「Buy the Dip」 Whale Reappears with $116 Million Liquidation, Closes $4.62 Million Brent Crude Oil Short Position with Small Gain

On April 15th, Web3 wallet app Zerion revealed that a team member fell victim to an AI-powered social engineering attack linked to a North Korean threat actor last week. The attack resulted in the theft of roughly $100,000 from the company’s hot wallet—user funds and app infrastructure were not impacted. In response, Zerion has proactively taken its web app offline and expects to restore service within 48 hours. The company has also rotated all compromised credentials, hardened its deployment infrastructure, and is collaborating with security partners (Blockaid, ZeroShadow, ChainPatrol) to trace the attacker’s wallet. The address holding the stolen funds has been reported to relevant law enforcement agencies.

On April 15, cybersecurity firm Elastic Security Labs uncovered a new social engineering attack targeting professionals in finance and crypto. Attackers posed as a venture capital firm on LinkedIn and Telegram, tricking targets into opening an Obsidian note vault with a hidden malicious payload—this deployed PHANTOMPULSE, a previously undocumented Windows remote access trojan (RAT). The attack did not exploit any software vulnerabilities; instead, it abused Obsidian’s Shell Commands plugin to auto-execute malicious code when the vault opened. The macOS variant used an obfuscated AppleScript dropper plus a Telegram channel as a secondary command-and-control (C2) server, while the Windows variant relied on Ethereum transaction data to resolve C2 addresses via blockchain.

April 15 — Per analyst Alicharts, Ethereum’s weekly MACD is currently forming a bullish crossover. In the wake of the past three weekly MACD bullish crossovers for ETH, the cryptocurrency’s price rallied 130%, 74%, and 98% respectively. Notably, while a MACD bullish crossover is widely viewed as a sign of strengthening bullish momentum, past performance is not a guarantee of future results. A comprehensive analysis accounting for the macro landscape and broader market sentiment is necessary.

Per Bloomberg, on April 15, Societe Generale SA’s digital asset arm Societe Generale-FORGE announced it will bring the USD CoinVertible stablecoin to MetaMask—the self-custodial crypto wallet—via a partnership with blockchain firm Consensys. This marks a key push by a traditional bank to expand digital currency accessibility in the crypto space. Users can now directly access and manage the USD CoinVertible token within their MetaMask wallets.

April 15 — Per Sky News UK, former President Donald Trump said it’s “very likely” the U.S. will reach an agreement with Iran before the King of the United Kingdom visits the U.S. later this month. When a Sky News reporter asked about the current status of the U.S.-UK “special relationship,” Trump claimed the bond “has already improved.” He added: “The U.S.-UK relationship is like this: When we ask them for help, they’re not there; when we need them, they’re not there; when we don’t need them, they’re still not there. And they still haven’t shown up.” Trump also noted his positive rapport with the King, saying: “I think I quite like Stammer.”

On April 15th, HyperInsight monitoring (via https://t.me/HyperInsight) shows the war premium has pulled back sharply amid a rebound in risk appetite. A whale with heavy positions across three major markets has booked $1.3 million in profits today, while further reducing its WTI crude short positions—total cuts now stand at $4.3 million. The whale’s total floating profit across these positions currently totals $4.7 million. Key position details: - **U.S. Equities**: Long Nasdaq 100 + S&P 500, total size $38.1M, floating profit $1.6M - **Commodities**: Short WTI + Brent crude, total size $19.2M, floating profit $1.33M - **Crypto**: Long BTC + HYPE, total size $15.9M, floating profit $1.8M Whale Address: 0x8af700ba841f30e0a3fcb0ee4c4a9d223e1efa05