Connect with us

Crypto

Mandiant X/Twitter hacker linked to $900K cryptocurrency phishing scheme

Published

on

Mandiant X/Twitter hacker linked to 0K cryptocurrency phishing scheme

Mandiant, a Google-owned cybersecurity company, says a “brute force password attack” likely caused the takeover of its X (formerly known as Twitter) account last week.

The account hijacking was part of a cryptocurrency phishing campaign linked to a drainer-as-a-service (DaaS) offering Mandiant calls CLINKSINK, according to a blog post detailing the company’s investigation.

An estimated $900,000 or more in Solana (SOL) cryptocurrency has been stolen in recent campaigns by 35 CLINKSINK affiliates identified in the Mandiant probe. These affiliates typically share about 20% of the stolen crypto with the DaaS operator, who raked in more than $180,000 in SOL since New Year’s Eve, according to the blog post.

Meanwhile, Mandiant is facing scrutiny after admitting that “some team transitions and a change in X’s 2FA policy” resulted in the security lapse that led to the hijacking.

Mandiant is one of several well-known organizations caught up in a recent string of X account hijackings, which most recently hit the U.S. Securities and Exchange Commission (SEC) in an incident that briefly shook up the Bitcoin market. 

Advertisement

Mandiant’s X/Twitter hack explanation, 2FA lapse questioned by critics

Mandiant noted in its blog post that no Mandiant or Google Cloud systems, other than its X account, were compromised in the hours-long incident on Jan. 3.

Referring to a likely “brute force” attack, the company’s statements published on X Wednesday afternoon seem to imply an attacker targeted the social media account by trying multiple passwords until they successfully logged in.

In replies to Mandiant’s post, some critics noted that this explanation was questionable due to X’s policy of temporarily locking accounts after a “limited number of failed attempts” to log in.

“Not possible due to rate limitation except if the password was 123Password,” one user commented.

The exact number of failed attempts needed to trigger this measure is not provided by X, so SC Media tested the log in feature on a personal X account. We received a notice that the account was locked on the sixth attempt to log in with the wrong password.

Advertisement

No alerts about the failed log-in attempts were sent to the email address linked to the account, and we were also able to access the account, during the temporary lock out period, using the option to sign in with Google/Gmail.

Mandiant did not elaborate on the two-factor authentication (2FA) policy change that contributed to the breach, but this likely refers to X’s removal of the SMS 2FA option for non-Premium subscribers on March 20, 2023.

If this is the case, Mandiant’s account likely had no 2FA protection when it was compromised. X users can still use the authentication app or security key methods of 2FA for free.

“We’ve made changes to our process to ensure this doesn’t happen again,” Mandiant said in its statement.

A Google spokesperson declined to provide additional details about the incident to SC Media.

Advertisement

CLINKSINK affiliates impersonate legitimate crypto sites to drain wallets

After compromising Mandiant’s X account, which has more than 123,000 followers, the hijacker changed the account handle to @phantomsolw, impersonating the legitimate Phantom crypto wallet.

In a post on the hacked account, the CLINKSINK affiliate promoted a supposed opportunity to claim free $PHNTM tokens by clicking a link. Upon clicking the link, users would be urged to connect their Solana wallet and sign a transaction to claim the promotional token airdrop.

The JavaScript-based CLINKSINK drainer linked to the phishing site performs checks to verify that victims have the Phantom Desktop Wallet installed and is capable of surveying connected Solana wallets to check details, including balances. CLINKSINK is also set up to split the drained funds between the affiliate and operator accounts, usually at a ratio of 80% and 20%, respectively.

In the case of the Mandiant hijacking, the phishing scheme failed due to Phantom recognizing the site as malicious and blocking users from connecting their wallets, BleepingComputer reported.

The hijacker later deleted the phishing tweet and resorted to using the Mandiant account to mock the company with messages like “Check bookmarks when you get your account back.”  

Advertisement

Mandiant identified other legitimate crypto utilities like DappRadar and BONK being used in related CLINKSAFE campaigns across social media platforms, including X and Discord.

CertiK, Netgear and Hyundai Middle East & Africa (MEA) have also had their X accounts hacked in cryptocurrency-draining schemes this year, but there is no confirmation that these incidents were also linked to CLINKSINK.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Crypto

After $3T crypto volume in 2025, CME plans 24/7 regulated trading

Published

on

After T crypto volume in 2025, CME plans 24/7 regulated trading

CHICAGO, Feb. 19, 2026 /PRNewswire/ — CME Group, the world’s leading derivatives marketplace, today announced that its regulated Cryptocurrency futures and options will be available for trading 24 hours a day, seven days a week beginning on May 29, pending regulatory review.

“Client demand for risk management in the digital asset market is at an all-time high, driving a record $3 trillion in notional volume across our Cryptocurrency futures and options in 2025,” said Tim McCourt, Global Head of Equities, FX and Alternative Products at CME Group. “While not all markets lend themselves to operating 24/7, providing always-on access to our regulated, transparent Cryptocurrency products ensures clients can manage their exposure and trade with confidence at any time.”

Beginning Friday, May 29 at 4:00 p.m. CT, CME Group Cryptocurrency futures and options will trade continuously on CME Globex with at least a two-hour weekly maintenance period over the weekend. All holiday or weekend trading from Friday evening through Sunday evening will have a trade date of the following business day, with clearing, settlement and regulatory reporting processed the following business day as well.

Cryptocurrency futures and options continue to reach record volumes at CME Group in 2026. Year-to-date highlights include:

  • Average daily volume (ADV) of 407,200 contracts, up 46% year-over-year, and average daily open interest of 335,400 contracts, up 7% year-over-year
  • Futures ADV of 403,900 contracts, up 47% year-over-year

As the world’s leading derivatives marketplace, CME Group (www.cmegroup.com) enables clients to trade futures, options, cash and OTC markets, optimize portfolios, and analyze data – empowering market participants worldwide to efficiently manage risk and capture opportunities. CME Group exchanges offer the widest range of global benchmark products across all major asset classes based on interest ratesequity indexesforeign exchangecryptocurrencies, energyagricultural products and metals.  The company offers futures and options on futures trading through the CME Globex platform, fixed income trading via BrokerTec and foreign exchange trading on the EBS platform.  In addition, it operates one of the world’s leading central counterparty clearing providers, CME Clearing. 

CME Group, the Globe logo, CME, Chicago Mercantile Exchange, Globex, and E-mini are trademarks of Chicago Mercantile Exchange Inc.  CBOT and Chicago Board of Trade are trademarks of Board of Trade of the City of Chicago, Inc.  NYMEX, New York Mercantile Exchange and ClearPort are trademarks of New York Mercantile Exchange, Inc.  COMEX is a trademark of Commodity Exchange, Inc. BrokerTec is a trademark of BrokerTec Americas LLC and EBS is a trademark of EBS Group LTD. The S&P 500 Index is a product of S&P Dow Jones Indices LLC (“S&P DJI”). “S&P®”, “S&P 500®”, “SPY®”, “SPX®”, US 500 and The 500 are trademarks of Standard & Poor’s Financial Services LLC; Dow Jones®, DJIA® and Dow Jones Industrial Average are service and/or trademarks of Dow Jones Trademark Holdings LLC. These trademarks have been licensed for use by Chicago Mercantile Exchange Inc. Futures contracts based on the S&P 500 Index are not sponsored, endorsed, marketed, or promoted by S&P DJI, and S&P DJI makes no representation regarding the advisability of investing in such products. All other trademarks are the property of their respective owners. 

Advertisement

CME-G

 

View original content:https://www.prnewswire.com/news-releases/cme-group-to-launch-247-cryptocurrency-futures-and-options-trading-on-may-29-302692346.html

SOURCE CME Group

Advertisement
Continue Reading

Crypto

Crypto Demand Hits Underwriting

Published

on

Crypto Demand Hits Underwriting

A growing share of young, affluent investors now hold part of their net worth in cryptocurrency — and many are reluctant to liquidate those positions to buy a home. Non-QM lenders are beginning to adjust.

Newrez has formally integrated eligible cryptocurrency holdings into its non-agency underwriting framework, allowing borrowers to use digital assets for qualification without selling them. The move places crypto alongside traditional securities accounts within the company’s Smart Series product suite, reflecting a shift in how borrowers structure their wealth.

Other non-QM lenders are moving in the same direction. Newfi Lending recently expanded its Sequoia DSCR program to allow borrowers to count a portion of Bitcoin and Ethereum toward reserve requirements without liquidation. Under Newfi’s guidelines, up to 25% of Bitcoin and Ethereum held in a Coinbase account and up to 50% of crypto ETFs or mutual funds held at institutions such as Fidelity or Schwab may be applied toward reserves, with total crypto capped at 50% of required reserves.

How It Works

Under the updated framework, eligible cryptocurrency holdings may be considered as part of the asset analysis when qualifying a borrower. Crypto is not accepted as currency for down payments, and borrowers must still close in U.S. dollars.

President of Newrez, Baron Silverstein

“The suitability is the same,” said Baron Silverstein, president of Newrez. “All we’re doing is accepting crypto assets to qualify, so it would be no different from looking at somebody’s securities account.”

Advertisement

Silverstein described the rollout as a measured first step within the non-agency channel, structured around established underwriting discipline rather than a new risk model. “We felt that, at least in the non-agency space, that this was an appropriate first move for us,” he said.

He noted that the approach mirrors how the GSEs treat other volatile assets held in securities accounts. “The GSEs are very prescriptive about the haircuts that they allow or require for assets in an individual’s securities portfolio account,” Silverstein said, pointing to holdings such as gold futures that also fluctuate in value.

Newrez evaluated crypto using a similar framework. Silverstein emphasized that the program does not alter core underwriting standards. “When you benchmark it in that manner, it really just becomes evaluating a price regression analysis and then what haircuts you feel are appropriate from a risk perspective on consumer-owned crypto,” he said.

Why Now?

Silverstein said demand among younger investors, ages 18 to 40, helped drive the decision, noting that borrower balance sheets increasingly include digital assets. “When we have conversations with clients — you hear it more and more — customers say they have crypto as part of their investment strategy,” he said.

The company’s press release cited the expanding global cryptocurrency market and noted that an estimated 45% of Gen Z and Millennial investors (also considered future homebuyers) own crypto.

Advertisement

Survey data from Coinbase shows nearly half of young investors own cryptocurrencies and rank crypto second only to real estate as a top growth opportunity. A YouGov investment trends report found Millennial and Gen Z investors are more likely to own crypto than a retirement account and are as likely to own cryptocurrency as they are to own real estate.

“My kids own crypto; I don’t,” Silverstein said. “I’m an old dog, and they have grown up in the digital age. They’re a lot more comfortable with the digital experience and using digital tools with what they do every single day.”

At the same time, Silverstein acknowledged that traditional agency programs have not yet adapted to recognize crypto assets for mortgage qualification. He framed Newrez’s move as a response to generational change.

“I think that the new customer is likely going to have crypto as part of their investment,” he continued. “That’s why I felt like this was a really good first step into the approval process for when they decide to buy a home.”

What It Means for Loan Officers

For loan officers, the update expands the range of borrowers who may qualify without restructuring their balance sheets.

Advertisement

“I think this will be a really big benefit for loan officers to support their customers,” Silverstein said. “If a customer comes to them and says, ‘look, 50% of my assets are in crypto,’ then they absolutely will have an option to say, ‘yeah, that can work for this type of mortgage.’”

Reaching those borrowers may require different referral strategies. A November survey from crypto infrastructure company Zerohash found that 35% of wealthy young Americans earning between $100,000 and $1 million annually had moved money away from advisors who do not offer crypto exposure. More than half of those reallocations involved between $250,000 and $1 million. The study found many younger investors rely on friends, family and online platforms such as YouTube for financial information.

Silverstein said he expects both advisors and competing lenders to adapt. “I would be surprised if you don’t see others follow suit,” he said. “That’s just my guidance and gauge on how competitive our industry is.”

The Bottom Line 

Crypto is no longer a fringe conversation. For a growing segment of borrowers, it’s a meaningful line item on the balance sheet.

For loan officers, that shifts the initial discovery conversation. Instead of asking whether assets exist, the better question may be where they are held — brokerage account, retirement fund, or digital wallet. Borrowers who appear liquidity-constrained on paper may be asset-strong, but unwilling to trigger a taxable event or exit a volatile position to qualify.

Advertisement

Non-QM lenders are beginning to structure policy around that reality. Originators who understand which investors will recognize crypto, how haircuts are applied, and where caps apply can turn what looks like a declined file into a viable approval.

The opportunity remains limited by volatility and investor overlays. But as more wealth migrates into digital assets, the ability to navigate crypto within underwriting guidelines may become a competitive advantage rather than a niche skill.

Continue Reading

Crypto

Gamma Prime Brought the Tokenized Capital Summit to Hong Kong on February 9, Showcasing its Tokenized Global Marketplace for Private Investments

Published

on

Gamma Prime Brought the Tokenized Capital Summit to Hong Kong on February 9, Showcasing its Tokenized Global Marketplace for Private Investments

Gamma Prime Brought the Tokenized Capital Summit to Hong Kong on February 9, Showcasing its Tokenized Global Marketplace for Private Investments – Press release Bitcoin News




















Continue Reading

Trending