GM, frens! ☕️

Perseverance rarely feels impressive while you're living it. Most of the time it just feels like coming back tomorrow, even though today wasn't particularly rewarding. There's nothing glamorous about it, which is why it's so easy to underestimate.

Looking back, though, it's usually the people who simply refused to stop that ended up getting somewhere. Not because they were always right, but because they gave themselves enough chances to be 💜 

Here’s what we’re looking at this week:

• 🪙 BitMEX - from crypto’s derivatives king to shutting down operations

• 🦊 MetaMask hired a suspected spy near core wallet code

• 🔧 CertiK says crypto wrench attacks keep getting worse

• 🤡 The man who drains wallets says his wallet got drained

As always, our Discord is open🤠 

BitMEX - from crypto’s derivatives king to shutting down operations

Before perps became a standard menu item across crypto, BitMEX helped turn leverage into a spectator sport 🏃 

It was one of the places where “100X” trading went from insane behavior to normal market culture which says plenty about this industry - the exchange became a symbol of early crypto derivatives: fast, reckless, influential, impossible to ignore if you were anywhere near the market during its peak 🔨 

Now that chapter is closing. BitMEX has announced that it will shut down operations on September 23, 2026, ending an 11 year run for one of crypto’s most important early trading venues.

Users have been told to close positions and withdraw funds before the shutdown. New account registrations have already been halted, and any open positions left by the deadline will be force closed 🔒️ 

That is the entire problem wrapped in handy trading UI. You may have an account, balances, positions and years of history on a platform, but the exchange itself is still a private company. It can change rules, close markets, block access, halt registrations, force users out or disappear behind a legal notice 📜 

You are not using crypto how it’s supposed to be used - you are renting permission from a company until the company decides the arrangement no longer suits it.

BitMEX had been under pressure for a long time. In 2020, it ran into anti money laundering issues that brought fines, leadership changes and Arthur Hayes leaving the company. More recently, its CEO, CFO and head of growth reportedly resigned within weeks of the shutdown announcement 🤔 

Competition also ate into its market. Binance, Bybit, OKX, Hyperliquid and others took over the derivatives scene BitMEX once helped define 🤷‍♂️ 

BitMEX is not FTX at least, it’s not about a massive collapse with customer funds missing.

But think about it - a fully onchain market does not depend on whether a company still wants to operate the product. DeFi has its own risks, but at least the core design points toward open access rather than corporate permission 🤵 

And that difference becomes painfully obvious every time a centralized exchange hits the end of its story.

BitMEX closing is not just the end of an old exchange. It is another case study in why crypto should stop treating centralized platforms as home base. They are useful doors in and out, maybe. They should never be where the industry lives 🫡 

MetaMask hired a suspected spy near core wallet code

Every serious tech company is supposed to know who it lets near production code. In crypto, that stops being normal corporate hygiene and becomes survival, because one compromised developer can get frighteningly close to wallets, signing flows, user data, internal tooling, and whatever else sits behind the curtain 😐️ 

According to reports, Consensys hired a developer who was later identified as a suspected North Korean mole, and that developer reportedly worked on MetaMask’s core wallet code for about a month before access was cut off 🤪 

Obviously, MM is not some weekend DeFi fork with two anonymous devs, it is one of the default wallets for crypto, used by millions of people who still open it every day (and accept that the UI/UX looks like it was designed during First French Revolution and then preserved as a historical artifact) 🦊 

The developer was reportedly hired by Consensys, MetaMask’s parent company, as a contractor in April. Crypto investigator ZachXBT tipped off a MetaMask developer on May 27, after which the company raised alarms internally and cut access 👇️ 

The person in question was reportedly named Joshua Jack Nobert-Knapp, and allegedly appears on a Lazarus Group linked security page under the name “Mauro Liu” 🤔 

That page also lists past work connected to Web3 game MagicCraft in 2022 and DeFi project Napier Finance in 2023.

The same profile reportedly links him to a long list of other crypto firms too: Ankr, Pickle Finance, Harmoney, Gamerse, Clover Network, DEPO, Sifu Vision, Oxytocin, Tomodachi and Blueberry. The GitHub username tied to him was “fimyugioh” 💻️ 

That is a lot of places for one alleged bad actor to wander through. Either this guy had the busiest crypto resume on earth, or hiring checks across the space are still running on vibes.

Consensys says user funds were not affected. Its general counsel Matt Corva said that the developer was introduced through an existing relationship with a reputable “third party service provider”. The company says it discovered the threat quickly, followed its security process, immediately terminated access and launched an investigation 🤪 

That investigation, according to Consensys, found no misappropriation of assets or data, no malicious code deployed and no impact to user safety or security.

That is why due diligence here cannot be treated like paperwork. Crypto companies love talking about adversarial environments, trust minimization and security assumptions. Then, somehow, a GitHub profile and a recomendation from some IT temp agency turn out to be enough 🤦‍♂️ 

Another example earlier this year, ZachXBT named a suspected North Korean mole who had worked at Solana-based DEX Stabble. After that was revealed, Stabble fired him and encouraged users to withdraw funds. That person, real name Keisuke Watanabe, had reportedly worked there for a full year.

So this is not one incident floating alone in space. It’s part of a pattern: state backed operators allegedly getting into crypto teams by posing as developers, contractors or contributors. They know the industry is remote, fragmented, fast moving and often desperate for technical talent 🥷 

MetaMask catching the issue before funds were stolen is better than the alternative. That part should be said clearly 🙄 

But obviously, users should not have to rely on lucky timing, outside investigators and post hire panic to keep core infrastructure clean.

CertiK says crypto wrench attacks keep getting worse

There is a point where hardware wallets, seed phrases and three layers of operational paranoia stop mattering because someone decides to come to your house 🫢 

CertiK now says that wrench attacks are on a remarkable rise in 2026.

Wrench attacks refer to physical assaults, kidnappings, home invasions or extortion attempts used to force victims to hand over crypto. The basic idea is, instead of trying to break encryption, attackers break the human attached to it 🔨 

• According to CertiK’s report, the number of incidents slowed during the second quarter, but the first half of 2026 still reached 52 known cases.

• The financial exposure attached to those attacks also exploded. CertiK said money stolen or demanded by attackers rose more than 1,000% year over year, climbing to $124 million from $10.5 million 😵 

• Western Europe has been hit especially hard. CertiK said Europe accounted for 39 of the 52 verified incidents in the first half of the year, with France alone responsible for 33. That has made France the main national hotspot in the data, which is not exactly the kind of crypto adoption stat anyone wants on the brochure 💀 

Kidnappings are still part of the picture, but CertiK said home invasions have increased as well. Publicly reported home invasion cases tied to crypto went from one in the first half of 2025 to 20 in the first half of 2026. That is not just some security footnote..

This is where the public bragging culture around crypto starts looking less like harmless flexing and more like free research for criminals, to be honest. Screenshots of balances, lifestyle posts, conference selfies, location tags, luxury purchases and “I made it” threads all become part of the same profile. Most people think they are posting success. Someone else might be mapping opportunity 😶 

The darker point is that crypto’s best feature is also part of the risk. Self custody means users can hold value without banks, brokers or frozen accounts standing in the middle. That is the whole point. But if the assets are portable, final and personally controlled, attackers will sometimes treat the person as the access layer 🫠 

Being your own bank also means you inherit some of the problems banks solved with guards, procedures, vaults and not letting one guy in a hoodie move everything at once from a phone. A beautiful little detail, really. The future of finance has arrived, and it still needs door locks 🙉 

The man who drains wallets says his wallet got drained

There is a very specific kind of incident where every new detail makes the last one look almost reasonable. This one begins in Bali, at a beach club, with drinks, strangers, an some crypto on a phone and a man who seems genuinely wounded by the discovery that crime is not an exclusive profession 🔐 

• Ronnie Magrehbi, known as “29” on X, posted that he was robbed of 189 SOL, worth around $14,000, while partying with a group of Australian women 🍸️ 

• According to his own story, he gave one of them his unlocked phone so she could find and follow her Instagram account. Later, he checked his Phantom wallet and saw the SOL had been transferred to an address he said he had never interacted with before 🤨 

Not exactly Ocean’s Eleven, more like handing someone your house keys because they wanted to admire the wallpaper, then acting shocked when the TV is gone 🙃 

The night then turned into a full little crime drama. The guy said he called police, who sent undercover officers to track the women down and arrest them. He posted footage of himself confronting them, and in another clip filmed at a police station.

But far from the least interesting part is that the guy himself has been described as a well known crypto rugpuller.

He himself has previously admitted to using stories about children with cancer to pump and dump memecoins, then was reportedly recorded mocking the same children and thanking them for helping him make money. Far beyond edgy internet behavior 🫥 

His history outside memecoins is not much better.

• In 2020, when he was 19, he was charged with armed robbery and burglary after police said he and three others robbed a man at gunpoint and stole his jacket and bag 🔫 

• Later that year, he was charged with conspiracy to commit wire fraud after allegedly taking over an NFL player’s social media account and demanding payment to return it. Authorities said his accomplice targeted both NFL and NBA players 🤦‍♂️ 

He has also admitted in an interview to draining crypto wallets with malware.

So when the same person says his own wallet was drained after he handed over his phone in Bali, sympathy does not really arrive naturally 😐️ 

None of this makes the theft acceptable, obviously if the SOL was taken, that is still a crime, and the law should not depend on whether the victim is likable. But the public reaction was never going to be gentle.

Crypto has plenty of ordinary victims who get robbed and deserve real sympathy. This case is different. It is still bad, but it is also a brutal little morality play about a scammer learning that the jungle has other animals in it 🐯 

“HYPE, HOOD, And The Next Crypto Bull Market” by Matt Hougan:

“Casino or Settlement Layer? Robinhood Chain's RWA problem” - IOSG Ventures:

“Agentic AI—The Killer Use Case for Blockchain and Crypto” - FTDA

MEMES

That's all for now, frens.

We'll meet in a week! And remember, the market conditions are temporary, but our commitment to building a better Web3 is here to stay. Thanks for joining us, and we look forward to seeing you back next week. Cheers!

Yours, The 🔥 Team

Brought to you by Ambire: The Only Web3 Wallet That You’ll Need!