In the underground forum, a remote control tool claiming to be compatible with iOS 13 to 27.2 is quietly circulating. It spreads phishing links through SMS, chat apps, and emails, attempting to take control of devices, targeting keychain data, chat histories, file credentials, and information related to encrypted wallets. Meanwhile, on another front, the RWA protocol stUSDT announced the cessation of interest rewards and started an orderly exit, setting a redemption window for stUSDT and wstUSDT holders until May 14, 2027. Late applications will be processed monthly by customer service until August 2027. The team claims that "underlying assets still have full support," yet has not provided detailed disclosures such as the reasons for the exit and asset composition. Further afield, on December 18, 2025, the police in Changde, Hunan, China, issued a wanted notice, after which the Immigration Bureau of Thailand apprehended two Chinese men in Bangkok for cryptocurrency fraud, involving an amount reportedly exceeding 3.2 billion Thai Baht. Their residency permits were revoked, and cross-border law enforcement elevated the "asset security" issue from a technical level to a criminal level. In Washington, Senate Banking Committee Chairman Tim Scott sent letters to U.S. Commerce Secretary Gina Raimondo and former Nvidia CEO Jensen Huang, summoning them to hearings on chip export controls on December 10 and December 3, respectively, with the possibility of issuing subpoenas; over the past two years, Singaporean company Megaspeed reportedly purchased over 4.8 billion dollars' worth of Nvidia AI-related products, which has been included in this round of scrutiny. From black market control to protocol exits, to political inquiries targeting upstream computing power and exports, these seemingly scattered clues converge into a single direction: the cryptocurrency ecosystem is under multiple pressures from terminal security to protocol trust and macro-regulation, with the risk premium for user asset security and the RWA track being repriced. The forthcoming on-chain address behavior and policy tendencies need to be continuously and meticulously observed.
Black Market Remote Control: Mobile Wallets Targeted
Following this black market lead reveals the mounting pressure at the terminal level. Slow Mist CISO 23pds disclosed that a remote control tool being sold in underground forums claims to be compatible with iOS 13 to 27.2, nearly covering all mainstream system versions still in service. Its entry point continues to employ old-fashioned tactics – pushing phishing links through SMS, chat applications, or emails. Once users inadvertently click the link in daily conversations or work communications, the malicious program attempts to gain access to the device, and they will be concentrated into a remote control panel that allows the operator to manage the compromised mobile phone from the backend. This information currently comes from a single source and has not received broader technical verification, but the attack surface it sketches is already alarming enough.
The real danger lies in that this is no longer just lightweight phishing to "steal a login verification code," but targets the core sensitive data of the entire device. It is disclosed that such tools aim for system keychains, chat logs, file access credentials, and encrypted wallet-related data – from recovery phrases to various login information, all within the potential scope of collection. Once a user's mobile device managing private keys is compromised, the signing ability for the corresponding address is effectively handed over to others, and on-chain assets can be transferred and swiftly moved, with users often seeing abnormal transaction records and zero balances only afterwards. Compared to a single DApp being phished, this is an evolution from "application risk" to "device-level control": as long as the terminal falls, no matter how complete the permission pop-ups, contract audits, and risk control prompts may be, they become meaningless in this scenario. In such a situation, basic protective strategies must revert to the source – reducing the long-term storage of plaintext recovery phrases and large assets on mobile devices, separating daily payments from sizable holdings, exercising caution towards all links mixed in chats and emails, and treating "whether the device is secure" as a primary premise for the sustainability and credibility of on-chain identities.
stUSDT Stops Interest and Opens Redemption Window
As terminal security is forced back to "self-protection" logic, asset sides are quietly retracting risk exposure as well. The RWA protocol stUSDT announced the initiation of an "orderly exit," with the first step being the immediate cessation of interest rewards, signaling the end of this yield line; simultaneously, it opened an official redemption entry for stUSDT and wstUSDT holders, extending the main redemption window directly to May 14, 2027, and reserving a late redemption channel processed monthly by customer service for users who miss the deadline, concluding by August 2027. On the surface, this is a well-paced, clearly defined exit plan; the team has also emphasized that the protocol's underlying assets "still have full support," trying to focus attention on fund safety rather than product termination.
What truly tightens the RWA track is not the exit itself but the gaps left behind: the official has not explained the reasons for stopping interest and exiting, nor disclosed key details such as the asset composition and custodians behind the so-called "full support." Currently, there is also a lack of quantitative public data regarding redemption scale, progress, or on-chain redemption behavior, leaving the outside world to speculate on its risk profile under limited information. Over the past two years, RWA has been viewed as a bridge for bringing real-world yield onto the chain; now this bridge chooses to extinguish at the yield end, emphasizing security at the asset end, yet fails to provide a more complete structural explanation. For existing users, this is a forced trust test between "believing the statements" and "voting with feet to redeem." For the broader cryptocurrency community, it serves as a reminder: any protocol placing on-chain identities in the hands of real asset custodians, once a transparency gap appears, will ultimately revert to the most direct question of "Can I still trustingly hold on?"
Thailand's Cross-border Arrest of Chinese Team: Cryptocurrency Fraud Chain Cut Off
When a gap appears between on-chain assets and real-world custodians, the outcome often is not as simple as "switching protocols," but evolves into case files in the real world. On December 18, 2025, the Public Security Bureau of Changde, Hunan Province, China, publicly issued a wanted notice for two Chinese men; shortly after, the Immigration Bureau of Thailand's investigative team identified and arrested them in Bangkok – one aged 52 and the other 28, accused of involvement in cryptocurrency fraud, with the amount reportedly exceeding 3.2 billion Thai Baht, approximately 630 million yuan. This timeline connection indicates that the previously concealed cross-border fraud chain, which utilized the cryptocurrency narrative, is now exposed to both the Chinese criminal system and the Thai law enforcement view.
More noteworthy is that Thailand is not treating the case solely as a criminal issue; instead, it has employed tools from the Immigration Act to directly revoke the residency permits of both individuals in Thailand, cutting off the gray safety boundary of "staying in Southeast Asia with operational space." For an industry chain that relies on regional gray areas, cross-border teams, and complex identity structures to operate cryptocurrency fraud, a case involving 3.2 billion Thai Baht being addressed through cross-border cooperation is itself a high-intensity deterrent: once the scale of funds grows, identity and residency itself can also become a scrutinized risk point. For compliant projects and ordinary users operating in Southeast Asia, the signals released by this case are equally direct – any participation in local activities related to cryptocurrency assets must not only understand on-chain rules and product risks but also view the country's criminal laws and immigration management as part of the same risk control boundary. It is assumed that once the red line is touched, regulation will not merely stop at the level of fines but can swiftly escalate to comprehensive liquidation of individuals, identities, and even residency qualifications.
Washington Questions Chip Exports: AI Computing Power and Crypto Prospects Under Scrutiny
As Southeast Asia investigates the front-end fraud chain, American attention has shifted to upstream power supply. According to a single source, as Senate Banking Committee Chairman, Tim Scott has written to U.S. Commerce Secretary Gina Raimondo, requesting her to attend a hearing on chip export controls on December 10, with Raimondo consenting to voluntarily testify. The mirrored recipient of the same letter is former Nvidia CEO Jensen Huang, whom Scott has also summoned to the December 3 hearing on the same topic, openly stating that if Huang refuses to appear, the committee will consider using a subpoena to compel him to testify. Behind these letters is a concentrated assessment of the global flow of AI chips – reportedly, Singaporean company Megaspeed has purchased over 4.8 billion dollars' worth of Nvidia AI-related products over the past two years, becoming a case frequently mentioned in the context of examining the gap between export regulations and actual execution.
From the perspective of the cryptocurrency industry, such hearings are not unrelated to the on-chain world. Whether it is mining machine clusters in proof-of-work networks, high-performance nodes, sequencers, or on-chain applications relying on complex models, they essentially compete for the same batch of high-end computing power used in AI training and inference. Once the U.S. tightens its stance on chip exports and increases inspection density, global computing power's geographical distribution and cost structure may be reshaped, and the expansion of mines, deployment of nodes, and even the provision of external cryptocurrency computing services in some regions would make decisions under a more uncertain policy ceiling. This means that future on-chain infrastructure must not only compute electricity prices and machine depreciation but also regard cross-border chip compliance risks as long-term variables.
Response Checklist Amid Terminal Security, Protocol Exit, and Regulatory Heating
When viewing the black market control tools, orderly exit of stUSDT, cross-border arrests in Thailand, and U.S. hearings on chip exports together, the cryptocurrency ecosystem is simultaneously bearing the triple pressures of terminal security, protocol trust, and macro-regulation: mobile remote control directly targets wallet data, elevating device security to a priority level equal to that of private keys; stUSDT, while emphasizing full support for underlying assets, stops interest payments, extends the redemption window to May 14, 2027, and prolongs the customer service processing period, reflecting the exit path design under pressure for the RWA protocol; Thailand's cross-border collaboration and immigration law crackdown on reportedly over 3.2 billion baht worth of cryptocurrency fraud, along with public hearings regarding AI chip exports in the U.S., overlay regional law enforcement attitudes and the uncertainty of power policies onto on-chain infrastructure. For ordinary participants, responding is no longer just about "diversifying positions": first, treat terminal protection as the starting point for on-chain asset security, vigilant against phishing links and remote control risks disseminated through SMS, chat apps, and emails; second, if holding positions like stUSDT, wstUSDT, etc., understand the cessation of interest time, redemption window, and overdue processing arrangements, examining personal liquidity needs and tolerance for information disclosure of underlying assets; third, continuously monitor the law enforcement stance of the relevant jurisdiction towards cryptocurrency-related activities, as well as policies regarding chip export controls that might impose constraints on local mine expansions, node deployments, and managed computing power services. At the same time, it must be acknowledged that concerning the technical capabilities of control tools, the asset composition of stUSDT, subsequent judicial developments of the Thai case, and the substantive outcomes of the U.S. hearings, most currently come from single sources and key details remain undisclosed; these clues appear more like observational samples outlining risk profiles rather than validated causal chains, with subsequent on-chain behaviors and policy implementations needing careful tracking over time.
Join our community for discussions and to grow stronger together!
Exclusive AiCoin Hyperliquid Benefits: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive AiCoin Aster Benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram Community: https://t.me/AiCoinWhaleData
On-chain Community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin On-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
