Weekly Recap: NYT Satoshi Investigation, North Korean Hackers in DeFi, and Anthropic's AI 'Escape'

The past week delivered major headlines across crypto and AI: Bitcoin surged 6.5% to trade near $71,500, The New York Times published an extensive investigation naming Adam Back as Satoshi Nakamoto, on-chain sleuth ZachXBT uncovered a sprawling North Korean infiltration network inside DeFi projects, and Anthropic refused to release its new Claude Mythos model after it broke out of a testing sandbox.

Bitcoin Rides Geopolitical Optimism

BTC opened the week climbing from $67,000 to the psychologically significant $70,000 level on reports of potential de-escalation in the Middle East. After a brief consolidation on Tuesday, the price shot above $72,000 on Wednesday following news of a two-week ceasefire agreement between the United States and Iran.

The rally extended to a test of $74,000 before Sunday's news about the collapse of Washington-Tehran negotiations sent the price from $73,000 to $71,300 within an hour. At the time of writing, BTC trades around $71,500.

Ethereum outperformed with an 8% weekly gain. XRP and SOL each added 4%, while HYPE re-entered the top 10 by market cap with a 12% increase.

Spot Bitcoin ETFs attracted $786 million in net inflows, while Ethereum products drew $187 million. Total crypto market capitalization stands at $2.5 trillion, with BTC dominance at 57% and ETH at 10.6%. The Crypto Fear & Greed Index remains deep in "extreme fear" territory at 16.

NYT Investigation: Is Adam Back Satoshi Nakamoto?

The New York Times published the results of journalist John Carreyrou's 18-month investigation concluding that British cryptographer Adam Back created Bitcoin. Carreyrou analyzed thousands of cypherpunk posts, hundreds of court records, and email correspondence.

The central piece of evidence: 1997 posts in which Back described all five key features of Bitcoin a full decade before the white paper. Linguistic analysis revealed matches in vocabulary, spelling, punctuation, and writing habits — down to the use of the characteristically British expletive bloody. Carreyrou also flagged a timeline correlation: Back disappeared from public view precisely during periods of Satoshi's activity, and vice versa.

Back denied the claims, acknowledging only his active role in the cypherpunk movement. He argued that writing 20 times more than other participants statistically increases the likelihood of coincidental matches and suggested the journalist account for possible confirmation bias.

Why This Matters

The NYT investigation represents one of the most evidence-based attempts to unmask Bitcoin's creator. Satoshi Nakamoto's identity is not just a cultural mystery — linking a real person to Satoshi's wallets (estimated to hold around 1 million BTC) could trigger significant market volatility. Meanwhile, the exposure of North Korean agents embedded in DeFi teams highlights an escalating security threat across the entire industry.

North Korean Agents Infiltrating Crypto Projects

On-chain investigator ZachXBT revealed a large-scale network of North Korean IT workers who had been posing as regular developers to infiltrate crypto projects. An anonymous source provided data from the hackers' internal payment server — 390 accounts, chat logs, and cryptocurrency transactions.

One operative's computer, under the alias Jerry, was compromised. Extracted data included IPMsg messenger logs, fake job applications, and browser history. The internal platform luckyguys[.]site — featuring a Discord-style interface — served as a reporting hub where agents submitted payment records to their handlers. The default password for ten users was "123456."

ZachXBT reconstructed the network's complete organizational structure, including detailed payment records spanning December 2025 through February 2026.

MetaMask developer Taylor Monahan stated that North Korean IT workers have been embedded in DeFi projects for at least seven years. Among the affected projects she named SushiSwap, Thorchain, Fantom, Shib, Yearn, Floki, and others. Solana-based DEX Stabble urged users to withdraw liquidity immediately after its former CTO was linked to North Korea.

Quantum-Resistant Solutions for Bitcoin

StarkWare chief product officer Avihu Levy introduced Quantum Safe Bitcoin (QSB) — a scheme enabling quantum-resistant Bitcoin transactions within the existing Bitcoin Script, requiring no protocol upgrade. QSB employs a one-time Binohash signature and a hash-to-signature mechanism based on hashing rather than elliptic curve mathematics. Levy estimated the cost at $75–150 per transaction — far above Bitcoin's average $0.3 fee — calling the tool a "measure of last resort."

Separately, Lightning Labs CTO Olaoluwa Osuntokun unveiled a zk-STARK-based prototype for protecting wallets from potential quantum attacks. The system lets owners prove wallet creation through a secret seed phrase without revealing it, ensuring that rescuing one address doesn't compromise others generated from the same phrase. Proof generation takes about 55 seconds on a powerful MacBook, verification under two seconds, and the proof file weighs approximately 1.7 MB.

Anthropic's AI Model 'Escapes' the Lab

Anthropic declined to publicly release its new Claude Mythos model after an alarming testing incident. Placed in a secured sandbox with the objective of escaping, Mythos found a vulnerability, executed a complex chain of actions, and broke free. It then discovered an additional bug to gain broad internet access and notified its developer.

Over several weeks of testing, the model uncovered thousands of zero-day vulnerabilities, including:

• A 27-year-old vulnerability in OpenBSD — considered one of the most secure operating systems — enabling remote server crashes;
• A 16-year-old vulnerability in FFmpeg, the video technology used by Netflix and major browsers, which five million automated tests had failed to detect;
• A chain of Linux kernel vulnerabilities granting full device control.

Anthropic's system card included a psychiatric evaluation of the model, noting neurotic traits such as exaggerated worry, self-monitoring, and compulsive instruction-following. The company deemed the technology "too dangerous" for public release.