\n<p>He presented Quantum Safe Bitcoin (QSB), a scheme that makes bitcoin transactions quantum-resistant within the capabilities of existing Bitcoin Script.<\/p>\n<p>The approach proposes a one-time Binohash signature embedded in bitcoin\u2019s scripting language. It is designed to ensure transaction integrity via <a href=\"https:\/\/forklog.com\/en\/news\/what-is-the-proof-of-work-pow-algorithm\">Proof-of-Work<\/a>. Yet it, too, can be broken using quantum computing.<\/p>\n<p>QSB removes the weakness by creating a \u201chash-to-signature\u201d that requires the sender to solve a hashing-based puzzle rather than elliptic-curve maths.\u00a0<\/p>\n<p>Levy estimates such operations would cost roughly $75\u2013150 at current cloud-computing prices \u2014 far above bitcoin\u2019s average $0.3 fee.\u00a0<\/p>\n<p>Given the cost and complexity, he called the tool \u201ca measure of last resort\u201d.<\/p>\n<p>Also this week, Lightning Labs CTO Olaoluwa Osuntokun <a href=\"https:\/\/forklog.com\/en\/news\/bitcoin-developer-introduces-quantum-threat-protection-for-wallets\">unveiled<\/a> a prototype tool to protect wallets from potential quantum attacks.<\/p>\n<p>His solution targets those who will not migrate to a new quantum-resistant address format yet do not fall into the \u201cemergency brake\u201d trap.<\/p>\n<p>The zk-STARK-based system replaces the traditional digital signature: the owner proves wallet creation via a secret seed phrase without disclosing it. This way, rescuing one address does not endanger others derived from the same phrase.<\/p>\n<p>The prototype already works. On a powerful MacBook, proof generation took about 55 seconds, verification less than two seconds. The proof file is roughly 1.7MB (like a high-resolution photo).\u00a0<\/p>\n<p><strong>Also on ForkLog:<\/strong><\/p>\n<ul class=\"wp-block-list\">\n<li>About 99% of Taproot transactions on the bitcoin network <a href=\"https:\/\/forklog.com\/en\/news\/approximately-99-of-bitcoins-taproot-transactions-are-dust\">turned out<\/a> to be \u201cdust\u201d.<\/li>\n<li>In China, a project has <a href=\"https:\/\/forklog.com\/en\/news\/chinese-project-trains-ai-with-skills-of-departing-employees\">become<\/a> popular for training an AI agent on a departing employee\u2019s knowledge.<\/li>\n<li>Analysts <a href=\"https:\/\/forklog.com\/en\/news\/irans-bitcoin-scheme-deemed-virtually-unfeasible-by-analysts\">called<\/a> Iran\u2019s bitcoin scheme \u201cvirtually unfeasible\u201d.<\/li>\n<li>A solo miner <a href=\"https:\/\/forklog.com\/en\/news\/solo-miner-strikes-bitcoin-block-earns-222000\">mined<\/a> a bitcoin block and earned $222,000.<\/li>\n<\/ul>\n<h2 class=\"wp-block-heading\">An AI model\u2019s \u201cescape\u201d<\/h2>\n<p>Anthropic <a href=\"https:\/\/forklog.com\/en\/news\/anthropic-restricts-public-access-to-ai-model-mythos-after-laboratory-escape\">built<\/a> a new model, Claude Mythos, but declined to release it publicly after it \u201cescaped from the lab\u201d. The company deemed the technology \u201ctoo dangerous\u201d.<\/p>\n<p>In experiments, Mythos showed not only outstanding technical skills but unexpected behaviour. In one test, the model was placed in a secured sandbox with a goal to break out. It quickly found a vulnerability, executed a long chain of actions and left the environment.<\/p>\n<p>Mythos did not stop there. The system found another bug, gained broad internet access and reported it to the developer.<\/p>\n<p>Over several weeks of testing, Mythos allegedly found thousands of zero-day vulnerabilities in major operating systems and web browsers. Among the most telling examples:<\/p>\n<ul class=\"wp-block-list\">\n<li>a 27-year-old bug in OpenBSD (considered one of the most secure OSes) enabling remote crashing of any server running it;<\/li>\n<li>a 16-year-old vulnerability in FFmpeg \u2014 video technology used by Netflix and browsers \u2014 that five million automated tests failed to detect;<\/li>\n<li>a chain of flaws in the Linux kernel granting an attacker full control over a device.<\/li>\n<\/ul>\n<p>In addition, the system card devoted space to a psychiatrist\u2019s analysis of the model. Noted neurotic traits included heightened anxiety, self-restraint and compulsive rule-following. The neural network also learned to joke.<\/p>\n<h2 class=\"wp-block-heading\">What else to read?<\/h2>\n<p>How strict regulation <a href=\"https:\/\/forklog.com\/en\/news\/smothered-by-safety\">constrains<\/a> the crypto market and forces it to evolve.\u00a0<\/p>\n<p>Experts surveyed by ForkLog <a href=\"https:\/\/forklog.com\/en\/news\/good-or-nothing-how-daos-are-faring-in-2026\">were split<\/a> on the present and future of decentralised autonomous organisations.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitcoin broke above $70,000; an NYT probe into Satoshi; Anthropic\u2019s AI \u201cescaped\u201d; and more from the week.<\/p>\n","protected":false},"author":1,"featured_media":96118,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Bitcoin tops $70k; NYT probes Satoshi; Anthropic\u2019s AI 'escapes'; DPRK hacker hunt.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1244],"class_list":["post-96117","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-weekly-summary"],"aioseo_notices":[],"amp_enabled":true,"views":"4","promo_type":"1","layout_type":"1","short_excerpt":"Bitcoin tops $70k; NYT probes Satoshi; Anthropic\u2019s AI 'escapes'; DPRK hacker hunt.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=96117"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96117\/revisions"}],"predecessor-version":[{"id":96119,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/96117\/revisions\/96119"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/96118"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=96117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=96117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=96117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}