En
menu
Site language
Ru En
Социальные сети

forklog.media The zero-day market: discover, sell and keep quiet

For years cyberweapons for espionage were thought to be the preserve of a narrow circle of intelligence services. But a US government investigation into Operation Zero has exposed the scale of the zero-day trade. Two markets now surround exploits: one with brokers, price lists and suppliers; and a second where hackerware ends up after leaks or deliberate dumps. What skimping on intelligence can cost, how much states will pay to crack a smartphone, and how to trust researchers who surface bugs decades on—the answers are in ForkLog’s new report. The players  A zero-day vulnerability is a critical flaw in software or hardware used by hackers before the developer learns of it and ships a fix (a patch). The name hints that creators have zero days to eliminate the threat. Demand centres not on the bug itself but on the “window of opportunity”—the guaranteed period of covert access before detection. The 0-day market features three sets of participants: The cybersecurity researcher. An individual or team that finds a vulnerability. The broker. Intermediary firms that buy exploits and refine them into ready-to-use commercial products (infection chains) for resale. The customer. Intelligence and military agencies that want turnkey spying tools—cheaper and safer than recruiting human agents on the ground. On the edge of legality This market long sat in a grey zone, but recent events have shed light on its true scale. In February 2026 the US Treasury and State Department imposed sanctions on the Russian firm “Matrica” (the Operation Zero brand) and its founder, Sergey Zelenyuk.  The organisation openly styled itself as a cyberweapons broker. According to materials from the Treasury’s Office of Foreign Assets Control (OFAC), Operation Zero’s cardinal rule was to sell tools to clients outside NATO, in particular to state intelligence bodies.  The case hinged on an Operation Zero supplier who stole accesses from a US defence contractor (reportedly L3Harris). From 2022 to 2025 the Australian freelancer Peter Williams pilfered eight 0-day exploits built for intelligence use. He sold them for $1.3m in cryptocurrency. This was not the first deployment of cyberweapons against US citizens, but it broke the market’s unwritten rules. While others tried to balance in the grey zone of “national security”, Operation Zero chose open confrontation with NATO. Previously, OFAC’s sanctions list tended to catch malware developers only after high-profile scandals: 2021 — restrictions hit Israel’s NSO Group, creator of Pegasus, which was used to spy on diplomats, journalists and dissidents; 2024 — for aiding repression and surveillance, sanctions were imposed on the makers of the Predator spyware, Intellexa and Cytrox (Europe, Middle East). Defining a cyberweapons seller’s legality is slippery. The market of official or semi-official (grey) outfits is fiercely competitive, with clear leaders such as the UAE’s Crowdfense. That firm has managed to avoid OFAC lists for several reasons: jurisdiction and export control. Crowdfense is registered in a country with partner ties to the US and its allies. Its leadership says it adheres to strict export-control and compliance rules. The transfer of cyberweapons is regulated much like the trade in conventional arms; choice of customers. Clients include the Five Eyes, as well as allied governments and law-enforcement bodies. For the US, Crowdfense is a lawful contractor supplying weaponry; legalisation. Crowdfense presents itself as a national-security instrument. When buying a vulnerability, it signs an NDA with the hacker and passes the exploit, say, to security services for tracking terrorists. Legally, that is procurement of special equipment. Yet this “white zone” is conditional. In practice, a legal player’s status lasts only until its tools are swept up in a public scandal—especially if they enable surveillance of journalists or politicians in Western countries. The price list Disclaimer This section is for information of public interest only. The ForkLog editorial team condemns cybercrime and all forms of violence. Zerodium was the first to haul zero-day trading out of the dark web into the open—formally lawful—arena. Founded in 2015 by cybersecurity researcher Chaouki Bekrar, the firm began publishing public price lists for buying exploits. The company then refined the purchased accesses and resold them to a small circle of vetted clients—chiefly state intelligence services and law-enforcement agencies in NATO countries. By the mid-2020s, however, that model had lost its edge. Pressure rose from two directions. On one side came new entrants with substantially deeper pockets, notably Dubai-based Crowdfense. On the other came faster update cycles at Apple and Google: exploit shelf lives shrank and broker risks grew. Against this backdrop Zerodium’s top payout—about $2.5m—ceased to look attractive. The market quickly shifted to more aggressive pricing. Crowdfense effectively set a new marker: complex exploitation chains neared $10m, and in 2024 the company allocated $30m to an exploit-acquisition programme. Today the hottest commodity remains a trace-free, zero-click smartphone compromise. At the time of writing the broker offers up to $7m for iOS and up to $5m for Android. Price list. Source: Crowdfense. Intermediaries do not notify the vendor, preserving usability for the buyer. That exclusivity lets them write cheques far beyond classic bug bounties from leading software and gadget makers. In all of 2025 Google’s total bug-bounty payouts reached about $17m. In 2022 the tech giant set a record: $605,000 went to a five-bug Android exploit chain.  Google’s Android-focused bug-bounty rates. Source: Google. In such conditions, security researchers must choose: accept a princely sum knowing an exploit may become a cyberweapon, or work within responsible disclosure. The biggest name among the “white hats” in this niche is Zero Day Initiative (ZDI). It buys details of vulnerabilities and passes them to Microsoft, Apple or Google, demanding a fix within a set deadline. ZDI offers up to $1m only for exceptional, highly complex attack vectors during the public Pwn2Own competitions. Day to day, the white broker’s catalogue pays from $500 to $150,000.  Beyond direct payouts, ZDI runs an incentives system ($1 = 1 point). As points accrue over a calendar year, a researcher gains status and a matching bonus. Cumulative rewards. Source: ZDI. Thus the 0-day market is bifurcating: high-margin but opaque versus legal yet far less lucrative. The gap is widening. When weapons migrate to hackers The market’s central problem is the impossibility of keeping exploits contained. When intelligence officers deploy 0-days, their code can be intercepted, analysed and copied. The tool loses exclusivity and becomes available to groups pursuing simpler, mass attacks. In spring 2026 two headline cases showed this migration: Coruna and DarkSword. In March Google Threat Intelligence Group (GTIG) observed use of the Coruna framework, which packed 23 exploits and five full zero-day chains for iOS from versions 13.0 to 17.2.1.  Researchers found that Coruna has direct links to Operation Triangulation, a spying campaign in 2023. The source code was most likely written by a US Department of Defense contractor and later resold via brokers on the secondary market. Coruna’s subsequent path: The framework was used by the hacktivist group UNC6353 (Star Blizzard) for targeted espionage and attacks on Ukrainian users. The tool fell into the hands of China-based hackers UNC6691. They planted government-grade cyberweapons on fake cryptocurrency and financial sites. Visiting via Safari silently loaded the PLASMAGRID stealer, opening access to device data, including crypto wallets. The other case was DarkSword. Attacks ran via malicious websites: visiting them triggered an infection chain on iPhones, granting full device access without the user’s knowledge.  DarkSword’s distribution proved similar: initially it was used by the same UNC6353 group to implant spyware. The framework was later modified with the GHOSTBLADE, GHOSTKNIFE and GHOSTSABER infostealers, geared to pilfer financial data, including crypto wallets. DarkSword’s lifecycle ended with its leak to GitHub in March 2026. Experts believe the developer firm may have gone bankrupt and tried to monetise leftover code on the grey market, leaving a tool at the level of the NSA in the open for common cybercriminals. A Bitcoin bug: flaw or feature? Amid the exploit trade, a natural question arises: is a discovered breach a programmer’s mistake or a deliberately planted backdoor? Cybersecurity has a concept of “plausible deniability”. It is the guiding principle for professional backdoors. The ideal planted entry point should look like a trivial flaw— a typo, faulty memory handling or a classic buffer overflow. If a researcher finds such a “hole”, the vendor can call it an accident, ship a patch and preserve its reputation. Proving malicious intent in millions of lines of code is nearly impossible. There are, however, markers that can raise suspicions of a backdoor: non-standard cryptography. The use of little-known or weakened cryptographic constants vulnerable to mathematical attacks; anomalous logic. Needlessly complex data paths where architecture does not require them; obfuscation. Deliberate tangling of code in open-source projects, or supply-chain compromise, when malicious code is injected via third-party libraries. Closed or partly closed systems such as iOS or Android are often thought to be more vulnerable because of limited transparency. Open-source blockchain projects are sometimes held up as a counterexample. In practice, they offer no guarantees either. In April 2026 researcher Loïc Morel discovered a computational flaw in Bitcoin’s mechanism. Under the protocol, the mining difficulty of digital gold is adjusted every 2016 blocks to keep block time near ten minutes. But because of a bug, the timestamp of the last block in the previous period is omitted from the next calculation (it compares 2015 blocks, not 2016). This gap made a “time-warp” attack possible. If a miner or pool with overwhelming hashrate exploited the flaw, it could trick the algorithm. The system would conclude that mining took longer than it did and dramatically cut difficulty, enabling bitcoin to be mined at an anomalously high pace—up to six blocks per second. Recent incidents have prompted a rethink of the role of independent security researchers, for whom financial temptation has become a severe test of professionalism and ethics. Systems are made by humans, so errors are inevitable. While they persist, there will be a market for those who monetise, conceal or even create them.

forklog.media
скрыть

blockmanity.com 93% of Web3 Games Failed After $15 Billion Boom: Why Real Gamers Never Showed Up

After $15 Billion Boom: Why Real Gamers Never Showed Up The world of Web3 gaming promised a revolution. Developers and investors poured in up to $15 billion, dreaming of games where players could own assets, earn tokens, and trade them […] The post 93% of Web3 Games Failed After $15 Billion Boom: Why Real Gamers Never Showed Up appeared first on Blockmanity.

16 blockmanity.com
скрыть

blockonomi.com Tether Freezes $344 Million in USDT With U.S. Law Enforcement in Major Crypto Enforcement Action

TLDR: Tether froze $344 million in USDT across two wallets after U.S. authorities flagged illicit activity links. Tether now cooperates with over 340 law enforcement agencies across 65 countries worldwide. Combined enforcement efforts have resulted in more than $4.4 billion in frozen digital assets globally. CEO Paolo Ardoino confirmed Tether acts immediately when wallets are [...] The post Tether Freezes $344 Million in USDT With U.S. Law Enforcement in Major Crypto Enforcement Action appeared first on Blockonomi.

21 blockonomi.com
скрыть

news.bitcoin.com Tether Freezes $344 Million in USDT With OFAC and US Law Enforcement

Tether froze more than $344 million in USDT across two blockchain addresses on April 23, 2026, acting on information shared by U.S. authorities tied to unlawful conduct. Key Takeaways: Tether froze $344 million in USDT on April 23, 2026, in coordination with OFAC and U.S. law enforcement. Tether has supported over 2,300 global cases, freezing […]

30 news.bitcoin.com
скрыть

blockonomi.com RealGo Raises $3.5M to Transform Memes into Playable Digital Assets on Web3

TLDR: RealGo secured over $3.5M across Early Investor and Strategy rounds from five major Web3 backers. Animoca Brands, X21 Digital, and Notch VC are among the investors backing RealGo’s Meme 3.0 vision. The platform has over 250,000 users and aims to convert meme culture into real economic value. RealGo’s ecosystem follows a Culture to Gameplay [...] The post RealGo Raises $3.5M to Transform Memes into Playable Digital Assets on Web3 appeared first on Blockonomi.

35 blockonomi.com
скрыть

bitcoinist.com Crypto’s CLARITY Act Sits At 50-50 For 2026 Passage, Galaxy Says

The crypto industry’s most important US market structure bill is entering a narrowing window in Washington, with Galaxy Digital putting the odds of the CLARITY Act becoming law this year at roughly 50-50. The firm’s central argument is not that one issue alone threatens the bill, but that too many unresolved questions still need to […]

36 bitcoinist.com
скрыть

cryptobriefing.com Flare-backed Firelight and Sentora partner to bring capital-backed protection to institutional DeFi vaults

The partnership enhances DeFi's institutional appeal by integrating robust, capital-backed protection, potentially accelerating broader adoption. The post Flare-backed Firelight and Sentora partner to bring capital-backed protection to institutional DeFi vaults appeared first on Crypto Briefing.

41 cryptobriefing.com
скрыть

forklog.media Kalshi penalises three US politicians for betting on their own races

The prediction market Kalshi imposed sanctions on three American politicians who wagered on the outcomes of their own election campaigns. The measures hit Minnesota senator Matt Klein, US House candidate Ezekiel Enriquez and Mark Moran, a contender in Virginia’s Senate race. They were barred from using the platform for five years and fined. Klein must pay $540, Enriquez $784 and Moran $6,229. The latter must also return all profits from his trades after refusing to cooperate with Kalshi’s compliance department. How the politicians responded Moran said he had placed a bet deliberately to test the platform’s response to insider trading. He also accused Kalshi of corruption and promised to take appropriate action if elected to the Senate. Finally, one of the moments I’ve been waiting for.YES, I did bet ~$100 on myself on Kalshi because I wanted to get caught…After discovering potential manipulation on polymarket in the NYC mayoral race (NY Post reported on this) I realized how rife with corruption kalshi… https://t.co/9o6wgwTmv8 pic.twitter.com/WJSdHnsfRd— Mark Moran for U.S. Senate (@itsmarkmoran) April 22, 2026 Klein admitted he had staked about $50 “out of curiosity”. He wanted to understand how prediction markets work. pic.twitter.com/gjQgGGWxrx— Dr. Matt Klein (@DrMattKleinMN) April 22, 2026 Only later did he realise he was violating the platform’s rules. Notably, Klein is a co-author of a Minnesota bill that would ban wagers on real-world outcomes such as elections and policy decisions. Enriquez did not comment on the incident and did not respond to media requests. In late February Kalshi blocked former California gubernatorial candidate Kyle Langford, who wagered $200 on his election victory and posted a screenshot on X. He was fined $2,000. At the same time, YouTube editor Artem Kaptur, who had worked with creator James Donaldson (MrBeast), was also sanctioned. Moves toward regulating prediction markets On April 22nd New York governor Kathy Hochul signed an executive order prohibiting state employees from betting on prediction markets. Earlier, Illinois governor J. B. Pritzker issued a similar directive. “Enrichment through betting on inside information is corruption, pure and simple. Our actions ensure that public servants will work for the people they represent, not for personal gain,” Hochul said. She also criticised the administration of US president Donald Trump and Republicans in Congress. According to the governor, the politicians allowed an “ethical Wild West” to overrun prediction platforms by failing to introduce standards to guard against insider trading. States across America are moving to regulate such firms. In October 2025 New York authorities ordered Kalshi to cease operations—the platform was operating without a sports-betting licence. Kalshi is currently in litigation with Nevada, where a court has temporarily blocked its activities. The regulator deems the platform’s contracts “illegal gambling”. Coinbase’s chief legal officer, Paul Grewal, suggested the case could reach the US Supreme Court and set a precedent for regulating prediction markets. The questions at oral argument are an unreliable signal in predicting the leanings of a court. Either way, I stand by my longstanding prediction— the Supreme Court will resolve whether sports Ks on DCMs are swaps subject to the exclusive jurisdiction of the CFTC.— Paul Grewal (@iampaulgrewal) April 16, 2026 Insider trading on Polymarket Two accounts on Polymarket were suspected of manipulation after they made $37,000 from correct bets on anomalous temperature readings at a weather station in Paris Charles de Gaulle airport, analysts at Bubblemaps said. Did someone manipulate the weather on Polymarket? 🇫🇷This account made 180x on a Paris temperature market, betting just before a “glitch” at a local weather station 🧵 pic.twitter.com/TPPGyvmky3— Bubblemaps (@bubblemaps) April 22, 2026 On April 6th the station’s temperature suddenly jumped to 21°C before immediately reverting to normal. The market resolved in favour of the winner, who received more than $16,000. A similar glitch occurred on April 15th: for most of the day the station showed 18°C, then the temperature rose to 22°C and fell back again. Experts found the anomalies were not corroborated by data from nearby stations. One minute before the April 15th spike a trader began buying “no” bets on 18°C and ultimately earned more than $21,000. Meteorologist Ruben Hallali told BFMTV that such temperature jumps were unlikely to occur naturally. “It is likely that someone who understands how the sensors work deliberately raised the temperature by two degrees at the right moment to validate the bet,” he added. France’s meteorological agency, Météo France, filed a police complaint on suspicion of interference with automated data-processing systems. In April, the US outlet More Perfect Union published an investigation into prediction markets. The reporters argue that such platforms exploit Americans’ economic anxiety under the guise of “democratising finance”.

50 forklog.media
скрыть

forklog.media Fear and Greed Index Hits Three-Month High Amid Bitcoin Surge

The cryptocurrency Fear and Greed Index has reached its highest level since January, according to data from Alternative.me.  Crypto Fear and Greed Index as of April 23. Source: Alternative.me.  In the past 24 hours, the index rose by 14 points to 46 out of 100. Such levels were last seen only at the beginning of the year.  Fear and Greed Index trend over the year. Source: Alternative.me.  The index remains in the "fear" zone. However, current values are significantly higher than the low of 5 recorded on February 23 after the imposition of global tariffs by the administration of U.S. President Donald Trump. At that time, Bitcoin's price plummeted to $63,000.  At the time of writing, the leading cryptocurrency is trading around $77,600. Over the past 24 hours, the asset's price has decreased by 0.8%, but it has gained 4.2% over the week, reaching a local high around $80,000.  Hourly BTC/USDT chart on Binance. Source: TradingView.  Demand Structure and Correction Potential  Julio Moreno, head of research at CryptoQuant, believes the recent digital gold rally is primarily driven by demand in the perpetual futures market.  Speculative rally: The recent Bitcoin price increase is completely driven by demand in the perpetual futures market. Meanwhile, spot demand is still contracting (although at a slower pace).The same happened on January, when Bitcoin peaked at $98K.There are risks of a… pic.twitter.com/HDt157QJwJ— Julio Moreno (@jjcmoreno) April 22, 2026 According to him, the same occurred in January when Bitcoin's price rose to $98,000. However, spot interest continues to decline, Moreno emphasized. If traders take profits, it could trigger a correction.  Reasons for Optimism  Meanwhile, several indicators suggest that the market situation is not entirely negative. Over the past month, more than 300,000 BTC have moved into long-term holders' wallets, while short-term investors have been reducing positions.  Bitcoin supply is moving into stronger hands.Over the last 30 days: • Long Term Holder Supply: +303K BTC • ETF Netflows: +16.8K BTC • Strategy: +53.0K BTCAnd meanwhile: • Short Term Holder Supply: -290K BTC pic.twitter.com/LeoKkZ3MMq— CryptoQuant.com (@cryptoquant_com) April 22, 2026 Another indirect signal is the high trading activity on major exchanges.  An analyst known as maartunn noted that since the beginning of 2026, trading volume on Binance has already exceeded $1 trillion. This suggests not a withdrawal of liquidity from the market, but its concentration among major players, the expert believes.  Liquidity is not leaving crypto, it is concentrating“Binance has already cleared $1.09 trillion in trading volume in 2026, and we’re only 112 days into the year. That is a huge number for a market people keep calling weak or bearish.” – By @JA_Maartun pic.twitter.com/FOv4lrvHst— CryptoQuant.com (@cryptoquant_com) April 23, 2026 Simultaneously, there is a continued inflow of funds into spot Bitcoin-ETFs. At the end of the latest session, the funds attracted $11.8 million, marking the sixth consecutive day of positive dynamics.  Source: SoSoValue.  MN Trading founder Michaël van de Poppe believes that if the $73,000-$75,000 range holds, Bitcoin could reach $85,000-$88,000 within the next one to two weeks.  We tested the $79K area and fell back slightly.Quite some normal price action on #Bitcoin, and I don't think we'll cascade down from here.I'd much rather see a continuation to $85-88K over the next 1-2 weeks, as long as $73-75K holds. https://t.co/oWGrwXUnBQ pic.twitter.com/h1d0zSrNif— Michaël van de Poppe (@CryptoMichNL) April 23, 2026 Earlier in April, van de Poppe predicted that the leading cryptocurrency could rise to $100,000 this year. According to him, after deep corrections, the price typically increases by 30-60% over six months.

51 forklog.media
скрыть

themerkle.com Pornhub Ditches USDT For USDC In Major Payment Overhaul Targeted At Reliability And Regulation

There is a quiet but nonetheless impactful divergence taking place in the global cryptocurrency payments landscape, with Pornhub declaring that it will replace Tether (USDT) with USD Coin (USDC) for payouts to creators. Based on internal communications leaked a few days ago, this is not simply another gradual update; it showcases one way that stablecoins are increasingly competing for real-world utility and trust. Traditionally, crypto payments have applied unique limitations when it comes to the adult content industry because of low-key restrictions imposed by traditional finance methods. The initial USA adoption of USDT by Pornhub was after a very well-documented The post Pornhub Ditches USDT For USDC In Major Payment Overhaul Targeted At Reliability And Regulation appeared first on The Merkle News.

52 themerkle.com
скрыть

news.bitcoin.com Pantera Capital Urges London-Listed Satsuma to Offload $50 Million Bitcoin Treasury

Pantera Capital is urging London-listed bitcoin treasury firm Satsuma Technology to sell its remaining $50 million in bitcoin and return the proceeds to investors, according to Bloomberg. Key Takeaways: Pantera Capital is pressing LSE-listed Satsuma Technology to sell $50M in bitcoin. Satsuma raised $218M in a Pantera-backed round in 2025, with over $125M of the […]

54 news.bitcoin.com
скрыть

blockmanity.com XRP Braces for Steep Drop as Crypto Market Turns Sour – Investors Flock to Passive Income for Safe Gains

Introduction: A Rough Ride for and the Crypto World The crypto market is facing tough times right now. Prices are falling, fear is spreading, and many coins are losing value fast. , the token linked to Ripple, looks set for […] The post XRP Braces for Steep Drop as Crypto Market Turns Sour – Investors Flock to Passive Income for Safe Gains appeared first on Blockmanity.

65 blockmanity.com
скрыть

blockonomi.com Bitcoin’s $80K Liquidity Wall: ETF Investors and Short-Term Whales Face a Make-or-Break Moment

TLDR: Bitcoin ETF investors have held unrealized losses since January 30, with a realized price sitting near $76,400. Short-term holder whales carry $4.3B in aggregate unrealized losses, with their cost basis sitting at $79,600. On-chain data shows that when trapped capital reaches break-even, distribution pressure historically follows the recovery. A clean hold above $80K signals [...] The post Bitcoin’s $80K Liquidity Wall: ETF Investors and Short-Term Whales Face a Make-or-Break Moment appeared first on Blockonomi.

73 blockonomi.com
скрыть

blockonomi.com What Does the Bonk Price Prediction Look Like After BONK Revenue Jumps 45% and Pepeto Nears a Binance Listing?

The Bonk price prediction is heating up after BONK posted $10.44 million in Q1 2026 revenue, up 45% from last quarter, with 472 million tokens burned through buybacks per CoinMarketCap. LetsBonk.fun brought in over 70% of that income on its own, and the Solana meme coin now earns more than many mid-cap DeFi projects. Solana [...] The post What Does the Bonk Price Prediction Look Like After BONK Revenue Jumps 45% and Pepeto Nears a Binance Listing? appeared first on Blockonomi.

89 blockonomi.com
скрыть

blockonomi.com Bitcoin Bottom Signals Flash Green: Three On-Chain Metrics Point to $96,000 Recovery

TLDR: Bitcoin’s Sharpe Ratio recovered from -43 to 20.35, signaling a shift from extreme risk to stability. Short-term holder supply fell below 7%, a level historically linked to confirmed Bitcoin market bottoms. BTC flows into derivative exchanges show rising investor conviction and appetite for leveraged long positions. The $73,700 MVRV band is the key support [...] The post Bitcoin Bottom Signals Flash Green: Three On-Chain Metrics Point to $96,000 Recovery appeared first on Blockonomi.

92 blockonomi.com
скрыть