On 22 August 2025, the DeepCode intelligence team identified a darknet marketplace listing by the actor “1688shuju” on darkforums[.]st offering large batches of verified phone numbers tied to major cryptocurrency exchanges (Binance, OKX, Coinbase, KuCoin, HTX). During an undercover engagement, DeepCode obtained a payment endpoint used to purchase the