Autor: dot-traders

• Ondo Finance token is down 4% after Nathan Allman’s death announcement.
• Ian De Bode officially takes over as Ondo Finance CEO.
• Ondo TVL holds above $2.67 billion amid market uncertainty.

ONDO token fell nearly 4% over the past 24 hours after news emerged that Ondo Finance founder Nathan Allman had passed away unexpectedly.

The token traded around $0.421 at the time of writing, down from an intraday high of $0.444.

Trading activity also increased sharply, with daily volume climbing to more than $229 million as investors reacted to the development.

The decline interrupted what had been a strong recovery period for ONDO.

The token had gained close to 62% over the past 30 days, supported by growing interest in real-world asset (RWA) tokenisation and expanding institutional involvement in blockchain-based financial products.

What caused Nathan Allman’s death?

Ondo Finance confirmed that Nathan Allman died unexpectedly on May 26, 2026. However, the company did not disclose the cause of death.

The lack of details led to widespread speculation across the crypto community, though Ondo leadership requested privacy for Allman’s family and close associates.

Several major figures in the digital asset industry publicly shared tributes following the announcement.

Former Binance CEO Changpeng Zhao was among those who reacted publicly, alongside Mantle and Compound founder Robert Leshner.

Messages from industry participants described Allman as one of the key figures driving institutional adoption of tokenised assets.

Allman became widely associated with the idea that blockchain technology could modernise capital markets through around-the-clock settlement and easier global access to financial products.

Under his leadership, Ondo Finance established relationships with institutions including JPMorgan Chase, Franklin Templeton, Broadridge Financial Solutions, and BlackRock.

Ondo Finance has become one of the biggest names in the tokenised treasury market over the past two years.

The platform currently holds more than $2.67 billion in total value locked, placing it among the leading projects focused on bringing traditional financial products onto blockchain networks.

Allman played a central role in that growth. Before launching Ondo Finance in 2021, he worked on Goldman Sachs’ digital assets team and previously had experience in private credit investing. He later built Ondo into one of the most recognised real-world asset platforms in the crypto sector.

The company’s products include OUSG, which offers tokenised exposure to short-term US Treasuries, and USDY, a yield-bearing digital dollar product backed by treasury assets.

Ondo also expanded into tokenised equities infrastructure through Ondo Global Markets.

Ian De Bode named Ondo Finance CEO

Ondo Finance moved quickly to address leadership concerns by naming Ian De Bode as the company’s new CEO.

It is with profound sadness that we announce the unexpected passing of Nathan Allman, Ondo’s founder. Our hearts are with his family and loved ones.

Nate’s brilliance, humility, and drive shaped every part of what Ondo is today. His belief in the power of technology to create a…

— Ondo Finance (@OndoFinance) May 25, 2026

De Bode previously served as Ondo’s president and had already been overseeing strategy, product development, and operations for more than two years before the transition.

His background includes work at McKinsey’s digital assets division, giving him direct experience in institutional blockchain adoption and financial infrastructure.

The company stated that its long-term roadmap would continue without changes despite the leadership shift.

That message appeared aimed at calming investors and institutional partners following the sudden news.

What to expect in the coming days

Despite the sharp emotional reaction from the community, ONDO’s price movement remained relatively controlled compared to previous major crypto leadership events.

The coming days will likely focus on whether ONDO can maintain support above the $0.40 range as markets digest the leadership transition.

Short-term volatility may continue because the news arrived during a period of strong upward momentum for the token.

ONDO had already risen nearly 9% over the past seven days before the latest decline, suggesting traders were actively positioning around the broader real-world asset narrative.

Much of the market’s attention will now shift toward how Ian De Bode handles Ondo’s institutional partnerships and ongoing expansion plans.

The post ONDO price drops 4% as community mourns Nathan Allman’s death appeared first on CoinJournal.

• The malware spread through npm, PyPI, and Rust packages in coordinated waves.
• It steals crypto wallets, SSH keys, and cloud developer credentials.
• AI coding tools were also targeted through malicious config files.

A coordinated malware campaign known as TrapDoor has hit software ecosystems widely used by crypto and blockchain developers.

Security researchers identified dozens of malicious packages spread across major open-source repositories, all designed to steal sensitive developer data such as wallet keys, cloud credentials, and source code access tokens.

Instead of a single malicious upload, attackers deployed multiple packages in waves using different accounts.

This approach made the activity harder to detect at the early stages and allowed the malware to blend into routine dependency updates.

Coordinated attack across major developer ecosystems

The TrapDoor operation affected at least three major package ecosystems: npm, PyPI, and Crates.io.

Together, researchers identified more than 30 malicious packages and over 300 affected versions distributed within a short window.

The activity reportedly began around May 22, 2026, although GitHub reported unauthorized access to internal repositories on May 20. It then escalated quickly over the following days.

The packages were not isolated incidents. Instead, they appeared to be part of a coordinated release strategy involving multiple developer accounts.

This structure suggests planning rather than opportunistic abuse. Each package carried similar behavior patterns and pointed to a shared malicious framework used by the attackers.

How the TrapDoor malware operates inside developer systems

Once installed, TrapDoor packages execute automatically through standard build and installation processes used in modern development environments.

In JavaScript packages, malicious code is triggered through post-install scripts, which run immediately after a dependency is added.

In Python packages, the malware can activate during import, allowing it to execute without any explicit function call.

Rust packages use build scripts to achieve the same result during compilation.

After execution, the malware scans local systems for valuable data. This includes SSH keys, API tokens, and configuration files commonly used in cloud and blockchain development workflows.

It also targets browser-stored credentials and environment variables, which often contain sensitive authentication data.

Stolen information is then sent to external servers controlled by the attackers.

In some cases, the malware attempts to maintain persistence by modifying startup processes or inserting malicious hooks into development tools.

Crypto-focused targeting and high-value data theft

What makes this campaign particularly concerning is its focus on crypto-related development environments.

The malware specifically searches for crypto wallet-related files and credentials linked to platforms such as Coinbase, MetaMask, Binance, and Solana-based tools.

It also targets cloud infrastructure credentials from providers like AWS and GitHub access tokens.

These are especially valuable because they can provide attackers with direct access to private repositories, deployment pipelines, and backend systems.

In addition, the malware attempts to collect SSH keys that could allow remote access to developer machines or production servers.

This combination of targets gives attackers a wide range of entry points into both personal and enterprise systems.

AI development tools also under pressure

One of the more unusual elements of the TrapDoor campaign is its interaction with AI-assisted development environments.

Some malicious packages include configuration files designed to influence coding assistants and automated development tools.

Files such as .cursorrules and CLAUDE.md were reportedly used to manipulate AI coding assistants into performing actions that could expose sensitive information.

Instead of directly hacking systems, the attackers attempted to exploit how AI tools interpret project instructions.

This approach reflects a shift in attack methods.

Rather than targeting only code execution, the campaign also attempts to influence developer workflows that rely on AI-generated suggestions and automated analysis.

The post TrapDoor attack targets crypto wallets, AWS keys and GitHub tokens appeared first on CoinJournal.