Lazarus hits cryptocurrency exchange with fake installer and macOS malware 11019

Kaspersky Lab has been assisting with incident response efforts. While investigating a cryptocurrency exchange attacked by Lazarus, we made an unexpected discovery. The victim had been infected with the help of a trojanized cryptocurrency trading application, which had been recommended to the company over email. It turned out that an unsuspecting employee of the company had willingly downloaded a third-party application from a legitimate looking website and their computer had been infected with malware known as Fallchill, an old tool that Lazarus has recently switched back to. There have been multiple reports on the reappearance of Fallchill, including one from US-CERT.

To ensure that the OS platform was not an obstacle to infecting targets, it seems the attackers went the extra mile and developed malware for other platforms, including for macOS. A version for Linux is apparently coming soon, according to the website. It’s probably the first time we see this APT group using malware for macOS.

The fact that the Lazarus group has expanded its list of targeted operating systems should be a wake-up call for users of non-Windows platforms.

Trojanized cryptocurrency trading application

Thanks to Kaspersky Lab’s malicious-behavior detection technology, implemented in its endpoint security software, we were able to reassemble the stages of infection and trace them back to their origin. This helped us understand that one of Lazarus’ victims was infected with malware after installing a cryptocurrency trading program. We also confirmed that the user installed this program via a download link delivered over email.

Trojanized trading application for Windows

Including malicious code into distributed software and putting that on a website would be too obvious. Instead, the attackers went for a more elaborate scheme: the trojan code was pushed out in the form of an update for a trading application.

A legitimate-looking application called Celas Trade Pro from Celas Limited showed no signs of malicious behaviour and looked genuine. This application is an all-in-one style cryptocurrency trading program developed by Celas.

Screenshot of Celas Trade Pro

When we started this research, any user could download the trading application from the Celas website. Checking the installation package downloaded from the website confirmed the presence of a very suspicious updater.

Installation package download page

We have analyzed the following Windows version of the installation package:

MD5: 9e740241ca2acdc79f30ad2c3f50990a
File name: celastradepro_win_installer_1.00.00.msi
File type: MSI installer
Creation time: 2018-06-29 01:16:00 UTC

At the end of the installation process, the installer immediately runs the Updater.exe module with the “CheckUpdate” parameter. This file looks like a regular tool and most likely will not arouse the suspicion of system administrators. After all, it even contains a valid digital signature, which belongs to the same vendor. But the devil is in the detail, as usual.

The code writer developed this project under the codename “jeus”, which was discovered in a PDB path included in the updater and used as unique HTTP multipart message data separator string. Because of this, and the fact that the attacked platforms include Apple macOS, we decided to call this Operation AppleJeus.

Properties of the shady updater tool included in the package are:

MD5: b054a7382adf6b774b15f52d971f3799
File Type: PE32 executable (GUI) Intel 80386, for MS Windows
Known file name: %Program Files%\CelasTradePro\Updater.exe
Link Time: 2018-06-15 10:56:27 UTC
Build path: Z:\jeus\downloader\downloader_exe_vs2010\Release\dloader.pdb

The main purpose of Updater.exe is to collect the victim’s host information and send it back to the server. Upon launch, the malware creates a unique string with the format string template “%09d-%05d” based on random values, which is used as a unique identifier of the infected host. This malware collects process lists, excluding “[System Process]” and “System” processes and gets the exact OS version from the registry value at “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion”. It seems that such values only exist from Windows 10, so we assume that the author developed and tested it on Windows 10.

  • ProductName: Windows OS version
  • CurrentBuildNumber: Windows 10 build version
  • ReleaseID: Windows 10 version information
  • UBR: Sub version of Windows 10 build
  • BuildBranch: Windows 10 build branch information

The code encrypts the collected information with the hardcoded XOR key (“Moz&Wie;#t/6T!2y“) before uploading it to the server.

Data encryption routine

The code sends the victim’s information to a webserver using HTTP and the following URL:
www.celasllc[.]com/checkupdate.php

The server is a legitimate looking website owned by the developer of the program: Celas LLC. At this point we were not able to conclude with high confidence whether the server was compromised by the threat actor or had belonged to the threat actor from the beginning. To learn more about the server, please read the “Infrastructure” section below.

The malware used a hardcoded User-Agent string “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)” and fixed a multipart form data separator string “jeus“.

Using encryption, the custom separator string wouldn’t be a red flag for a legitimate application, but sending a request with the context-irrelevant string “get_config”, as well as uploading collected system information as “temp.gif”, mimicking a GIF image with a magic number in the header, definitely made us raise our eyebrows.

Communication with the C2 server

After successfully uploading data, the updater checks the server response. If the server responds with HTTP code 300, it means the updater should keep quiet and take no action. However, if the response is HTTP code 200, it extracts the payload with base64 and decrypts it using RC4 with another hardcoded key (“W29ab@ad%Df324V$Yd“). The decrypted data is an executable file that is prepended with the “MAX_PATHjeusD” string.

During our research, we found other similar files. One was created on August 3rd and another on August 11th. The PDB path shows that the author keeps improving this updater tool, apparently forked from some stable version released on July 2, 2018 according to the internal directory name.

Additional trojanized sample #1 Additional trojanized sample #1
Installation package MD5 4126e1f34cf282c354e17587bb6e8da3 0bdb652bbe15942e866083f29fb6dd62
Package creation date 2018-08-03 09:57:29 2018-08-13 0:12:10
Dropped updater MD5 ffae703a1e327380d85880b9037a0aeb bbbcf6da5a4c352e8846bf91c3358d5c
Updater creation date 2018-08-03 09:50:08 2018-08-11 7:28:08
Updater Build path H:\DEV\TManager\DLoader\20180702\dloader\WorkingDir\Output\00000009\Release\dloader.pdb H:\DEV\TManager\DLoader\20180702\dloader\WorkingDir\Output\00000006\Release\dloader.pdb

Note the TManager directory in the PDB path from the table. It will pop up again in another unexpected place later.

Trojanized trading program for macOS

For macOS users, Celas LLC also provided a native version of its trading app. A hidden “autoupdater” module is installed in the background to start immediately after installation, and after each system reboot. It keeps contacting the command and control (C2) server in order to download and run an additional executable from the server. The communication conforms to the Windows version of the updater and is disguised as an image file upload and download, while carrying encrypted data inside.

We have analyzed the following installation file:

MD5: 48ded52752de9f9b73c6bf9ae81cb429
File Size: 15,020,544 bytes
File Type: DMG disk image
Known file name: celastradepro_mac_installer_1.00.00.dmg
Date of creation: 13 July 2018

Once the Cellas Trade Pro app is installed on macOS, it starts the Updater application on the system load via a file named “.com.celastradepro.plist” (note that it starts with a dot symbol, which makes it unlisted in the Finder app or default Terminal directory listing). The “Updater” file is passed the “CheckUpdate” parameter on start.

Celas Trade Pro app plist file (Apple Property List)

The command-line argument “CheckUpdate” looks redundant from a code analysis perspective: there is no other argument that the application expects. In the absence of all arguments, it doesn’t do anything and quits. This may or may not be way to trick sandboxes that could automatically execute this trojan updater, with no suspicious activity produced without such a “secret” extra argument. The choice of a benign string such as “CheckUpdate” helps it to hide in plain sight of any user or administrator looking into running processes.

The trojanized updater works similar to the Windows version in many ways. Both applications are implemented using a cross-platform QT framework. Upon launch, the downloader creates a unique identifier for the infected host using a “%09d-%06d” format string template. Next, the app collects basic system information, which for macOS is done via dedicated QT classes:

  • Host name
  • OS type and version
  • System architecture
  • OS kernel type and version

The process of encrypting and transferring data is the same as in the Windows version. This information is XOR-encrypted with hardcoded 16-byte static key “Moz&Wie;#t/6T!2y”, prepended with GIF89a header and uploaded to the C2 server via HTTP POST and the following URL:

https://www.celasllc[.]com/checkupdate.php

POST request template strings

The module relies on a hardcoded User-Agent string for macOS:
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36

Once the server replies, it checks the HTTP response code. HTTP response code 300 indicates that the server has no task for the updater and the application terminates immediately. If the HTTP response is code 200, then the updater gets the data in the response, decodes it from base64 encoding and decrypts it using RC4 with the hardcoded static key “W29ab@ad%Df324V$Yd“. It calculates the MD5 of the decoded and decrypted data, which is compared to a value stored inside, to verify the integrity of the transferred file. After that, the payload is extracted and saved to a hardcoded file location “/var/zdiffsec“, sets executable permissions for all users and starts the app with another secret hardcoded command-line argument “bf6a0c760cc642“. Apparently the command-line argument is the way to prevent the detection of its malicious functionality via sandboxes or even reverse engineering. We have previously seen this technique adopted by Lazarus group in 2016 in attacks against banks. As of 2018, it is still using this in almost every attack we investigated.

Downloaded payload

According to data from Kaspersky Security Network, the threat actor delivered the malicious payload using one of the shadowy updaters described above. We found a malicious file created at the same host:

MD5: 0a15a33844c9df11f12a4889ae7b7e4b
File Size: 104,898,560 bytes
File Type: PE32+ executable (GUI) x86-64, for MS Windows
Known file name: C:\Recovery\msn.exe
Link time: 2018-04-19 13:30:19

Note the unusually large size for an executable file. We believe that it was inflated with junk data on purpose to prevent easy download or transfer over the internet.

Searching for the reason for the malware’s appearance on the system revealed that there was an additional process responsible for producing several files before this malware was launched, suggesting a trojan dropper in action. The main function of this malware is to implant the Fallchill backdoor loader linked to several files. Upon launch, the malware checks one of the command-line arguments passed to it. The malware chooses one of the service names located in the following registry value as a disguise:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs

This value includes a list of several dozen standard system service names.

The randomly chosen service name is used to name the dropped file and newly registered Windows service. Let’s refer to this randomly chosen service name as [service]. The malware contains references to several files inside:

  • The file passed as argument: contains a 16-byte key
  • msncf.dat: Encrypted configuration data
  • msndll.tmp: Encrypted Fallchill loader
  • msndll.dat: Encrypted Fallchill backdoor (payload for the loader)
  • [service]svc.dll: Fallchill backdoor loader
  • [service].dat: Copy of msndll.dat

A mix of the above-mentioned files produces the final backdoor known as Fallchill. A more detailed procedure for technical specialists is as follows:

  1. Check whether the command-line argument points to a file of 16 byte size.
  2. Read the file passed via the command-line argument. The contents of this file contains a crypto key, which we will call the main key.
  3. Open the msncf.dat file (configuration file). If the file size equals 192 bytes, read the content of the file.
  4. Open msndll.tmp file and decrypt it using the main key.
  5. Create the [service]svc.dll file and fill it with pseudo-random data.
    1. The malware fills the file with 10,240 bytes of pseudo-random data, and iterates (rand() % 10 + 10240) times. This is why it produces files which are at least 104,851,000 bytes.
  6. Copy the 16-byte main key at the end of the [service]svc.dll file.
  7. Encrypt the [service].dat file name with the main key and append it at the end of [service]svc.dll.
  8. Overwrite the beginning of [service]svc.dll with data decrypted from msndll.tmp.
  9. Move msndll.dat file to [service].dat.
  10. Delete temporary files: msndll.tmp, msncf.dat, msndll.log.
  11. Timestamp [service]svc.dll and [service].dat files.
  12. Register [service]svc.dll as a Windows service.
  13. Save a copy of data from msncf.dat file in the following registry value
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskConfigs\Description.

Infection process diagram

Fallchill backdoor loader

We confirmed that the following malware was created on the infected host using the method described above:

Fallchill backdoor loader:

MD5: e1ed584a672cab33af29114576ad6cce
File Size: 104,878,356 bytes
File Type: PE32+ executable (DLL) (console) x86-64, for MS Windows
Known file name: C:\Windows\system32\uploadmgrsvc.dll
Link time: 2018-01-18 01:56:32

Encrypted Fallchill backdoor:

MD5: d8484469587756ce0d10a09027044808
File Size: 143,872 bytes
File Type: encrypted data
Known file name: C:\Windows\system32\uploadmgr.dat

Upon starting, uploadmgrsvc.dll reads 276 bytes from the end of its own executable file. The first 16 bytes of this 276-byte data are used as a decryption key, and the remaining 260 bytes contain the encrypted file path used by the backdoor.

Data at the end of the loader module

After decryption of the last 260-bytes, the malware retrieves the name or path of the file that contains the actual backdoor body in encrypted form.

Decrypted file name in the end of loader module

The malware reads the specified file and decrypts it using the same decryption routine. This is how the executable code of the backdoor is produced in memory and executed by the loader. Below is the meta information about the decrypted final payload in memory:

MD5: d7089e6bc8bd137a7241a7ad297f975d
File Size: 143,872 bytes
File Type: PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Link Time: 2018-03-16 07:15:31

We can summarize the Fallchill backdoor loading process as follows:

Loading the Fallchill backdoor

As mentioned previously, the final payload belongs to a Fallchill malware cluster formerly attributed to the Lazarus APT group. Upon launching, this malware resolves the API function addresses at runtime, and reads the C2 server address from the registry value created during the installation stage:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskConfigs\Description

If there is no configuration value, the malware falls back to a default C2 server address.

  • 196.38.48[.]121
  • 185.142.236[.]226

This is a full-featured backdoor that contains enough functions to fully control the infected host. Some of its network protocol commands are described below.

Command ID Description
0x8000 Write current time and configuration data to registry key
0x8001 Send configuration data
0x8002 Replace configuration data in the fixed registry value
0x8003 Execute Windows command, store output in temp file and upload contents to C2
0x8006 Show current working directory
0x8007 Change current working directory
0x8008 Collect process information
0x8009 Terminate process
0x8010 Start new process
0x8011 Create process with security context of the current user
0x8012 Connect to specified host/port
0x8013 Get drive information
0x8014 Directory listing
0x8015 Search a file
0x8019 Write data to a specified file
0x8020 Read contents of specified file and upload to C2 server
0x8021 Compress multiples files to a temp file (name start with ZD) and upload to C2
0x8023 Wipe specific file
0x8025 Copy file time from another file time (timestamping)
0x8026 Shutdown malware service and self-delete
0x8043 Send “Not Service” unicode string to C2 server (communication test?).

This set of capabilities is very common for many Lazarus backdoors, which have been seen in other attacks against banks and financial industry in the past years.

Infrastructure

While working on the incident of the cryptocurrency company’s breach, we were curious about the legal status of the Celas LLC company that developed this trojanized trading application.

Celas LLC main homepage.

The website had a valid SSL certificate issued by Comodo CA. However, note that the certificate from this webserver mentions “Domain Control Validated”, which is a weak security verification level for a webserver. It does not mean validation of the identity of the website’s owner, nor of the actual existence of the business. When certification authorities issue this kind of certificate they only check that the owner has a certain control over the domain name, which can be abused in certain ways.

Below is the WHOIS record of the “celasllc.com” domain. The domain name was registered by an individual named “John Broox” with registrant email address “johnbroox200@gmail[.]com”.

The same name of “John Broox” was used inside the installation package of the macOS version of the trading application. The Info.plist properties file describes the package as follows:

It looks at first sight like a legitimate WHOIS record, but something doesn’t really add up here. The domain celasllc.com was the only domain registered with this email address and was exclusively used for domain registration.

The registrant used the Domain4Bitcoins service to register this domain, apparently paying with cryptocurrency. According to open-source intelligence, the address of the WHOIS information is fake, unless it’s the owner of a ramen shop running a cryptocurrency exchange software development studio on the side.

View of the location referred in the WHOIS record. Image source: Google Maps.

The server hosting celasllc.com (185.142.236.213) belongs to the Blackhost ISP in the Netherlands.

WHOIS record of cellasllc.com server

Coincidentally, the Fallchill malware authors also preferred to use the same hosting company to host their C2 server. Moreover, the Celas LLC web server and one of the C2 servers of the Fallchill malware are located in the same network segment of this ISP:

  • Celas LLC infrastructure:
    • 185.142.236.213: Netherlands Blackhost Ltd. AS174 COGENT-174
  • Fallchill malware C2 server:
    • 196.38.48[.]121: South Africa Internet Solutions AS3741
    • 185.142.236[.]226: Netherlands Blackhost Ltd. AS174 COGENT-174
  • Additional attacker’s server from telemetry
    • 80.82.64[.]91: Seychelles Incrediserve Ltd AS29073
    • 185.142.239[.]173: Netherlands Blackhost Ltd. AS174 COGENT-174

However, when you look into Celas Trading Pro application’s digital signature, including its “Updater”, you will find that this certificate was also issued by Comodo CA, which refers to a company address in the United States.

According to open-source data, this address doesn’t belong to a real business, and looks on maps like a meadow with a small forest and small real estate offering nearby.

Location of Cellas LLC, according to its digital certificate

Real estate history of that address

Pivoting the infrastructure a little further brings up some more suspicious things. It appears that the domain referred to two IPs, one of which was linked to a few other suspicious domains, according to PassiveDNS.

Cellas LLC linked infrastructure

The owners of the linked infrastructural elements preferred to use several interesting services for hosting domain registration. All these service providers offer a certain level of anonymity to their customers. Most of them accept Bitcoins as a main payment method to keep their customers anonymous. This is very uncommon for companies running a legitimate business.

Hosting services linked to Celas LLC:

  • Blackhost (https://black.host/)
  • Liberty VPS (https://libertyvps.net/)

Domain registration services linked to Celas LLC:

  • Domains4Bitcoins (https://www.domains4bitcoins.com/)
  • NameCheap (https://www.namecheap.com/)
  • ChangeIP (https://www.changeip.com/)
  • Njalla (https://njal.la/)

All the facts above can make the more sceptical among us doubt the intentions of Celas LLC and the legitimacy of this business. Of course, these facts alone would not be enough to accuse Celas LLC of committing a crime.

Attribution

Kaspersky Lab has previously attributed the Fallchill malware cluster to Lazarus group when it attacked the financial sector around the world. It was also confirmed by other security vendors, and the national CERT of US.

RC4 key from the older Fallchill

Fallchill malware uses a RC4 algorithm with a 16-byte key to protect its communications. The key extracted from the Fallchill variant used in the current attack is DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B.

Current RC4 key of Fallchill

We were able to confirm that some of older Fallchill malware variants used exactly the same RC4 key. Below are Fallchill malware samples that used the same key (the compilation timestamp may indicate the date of malware creation).

MD5 Timestamp
81c3a3c5a0129477b59397173fdc0b01 2017-05-26 23:37:04
6cb34af551b3fb63df6c9b86900cf044 2017-06-09 17:24:30
21694c8db6234df74102e8b5994b7627 2017-11-07 17:54:19
5ad7d35f0617595f26d565a3b7ebc6d0 2015-10-24 01:52:11
c501ea6c56ba9133c3c26a7d5ed4ce49 2017-06-09 03:59:43
cafda7b3e9a4f86d4bd005075040a712 2017-11-07 17:54:33
cea1a63656fb199dd5ab90528188e87c 2017-06-12 19:25:31
6b061267c7ddeb160368128a933d38be 2017-11-09 17:18:06
56f5088f488e50999ee6cced1f5dd6aa 2017-06-13 08:17:51
cd6796f324ecb7cf34bc9bc38ce4e649 2016-04-17 03:26:56

Same C2 server with older Fallchill

We have confirmed that the C2 server addresses (196.38.48[.]121, 185.142.236[.]226) used in this attack have been used by the older variant of Fallchill.

MD5 Timestamp
94dfcabd8ba5ca94828cd5a88d6ed488 2016-10-24 02:31:18
14b6d24873f19332701177208f85e776 2017-06-07 06:41:27
abec84286df80704b823e698199d89f7 2017-01-18 04:29:29

Overlap of C2 infrastructure

Apparently, the attackers using the Fallchill malware continue to reuse code and C2 server infrastructure over and over again.

According to Kaspersky Security Network, Fallchill was not the only malware used in this attack. There was another backdoor that was used by the threat actor. We omit a full description of this backdoor in the current report to keep the write-up to an acceptable length, but we would like to highlight two important things discovered in it. First, this backdoor was created on 2018-07-12 and revealed an already familiar directory, “TManager”, which we previously saw in the Updater.exe application from the Cellas Trading Pro suite:

H:\DEV\TManager\all_BOSS_troy\T_4.2\T_4.2\Server_\x64\Release\ServerDll.pdb

Second, what is probably one of the most interesting findings to come from this additional backdoor was discovered hidden in hardcoded headers used to communicate with C2 server. The Accept-Language HTTP header string revealed a language code associated with North Korea. In our experience, this is something we normally don’t see in malware.

Accept-Language: ko-kp,ko-kr;q=0.8,ko;q=0.6,en-us;q=0.4,en;q=0.2

Accept-Language HTTP header value in the body of the backdoor

Conclusions

The Lazarus APT group’s continuous attacks on the financial sector are not much of a surprise to anyone. A lot of research has been done and published about such attacks. However, we think this case makes a difference. Recent investigation shows how aggressive the group is and how its strategies may evolve in the future.

First of all, Lazarus group has entered a new platform: macOS. There is steadily growing interest in macOS from ordinary users, especially in IT companies. Many developers and engineers are switching to using macOS. Apparently, in the chase after advanced users, software developers from supply chains and some high profile targets, threat actors are forced to have macOS malware tools. We believe that in the future Lazarus is going to support all platforms that software developers are using as a base platform, because compromising developers opens many doors at once.

We cannot say with full certainty whether Celas LLC was compromised and the threat actor abused it to push malware through an update mechanism. However, the multiple successful Lazarus attempts to compromise supply chain companies suggest that it will keep exploring this infection method. From all angles, the Celas LLC story looks like the threat actor has found an elaborate way to create a legitimate looking business and inject a malicious payload into a “legitimate looking” software update mechanism. Sounds logical: if one cannot compromise a supply chain, why not to make fake one?

This should be a lesson to all of us and a wake-up call to businesses relying on third-party software. Do not automatically trust the code running on your systems. Neither good looking website, nor solid company profile nor the digital certificates guarantee the absence of backdoors. Trust has to be earned and proven. Stay safe!

Previous ArticleNext Article

Theo’s Gold-Backed Stablecoin Held Steady Through Global Disruption, Now Targets $1B in Deposits 327

Following $100M Genesis Program sellout in 24 hours, Theo opens access to gold-backed, yield-bearing stablecoin in 200 countries

Theo, the tokenization platform built by former Optiver and IMC traders, is opening access to thUSD, its gold-backed, yield-bearing stablecoin, in over 200 countries, targeting $1 billion in deposits by year-end. The move follows a period in which the product’s delta-neutral gold strategy delivered positive returns every month, including through the significant gold price volatility of March 2026.

thUSD generates yield from two independent sources that are structurally disconnected from both central bank policy and gold price movements. The first is physical gold lending: deposits are backed by thGOLD, Theo’s tokenised gold product, which earns interest by lending gold to established retailers including Mustafa Gold, one of Asia’s largest gold retailers with $550 million in annual revenue. The second is futures arbitrage: Theo simultaneously shorts gold futures on the CME and other venues against its long thGOLD position, capturing the spread between spot and futures prices. The result is a delta-neutral position, holders are not exposed to gold going up or down, only to the structural basis between the two markets.

That basis held through March 2026, when market volatility drove sharp declines in gold prices. While holders of gold ETFs and gold-backed tokens experienced sharp drawdowns, thUSD’s peg was unaffected and yield continued to accrue.

“Most yield products today are a bet on rates or a bet on markets. thUSD is neither,” said Ari Pingle, Co-Founder and Co-CEO of Theo. “We’re harvesting a structural spread that exists because of how gold futures are priced relative to spot. That spread has been there for decades, we’ve just tokenised access to it.”

The opening of access follows the oversubscription of Theo’s $100 million Genesis Program, which hit its cap within 24 hours, validating demand for a yield product that does not depend on the direction of interest rates. With DeFi yields compressing, thUSD’s return profile offers a proposition that is structurally independent of the rate cycle. Theo is targeting $300 million in total value locked by the end of April and $1 billion by year-end.

The infrastructure is institutional-grade. FundBridge Capital manages the MG999 Onchain Gold Fund that underpins thGOLD, while Libeara, a tokenisation platform incubated by Standard Chartered Ventures, handles the onchain architecture. A first-loss buffer from the fund sponsor ensures loans remain fully collateralised before depositors bear any risk. Gold’s annualised volatility of 14.4% compares favourably to Bitcoin at 33.5% and Ethereum at 60.8%, and with $247.7 billion in open interest, gold futures dwarf crypto derivatives by orders of magnitude, supporting thUSD’s ability to scale without compressing yields.

“The question everyone asks is ‘what happens when gold drops?'” said Iggy Ioppe, Chief Investment Officer of Theo. “March gave us the answer. Gold dropped and thUSD didn’t flinch, because you’re not long gold, you’re long the spread. That’s the entire point.”

thUSD is built on the same infrastructure as thBILL, Theo’s tokenized U.S. Treasury product, which has processed approximately $1 billion in cumulative volume and holds over $200 million in assets. Theo’s $20 million funding round was led by Hack VC and Anthos Capital, with participation from angel investors at Citadel, Jane Street, HRT, Optiver, IMC, Five Rings, and JPMorgan.

thUSD is accessible via http://app.theo.xyz

About Theo

Theo is a full-stack tokenisation platform built by former quantitative traders from Optiver and IMC Trading. Theo combines asset issuance, professional market-making, and multi-venue distribution to make tokenised real-world assets more powerful than their traditional counterparts. Theo’s products, including thBILL (tokenised U.S. Treasuries, $200M+ TVL) and thGOLD (yield-bearing tokenised gold), are available across major DeFi venues including Arbitrum, Ethereum, Stable and powered by LayerZero. Theo is backed by Hack VC, Anthos Capital, and angel investors from Citadel, Jane Street, HRT, Optiver, IMC, Five Rings, and JPMorgan. Learn more at theo.xyz.

Solv Protocol Becomes First to Deliver Bitcoin-Native Yield via Utexo on RGB + Lightning Network, Aligning with Tether’s USDT Expansion 389

Solv Protocol, the leading on-chain Bitcoin asset management platform with over $2 billion in reserves and the largest on chain Bitcoin-native yield infrastructure, today announced a strategic integration with Utexo, a non-custodial settlement layer built on RGB protocol and Lightning Network. This marks the industry’s first true Bitcoin-native yield powered by atomic swaps between native BTC-to-USDT swaps directly on Bitcoin’s rails, eliminating wrappers, bridges, and custodial dependencies while preserving full self-custody, privacy, and settlement finality.

The integration aligns with Tether’s August 2025 announcement to issue USDT natively on RGB-compatible Lightning rails, marking a key step in commercializing Bitcoin-native stablecoins with faster, more private transfers.

A Shared Vision for Production-Ready Bitcoin Infrastructure

Solv participated as a strategic angel investor in Utexo’s recent $7.5 million seed round, which was led by Tether alongside other prominent investors. Both Solv and the round’s lead investors recognized the same critical gap: the lack of production-ready infrastructure capable of enabling scalable, native stablecoin settlements on Bitcoin and Lightning.

As Lightning Network advances toward even quicker settlements and broader asset support in 2026, Solv’s Utexo integration positions Bitcoin yield for large-scale institutional use, enabling seamless, Bitcoin-anchored financial flows.

A Milestone Shift to Pure Bitcoin-Native Yield

Traditional Bitcoin yield solutions force users to sacrifice custody, privacy, or settlement integrity. Solv’s Utexo integration changes that with 3 breakthrough advantages:

  • True self-custody — RGB’s client-side validation keeps transactions confidential while anchored to Bitcoin’s UTXO model
  • Lightning Network delivers 10x faster settlement — enabling instant, near-zero-fee transactions that finalize in approximately 50ms
  • Institutional-ready — Enterprise APIs eliminate technical complexity for funds, exchanges, and DeFi protocols

The timing aligns perfectly with Tether’s RGB-compatible USDT launch, positioning Solv to capture institutional demand as Bitcoin-native stablecoins go mainstream in 2026.

“Bitcoin-native yield has long been diluted by wrappers and intermediaries. With Utexo, we are drawing a clear line: true yield must be built directly on native Bitcoin rails, prioritizing security, privacy, and settlement integrity at institutional scale,” said Ryan Chow, Co-founder and CEO of Solv Protocol. “This is a key step in our ongoing exploration and creation of more sophisticated native BTC yield products for sophisticated capital.”

Utexo complements Solv’s vision by providing production-ready infrastructure for native BTC/USDT flows, especially as Tether’s RGB rollout expands stablecoin adoption on Bitcoin. Together, they support regulated access, enhanced collateral use cases and demand for high-throughput settlement with private execution and pre-fixed costs.

“Utexo’s RGB-Lightning stack empowers Solv to offer scalable, enterprise-grade yield, aligning with Tether’s native stablecoin roadmap,” said Viktor Ihnatiuk, Utexo’s Co-founder and CEO.

This positions Solv as a pioneer in Bitcoin-native finance, supporting Tether’s vision for private USDT transfers on Lightning, unlocking $1T+ in BTC potential amid 2026’s DeFi surge.

For more information, please visit https://solv.finance

Solv Protocol

Solv Protocol is the largest on-chain Bitcoin reserve, bridging TradFi, CeFi, DeFi, and RWAFfi (real-world assets finance) through its Bitcoin Finance product suite which includes SolvBTC, xSolvBTC and BTC+. With over 25,000 BTC staked and $2.5 billion in asset under management (AUM), Solv offers institutional-grade vaults, liquid staking, and lending solutions audited via Chainlink Proof of Reserve.

Backed by Binance Labs, Solv is building the $1 trillion Bitcoin economy — powered by transparency, efficiency, and interoperability.

Utexo

Utexo is a Bitcoin-anchored execution and settlement layer for stablecoin payments. By combining Lightning Network’s instant execution with RGB’s privacy-preserving asset issuance, Utexo’s API and SDK enable payment operators, exchanges, wallets, and custodians to process USDT with predictable fixed costs, sub-second settlement, and private execution without operating blockchain infrastructure or managing Lightning liquidity.

Quip.Network launches quantum-classical blockchain testnet, opens doors to global research community 715

More than 13,000 researchers sign up to participate in testnet to facilitate research and development in secure, trustworthy distributed quantum computing

Postquant Labs, the developer building Quip.Network, the first worldwide distributed quantum compute network, announced today that it has launched a publicly available quantum-classical blockchain test network (testnet). More than 13,000 people have signed up to participate in the testnet, which enables the global research community to experiment, collaborate, and contribute to advancing the intersection between quantum computing, blockchain technology and distributed quantum computing.

Built in consultation with D-Wave Quantum Inc. (“D-Wave”), the world’s leading quantum computing company, the testnet is designed to support the development and adoption of a global quantum blockchain standard. It is planned to also assess the role quantum computing could play in enabling a more secure and energy-efficient blockchain within a distributed computing network. The testnet uses D-Wave’s Advantage2 annealing quantum computers to solve complex optimization problems along with other computing platforms.

“Today, annealing quantum computers are starting to show performance advantages on useful optimization applications across logistics, manufacturing, and beyond, often delivering better results, faster, and at lower energy cost than classical-only solutions,” said Colton Dillion, CEO and co-founder of Postquant Labs. “Our goal is to make this quantum advantage accessible across a blockchain network, and we can begin to build the foundations for this today.”

Quip.Network’s testnet mining protocol is built around solving a set of computationally challenging optimization problems — a class of problems where D-Wave’s Advantage2 annealing quantum computer has demonstrated competitive performance relative to classical computing approaches. Researchers and developers are invited to participate in the testnet and compete for QUIP token incentives by solving these benchmark problems using quantum and classical computing resources, including CPUs and GPUs.

“The convergence of quantum computing and blockchain represents a powerful new frontier for secure, energy-efficient, and distributed computing,” said Dr. Trevor Lanting, chief development officer at D-Wave. “Quip.Network’s testnet provides a pathway for researchers to explore, understand and accelerate how quantum computing could enhance blockchain performance.”

“Quip.Network is open-source because quantum advantage shouldn’t be a marketing claim, but rather a verifiable result,” said Dr. Richard Carback, chief technology officer and co-founder of Postquant Labs. “We want the community running nodes and helping us harden the infrastructure. We want researchers to challenge our implementations and submit proofs of work optimized for their own processors.”

The network’s cross-chain architecture means users don’t need to move funds to a new blockchain to participate, and its post-quantum secure design protects user assets against emerging quantum threats. Quantum-resistant wallets are already deployed on EVM and Solana networks, with Bitcoin and other network support in development.

About Postquant Labs

Postquant Labs is building Quip.Network, the first decentralized, worldwide quantum computer. The network incentivizes both quantum and classical operators to contribute computing power, creating a trustless marketplace for quantum computing. Quip.Network’s quantum-resistant wallets are already deployed across multiple blockchains.

Uniblock Raises $5.2M to Operate Blockchain Infrastructure 842

Uniblock, the managed infrastructure layer for blockchain applications, has raised $5.2 million in funding ($7.5M to date). The round brings together investors across the US, Japan, India, Singapore, and the Solana ecosystem, including SBI, AllianceDAO, CoinSwitch, Blockchain Founders Fund, Hustle Fund, AAF Management, NGC Ventures, Alchemy, MoonPay among others, with angel participation from executives at Kraken, Uber, and CoinList.

Alongside the raise, Uniblock has shipped a suite of AI-native developer tools built for how blockchain development actually happens today.

The Infrastructure Problem

Blockchain infrastructure has entered a new phase. Stripe has entered the crypto arena in a big way with its $1.1B acquisition of Bridge for stablecoins, Privy for wallets and now Tempo, its own Layer 1 blockchain for payments, with Mastercard, Visa, and UBS already testing on the network. Mainstream media networks broadcast Polymarket prediction market odds in live news tickers alongside war coverage and election results. Tokenized assets trade on regulated exchanges.

At the same time, AI agents are beginning to read and write blockchain data autonomously, and developers increasingly build through AI coding assistants rather than reading documentation line by line.

No single blockchain data provider covers every chain an application may need. No single provider can guarantee uptime. Without a managed orchestration layer, every team builds and maintains its own routing and fallback system. AI agents face the same fragmentation with less tolerance for it.

Uniblock Today

Uniblock operates the managed infrastructure layer between blockchain applications and the 55 data partners they depend on. One API key provides access to over 300 blockchains and more than 3,000 APIs, with patented auto-routing that handles provider selection, failover, and data normalization. Over 3,000 projects and 4,000 developers run on the platform. Customers including Plume Network, Stellar Blockchain, Hypernative, Oku Trade, nReach, and Apechain run production workloads. Plume Network and Apechain run Uniblock as managed RPC infrastructure through ecosystem partnerships.

AI-driven API consumption is a growing segment on the platform. It accelerates Uniblock’s own development, powers the product’s intelligent routing engine, and represents a new category of infrastructure consumer.

AI-Native Developer Tools

Alongside the raise, Uniblock has shipped a suite of AI-native developer tools designed for how blockchain development happens today:

  • MCP Server. AI agents call Uniblock’s unified APIs directly with no humans in the loop. Live at a public endpoint.
  • LLM-Optimized Documentation (llms.txt). Structured API reference built for AI consumption. When a developer’s AI assistant queries Uniblock integration details, the answer is accurate.
  • Agent Skills. Ready-to-paste context for Claude, Codex, Cursor, and other AI coding environments. Developers drop these into their IDE so the AI writes correct Uniblock integration code on the first attempt.

“Two shifts are happening at once. Mainstream companies are bringing production workloads to blockchain, and AI agents are starting to read and write chain data autonomously. Both need the same thing: reliable infrastructure across hundreds of chains. That’s what Uniblock runs.”
Kevin Callahan, CEO and Co-Founder, Uniblock

“The next wave of blockchain adoption will depend on infrastructure that simplifies an increasingly complex ecosystem while maintaining dependable performance. Uniblock is building exactly that through a single API layer that simplifies multi-chain access for developers, enterprises, and AI-driven applications, and we are pleased to support the team as it enters this next phase of growth.”
Eiichiro So, CEO & Managing Director of SBI Ven Capital

“Stripe bought Bridge for $1.1B. Visa is embracing onchain. AI agents are transacting autonomously. All of them need reliable multi-chain infrastructure. Uniblock built it. 3,000 projects already run on the platform and that number only grows from here.”
Aly Madhavji, Managing Partner, Blockchain Founders Fund

Use of Funds

Capital will accelerate platform expansion: deepening chain coverage, scaling the intelligent orchestration engine, and building new API categories including stablecoins, wallets, and prediction markets. Investment continues in AI developer tooling, enterprise go-to-market, and ecosystem partnerships across the US, Japan, India, Singapore, and the Solana ecosystem. The team is scaling engineering and operations from its Canadian headquarters.

About Uniblock

Uniblock is the managed infrastructure layer for blockchain applications. A single API connection provides access to 300+ blockchains and 55 data partners through patented auto-routing with intelligent orchestration. AI-native developer tools, including an MCP server, LLM-optimized documentation, and Agent Skills, are live and in production. 3,000 projects and 4,000 developers run on the platform. Headquartered in Canada. Visit uniblock.dev.

STARTRADER Launches Web STAR Copy to Expand Social Trading Capabilities 910

New website feature empowers traders with greater control, flexibility, and confidence through strategy sharing and automated trade replication.

STARTRADER has introduced Web STAR Copy, a new web-based feature designed to simplify access to copy trading and enable more structured participation in financial markets. The feature allows traders to follow and copy strategies from experienced participants, improving execution consistency and overall trading efficiency.

As demand for social and copy trading grows among retail traders, Web STAR Copy offers a more structured way to participate, allowing users to create a dedicated account via the STARTRADER Client Portal and choose to act as either a Signal Provider or a Copier.

Experienced traders can monetize their strategies, while Copiers can follow proven approaches and trade with less reliance on manual execution.

The feature is built to enhance transparency and confidence. Strategy pages provide clear visibility into key performance metrics, including returns, trading activity, and the number of active Copiers, enabling users to evaluate strategies based on real data and make more informed choices.

Web STAR Copy also gives traders greater flexibility in how they participate. Copiers can tailor how trades are copied according to their individual preferences, while integrated risk management settings help control exposure and protect capital in changing market conditions.

In addition, users benefit from full visibility and control over their trading activity, including real-time positions, transaction history, and profit-sharing summaries. Flexible management options allow traders to adjust their participation at any time, ensuring a more responsive and controlled trading experience.

“Web STAR Copy reflects our focus on building a more connected trading ecosystem, where transparency and trust support long-term participation. We are continuously evolving our offering to give traders the confidence to engage with the markets in a more structured and reliable way.” — Peter Karsten, Chief Executive Officer, STARTRADER

The introduction of Web STAR Copy reflects STARTRADER’s ongoing commitment to enhancing its digital trading ecosystem by developing features that support collaboration, strategy sharing, and flexible participation for traders worldwide.

About STARTRADER

STARTRADER is a global broker that provides its clients with opportunities to trade financial instruments online. STARTRADER serves both Partners and Retail Clients, who can trade using the MetaTrader Platform, the STAR-APP, and STAR-COPY.

As a global broker, STARTRADER holds a client-first approach as its core principle. Regulated in 5 jurisdictions (ASIC, FSA, FSC, FSCA, and CMA), STARTRADER upholds strong governance and sustainable growth. STARTRADER’s team comprises dedicated professionals working collaboratively to deliver quality service to its Partners and Clients.

TradFi-DeFi Convergence Accelerates as Real-World Asset Tokenization Gains Institutional Momentum 1650

I-ON Digital, Instruxi and RAAC partnership illustrates emerging infrastructure linking gold-backed assets, stablecoins, and on-chain liquidity markets

The convergence of traditional finance (“TradFi”) and decentralized finance (“DeFi”) is moving from concept to implementation, as real-world asset (RWA) tokenization begins to establish a new foundation for global capital markets.

For small-cap investors and institutional observers alike, this shift represents a critical inflection point: the emergence of infrastructure capable of connecting regulated, asset-backed financial systems with blockchain-based liquidity and settlement networks.

From Fragmentation to Integration

Historically, TradFi and DeFi have operated in parallel:

  • TradFi offers regulatory structure, institutional trust, and deep capital markets
  • DeFi delivers programmability, continuous liquidity, and capital efficiency

Bridging these systems has remained a central challenge until the recent rise of tokenized RWAs, which allow tangible assets to be represented, financed, and deployed on-chain.

Market participants increasingly view RWA tokenization as one of the most significant growth vectors in digital finance, with long-term projections ranging into the hundreds of billions, and potentially trillions, of dollars.

Infrastructure in Practice: I-ON Digital and RAAC.io

A growing number of platforms are now moving beyond theory, building integrated systems that connect asset origination, stablecoin issuance, and decentralized liquidity.

I-ON Digital Corp., in partnership with Instruxi (https://www.instruxi.io/) RAAC (https://raac.io), provides a case study in how this convergence is being operationalized.

At the core of this model:

  • Digitized Gold-Backed Assets (IONau): Real-world gold exposure is structured into a blockchain-compatible financial instrument designed to align with traditional secured asset frameworks.
  • Stablecoin Layer (pmUSD): These assets support the issuance of pmUSD, a stablecoin engineered to maintain stability through structured collateralization tied to underlying real-world value.
  • Liquidity Infrastructure: pmUSD is deployed across established decentralized finance protocols and liquidity pools, enabling yield generation, market depth, and continuous capital deployment.

This vertically integrated approach, linking asset backing, issuance, and liquidity, addresses one of the primary limitations of earlier digital asset models: the disconnect between real-world value and on-chain utility.

The Role of Liquidity: From Concept to Market Depth

A defining feature of the next phase of digital finance is not simply tokenization, but liquidity at scale.

Deep, programmatic liquidity pools surrounding instruments like pmUSD are critical for:

  • Efficient price discovery
  • Scalable yield generation
  • Institutional-grade entry and exit pathways
  • Reduced volatility through structured collateral frameworks

By establishing liquidity infrastructure alongside asset issuance, platforms can move beyond static token models toward dynamic financial ecosystems capable of supporting meaningful capital flows.

Why It Matters for Small-Cap Investors

For investors focused on emerging growth sectors, the TradFi-to-DeFi bridge represents a foundational shift comparable to the early development of electronic trading or exchange-traded funds.

Key considerations include:

  • Early Infrastructure Positioning: Companies building compliant, scalable rails may capture disproportionate value as adoption accelerates
  • Institutional Tailwinds: Evolving regulatory clarity around stablecoins and digital assets is lowering barriers to institutional participation
  • Expanded Addressable Markets: Tokenization introduces liquidity and accessibility to asset classes historically constrained by geography or structure
  • Compounding Network Effects: Integrated ecosystems—combining asset backing, stablecoins, and liquidity—can scale rapidly as usage increases

A Structural Shift in Capital Markets

The integration of TradFi and DeFi is increasingly being viewed not as a replacement of existing systems, but as an extension that enhances efficiency, transparency, and capital mobility.

As real-world assets move on-chain and liquidity infrastructure matures, the ability to seamlessly connect regulated financial assets with decentralized markets may define the next generation of financial leaders.

About I-ON Digital Corp.

I-ON Digital Corp. is a U.S.-based digital asset infrastructure company focused on real-world-asset tokenization, regulated gold-backed digital instruments, and digital asset banking services. The Company’s platform enables institutions to digitize, tokenize, manage, and distribute physical and in-situ assets within compliant, treasury-grade frameworks.