TheDinarian
News • Business • Investing & Finance
Rilide: A New Malicious Browser Extension for Stealing Cryptocurrencies
April 14, 2023
post photo preview

(Dinarian Note: Whenever possible, ALWAYS go directly to the source versus clicking on an email link or google ad. Note: When searching on Google, the first 3 or 4 results are ads, do NOT use those. Also, ALWAYS double-triple check your pasted wallet address when withdrawing funds and ALWAYS use a VPN and Antivirus-Malware program, especially when you own crypto. Having cold storage is great, but when sending-recieving funds you are vunerable. Question everything, even if it seems legit.)

Trustwave SpiderLabs uncovered a new strain of malware that it dubbed Rilide, which targets Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, and Opera.

Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring browsing history, taking screenshots, and injecting malicious scripts to withdraw funds from various cryptocurrency exchanges.

Rilide is not the first malware SpiderLabs has observed using malicious browser extensions. Where this malware differs is it has the effective and rarely used ability to utilize forged dialogs to deceive users into revealing their two-factor authentication (2FA) and then withdraw cryptocurrencies in the background. During our investigation into Rilide’s origins, we uncovered similar browser extensions being advertised for sale. Additionally, we found that part of its source code was recently leaked on an underground forum due to a payment dispute.

Malicious Campaigns Leading to Rilide Stealer Extension

SpiderLabs uncovered two malicious campaigns leading to the installation of the Rilide extension.

Figure 1. Infection Chains Leading to the Execution of the Rilide Extension

Campaign 1: Ekipa RAT Installing Rilide Stealer

One of the Rilide samples identified by Trustwave SpiderLabs was distributed through a malicious Microsoft Publisher file. This file is part of Ekipa RAT, a Remote Access Trojan (RAT), designed for targeted attacks and often sold on underground forums.

We previously described Ekipa RAT in one of our blogs. It is important to note that Microsoft Publisher was not affected by Microsoft's decision to block macros from executing files downloaded from the Internet. As a result, when a user attempted to open a Publisher file, they would receive a warning but could still enable the execution of malicious content by clicking the ‘Enable Macros’ button. On 14 February 2023, Microsoft issued an update that resolved the Publisher security flaw. With the implementation of the ‘Mark of the Web’ feature on the .pub file, users are now left with only one option, ‘Disable Macros,’ which should have been the case all along.

Any association between the threat actors behind Ekipa RAT and those using the Rilide infostealer remains unclear. However, it is probable that Ekipa RAT was tested as a means of distribution for Rilide, before finally switching to Aurora stealer.

Figure 2. Publisher’s macro and Document_Open procedure executing remote Excel Workbook

Three tasks were configured on the C2 server:

  1. Download payload from hxxps://nch-software[.]info/1/2[.]exe to %temp% directory as.txt
  2. Change downloaded file’s extension to .exe
  3. Execute the payload.

File 2.exe is a Rust-based loader, responsible for installing the Rilide extension for Chromium-based browsers.

Campaign 2: Aurora Stealer Abusing Google Ads

Aurora is a Go-based stealer, which was initially spotted being advertised in April 2022 as a Malware-as-a-Service (MaaS) on Russian-speaking underground forums. The malware is designed to target data from multiple web browsers, cryptocurrency wallets, and local systems.

Recently, the threat actors behind Aurora have been observed abusing the Google Ads platform to spread the malware. According to a report published by Cyble, campaigns mimicking legitimate Team Viewer installers have been utilized to deploy Aurora. As reported by @1ZRR4H and @malwrhunterteam, Aurora was also spread via another campaign that imitated an NVIDIA Drivers installer. A downloaded sample was packed with Themida, a well-known commercial protector for executables. We used the UnpacMe service to unpack the sample.

Figure 3. Aurora campaign imitating the NVIDIA Drivers installer as shown in 1ZRR4H’s Twitter post

Restoring Function Names

The Aurora Stealer sample was stripped of debugging symbols, thus making the analysis harder. Since Go binaries are statically linked, which means that all the necessary libraries are included in the compiled binary, the number of potential functions to analyze is large. However, the original function names can be restored from the pclntab structure, as described in the CUJOAI Senior Threat Researcher Dorka Palotay’s post. Using the go_func.py script for Ghidra we were able to restore the functions names.

How an Aurora Module Downloaded Rilide Stealer

One of the eight grabbing modules, configured in the analyzed sample, contained a base64 encoded blob of data storing the URL for the Rilide Rust-based loader. The payload, hosted on Discord CDN, was saved to the %temp% directory with filename <10-alpahnumeric-characters>.exe and executed via start-process PowerShell cmdlet.

Figure 4. Part of Aurora Stealer routine downloading and executing Rilide loader

The Common Link Between Two Campaigns

The Rilide Rust-based loader samples analyzed as part of the Aurora campaign were packed with a VMProtect commercial packer. After unpacking the samples and analyzing strings contained in the binary, we found multiple references to Windows paths in the C:\Users\ilide\ directory. The same username was observed in the PDB Path of the Rilide sample obtained from the Ekipa RAT campaign.

Figure 5. The same username in a path found in Rilide Rust-based loaders samples from both campaigns.

Rilide Stealer Extension Targeting Chromium-Based Browsers

Rilide leverages a Rust loader used to install the extension if a Chromium-based browser is detected. Rilide mimics benign Google Drive Extensions and abuses several built-in chrome functionalities. The loader modifies LNK shortcut files opening targeted browsers, so that they are executed with parameter --load-extension pointing to the dropped malicious Rilide extension.

Figure 6. Rilide Stealer extension mimicking Google Drive and looking at its manifest revealing the configured permissions

Rilide’s background script attaches a listener to the tabs.onActivated and webRequest.onHeadersReceived events and removes the Content Security Policy (CSP) directive for all requests. This allows the extension to perform an XSS attack and load external resources that would otherwise be blocked by the CSP. The app script adds another listener to the DOMContentLoaded event and retrieves a list of targeted domains from the C2. If the current domain matches any of the listed targets, designated scripts are injected into the webpage.

Figure 7. Configuration list indicating targets such as email services and cryptocurrency exchanges.

Additionally, the background script carries out regular checks on the browsing history and exfiltrates URLs that are matched against the targeted domain list. Moreover, it is capable of capturing and exfiltrating screenshots of the currently active tabs on demand.

Figure 8. Rilide Stealer Execution Flow and Functionalities

Automatic Cryptocurrency Withdrawal

Rilide’s crypto exchange scripts support automatic withdrawal function. While the withdrawal request is made in the background, the user is presented with forged device authentication dialog in order to obtain 2FA. Email confirmations are also replaced on the fly if the user enters the mailbox using the same web browser. The withdrawal request email is replaced with a device authorization request tricking the user into providing the authorization code.

Figure 9. Withdrawal Requests replaced with Authorize New Device emails in Gmail mailbox

Figure 10. Content of the original and forged email. The verification code was extracted from the original message body.

We found no substantial variations in the code between the samples dropped by Ekipa RAT and used in the Aurora Stealer campaign. Both campaigns utilized a Rust dropper, and the functionalities of the browser plugins are nearly the same.

Figure 11. Code differences between Rilide Stealer plugin samples, both using the same C2 server

Rilide Stealer Origins

In the course of our research, we have encountered several stealer extensions for sale that advertised capabilities closely resembling those of the Rilide samples. However, we were unable to definitively link any of them to Rilide. One noteworthy finding was a botnet sale advertisement from an underground forum dated March 2022. Although the advertised functionalities matched those of Rilide, the botnet also included additional features such as a reverse proxy and ad clicker. Notably, the botnet's automatic withdrawal function supported the same exchanges observed in the Rilide samples.

Figure 12. Underground forum post advertising sale of botnet with Rilide-like capabilities

On February 27, 2023, a member of the same underground forum posted a link to the source code for the Rilide extension, reportedly due to an unresolved payment dispute. The leaked source closely resembles that used in the Aurora Stealer campaign but did not contain any of the injected scripts observed in the campaign sample.

Figure 13. Underground forum post, dated February 27, 2023, containing a link to part of the Rilide extension source code.

Notably there is one feature implemented that is missing in the later versions - swapping cryptocurrency wallet addresses in the clipboard. The list of addresses to be replaced is hard coded in the source code.

Figure 14. Clipboard hijacking routine in the analyzed sample from the forementioned forum post.

Pivoting on the Command-and-Control domain ashgrrwt[.]click hard coded in the sample, we identified additional Rilide loaders leading us to the GitHub user gulantin.

Figure 15. Github repository storing multiple Rilide loader and extension samples

Repositories created by this user contain loaders for the Rilide extension, but they are not Rust-based. The sample in the repository named ‘77’ is a .NET extension loader only for the Chrome browser, unlike the later Rust-based version that works for all Chromium-based browsers. Other loaders found in repositories 19 and 789 are based on Advanced Installer – a legitimate Windows Installer Packaging Tool for MSI installers.

Figure 16. Extension loading routine of the custom .NET loader from gulantin’s repository 77

The address contained in the domain variable that is supposed to store the C2 domain suggests that this version of a loader was still under development when submitted to GitHub.

Figure 17. Part of JavaScript configuration in the Rilide extension hosted on GitHub

Conclusions:

The Rilide stealer is a prime example of the increasing sophistication of malicious browser extensions and the dangers they pose. Disguised as a legitimate Google Drive extension, Rilide provides threat actors with the ability to carry out a wide range of malicious activities, including monitoring browsing history, capturing screenshots, and injecting malicious scripts to steal funds from cryptocurrency exchanges.

While the upcoming enforcement of manifest v3 may make it more challenging for threat actors to operate, it is unlikely to solve the issue entirely as most of the functionalities leveraged by Rilide will still be available.

Informational overload can dull our ability to interpret facts accurately and make us more vulnerable to phishing attempts. It is important to remain vigilant and skeptical when receiving unsolicited emails or messages, and to never assume that any content on the Internet is safe, even if it appears to be.

Ultimately, it is crucial to stay informed and educated about the latest cybersecurity threats and best practices to minimize the risk of falling victim to phishing attacks.

Indicators of Compromise:

Publisher File:

File name

Hash Type

Hash

Tes7777.pub

SHA256

0e31ff6406b03982581246b7dd60f3b96edcf0bd007b31766954df001fd68f69

SHA1

e049f56198c23d86e9083142bfe80042e21d4b8e

MD5

558104b26ccadec3d3eb2925113387a6


Aurora Stealer:

File name

Hash Type

Hash

PackageLauncher.exe

SHA256

e623984143e0dc6e35c79869ab1521c6714e588e8e648606496f8372ca0d8416

SHA1

b1c100d5a99ae34ccb3654c7b7f8573376a44fd9

MD5

c28a180de1f80c8c98d0904e64142bef

-

SHA256

ebd72806abd354f3162eec0991d127f993a5dde1a0c719b47087c9ee0edefeaf

SHA1

abaaa2644b1e84e8b39119988dd711572377c839

MD5

1baaeedd1a26edf4fa79ded370e3d19a

 

Rilide Loader:

File name

Hash Type

Hash

2.exe

SHA256

0f11aeecbde1f355d26c9d406dad80cb0ae8536aea31fdddaf915d4afd434f3f

SHA1

b4b918a5898463dad1c7d823e0b3f828bac15aad

MD5

0a4f321c903a7fbc59566918c12aca09

waBp.exe

SHA256

8342b134cddeaf34ce05bafa9e860dacf6cd01b85fd00147d90a350516c055e5

SHA1

25f3fb6d2dab206a5e9b2c0ef26ec6d6a56c5767

MD5

561797d7e5cf956e33735180d93be5b6

 

Rilide Extension:

File name

Hash Type

Hash

background.js

SHA256

4cc83be0fa496855d244050616ee2e86b044a9bc87bc5ca70b305986c1ba3bb8

SHA1

70167e7e5d71fba7d92796324b488c0fb9727712

MD5

766d020e902b6470d0510e5c6cfcd6e8

background.js

SHA256

55251c725e9f6f51b8db7a631b54dd85b1b59d644c3219e03ceffb0c49cd00a4

SHA1

a39d252e7927ae1adf518e6a3dd08f37e7ee7c26

MD5

d9cca3dd5bdaeb0466d52821b584602b

background.js

SHA256

1b01c3e554700e1282c7fdd2dcb54314516ee1f0c5eef3560cdbabc1ba776293

SHA1

ffebf78a9692293a23f9a477ea8a79f7f6ef5aa2

MD5

9e5f43b2dc1606e27fa0cfdfb4e363d2

app.js

SHA256

a28c623d120a76dcfeef9504eaeefabac9d33f292576ccf012fa458b8d7bc6ef

SHA1

a46586bfe22f4d84cd9174238740af275bf50c69

MD5

740606987f4d588c89d0a5b68648e31e

app.js

SHA256

8989f4244667626728c6c0083422ff714cb622c92c35a53f9cb1e9891f4528ff

SHA1

5012e783b2ee29cb40b04a10d1a40d0bfda683d9

MD5

1c54dd00bc7cc52b60ad4a46e2fb3a77

vpn.js

SHA256

170a13a7a8757336babe857804fa24b6cb20aaa9593b32546d7151f23095a510

SHA1

eafdc35b233600ef552b87e684faa3ab3396eae9

MD5

d54fa225b07298ec34be872cd4ebf4ae

manifest.json

SHA256

bb57a504e0b821552344cecb3da9ecdd0d61817264617a4917d6f5e64a1df7e5

SHA1

0cb1d9c2a3c8b776ef1e3ec1316fbf595ced7863

MD5

baee9ba0b94ea1e2b2e566fc8a615554

manifest.json

SHA256

d70e933e10e667ae7ef6e68a625c447be8aabe9b29affdad999c969bd8769003

SHA1

84db08e3dcbe40c7cbc998a77788f7303d4a2905

MD5

99dc4073f2fe91f48fd16bc65e7dcbc2

binance.js

SHA256

c8939f8d6237fcc17d486981a800b1e7e9974377de21d7e76677babe8ed536af

SHA1

f689396c73055e99a06e002c39e3a74d3d402607

MD5

2cc204564b68c5a98b1ff68d861b66c5

bitget.js

SHA256

2e310391d77022bcc708c354140319718777ca35efdfb76d6c80cb9de8c8091e

SHA1

05536aa80f8280ddc31be5c0ac3ca995f2190a0a

MD5

646b9404a29febe9f3741797b79e300c

blockchain.js

SHA256

4bbb0584eed0c082b5c43d3f259f37cf1a0b64eabb485e85090951a6566d98d4

SHA1

28ae2440c56350f65b607e4e99b67a2632db873b

MD5

253f4319673673d2bf5285558a6903df

bybit.js

SHA256

9dca66f52f31dca921fb238bd36bfc1b1a59d3e4af7b071da9bc4c6bf294e402

SHA1

61acdad59223a9eb0b392ccd085db1e49700d65

MD5

50e363409ba77b20fb6f0bce4eff7b1

coinbase.js

SHA256

4df0f18a7e05518bbe93758e751f1f462fef212cdc786c7217d50ddbda14efb5

SHA1

39f546a4ec94e63e603e3c2481fecab2b5e8a475

MD5

c1f40584e4ac391d97218ce137a63fb3

ftx.js

SHA256

ef20c929f5204b223b6e53dc406ea0bcd76d9e98c9ae4942037902883d4bb22a

SHA1

0ead1d32ce6b15c4a90373fce58d1554035cd40f

MD5

ebce63fdc8ef245f117f06ada3ba0f6d

huobi.js

SHA256

e1ad66cc0244fc075e0aabe0fd19502d4c9617829b90aa210e74be1d915275d2

SHA1

2449e4b27d778f6a4ffc00bb7b73926ac2c54e8a

MD5

4abe60d2c3506f4767e163d135f89f92

kraken.js

SHA256

a7f0fdfdfdf1ef65799fd2114bf5c1e133a8b7635b498b334553fbb64b218a05

SHA1

ec6de82efa93e59da148f4d696efcfca851e051e

MD5

b85c5659e946b5d7ad78410356288928

okx.js

SHA256

68278b40b59b1b0db2f814d2d864f0b9c2b4285f5795d22cabf60715f922989c

SHA1

415d790b54ca8e374f37fdbb00090110b823ba18

MD5

ff4e2df1a46d49862ab2a0af830a007e

gmail.js

SHA256

2f947644c7752ba014eae7971b247be60249a6088923c66ffe9886a7f5c5fe1c

SHA1

add0d61399c8c47f8ac73dc83cc83dfa31cddeca

MD5

c0e120778853f0a4865e006a07cd728a

 

Phishing Websites:

Malware

Domain

Aurora

nvidia-graphics[.]top

 

C2 Servers:

Malware

Domain

Ekipa RAT

nch-software[.]info

Aurora

45[.]15[.]156[.]210

Rilide

vceilinichego[.]ru

Rilide

ashgrrwt[.]click

 

Wallet Addresses:

Cryptocurrency

Address

BTC

bc1qkczacyp5jq29s5kaphth4asu8cv2y4u4gdgj7q

BTC

bc1qsjg8dqx6ga30h6szjd8dv2wg50ch50qrey4t7j

BTC

1KqequymujeNJuyB4gH7oJSFTB3En3Hf5n

ETH

0xDBc1330056E2F5e2FB11FB3C96dE2c44B313eA8d

LTC

LRYpzmnqBVozkbzJhTWndzYDPfjmNPyaLv

XRP

rUPTadzFN6LS662Z2d2AvNyqU1xwg2japJ

TRON

THiD8hFLiEyULVKLp3DSbBXQSbR3MQxm4X

DOGE

D5asYfjtbTtFmFkrEwqVgbJKYv9YT7Tgjh

Link

community logo
Join the TheDinarian Community
To read more articles like this, sign up and join my community today
0
What else you may like…
Videos
Podcasts
Posts
Articles
"The World Order That We Are Coming Into"

If XRP is the neutral bridge for all sovereign currencies, stablecoins, and tokenized assets, then it’s not just facilitating payments, it’s capturing all that value at every level. From smart contracts to tokenized treasuries and digitized assets, XRP forms the foundation and backbone for everything in between.

With cross-border payments representing a multi-trillion-dollar corridor, that’s where the largest capital will flow and the greatest returns will come from.

At this point, you’re the gatekeeper to the digital economy. Everything else follows or fades away once regulations take effect.

You either see it or you won’t until it’s too late.

~The Black Swan Capitalist

00:01:50
Denelle Dixon (Stellar CEO) On Bloomburg 🚀

'Everyone, including Mastercard and Visa, is looking at how this technology can make finance easier for their consumers and their business. I don't think there is going to be a loser, but I do think there will be shake-ups. And ultimately, the consumer is going to win.' - SDF CEO @DenelleDixon on @BloombergTV

00:05:29
We are minutes away from passing the GENIUS Act.
00:01:19
👉 Coinbase just launched an AI agent for Crypto Trading

Custom AI assistants that print money in your sleep? 🔜

The future of Crypto x AI is about to go crazy.

👉 Here’s what you need to know:

💠 'Based Agent' enables creation of custom AI agents
💠 Users set up personalized agents in < 3 minutes
💠 Equipped w/ crypto wallet and on-chain functions
💠 Capable of completing trades, swaps, and staking
💠 Integrates with Coinbase’s SDK, OpenAI, & Replit

👉 What this means for the future of Crypto:

1. Open Access: Democratized access to advanced trading
2. Automated Txns: Complex trades + streamlined on-chain activity
3. AI Dominance: Est ~80% of crypto 👉txns done by AI agents by 2025

🚨 I personally wouldn't bet against Brian Armstrong and Jesse Pollak.

👉 Coinbase just launched an AI agent for Crypto Trading
🚀 On-chain Yield Meets Wall Street! 🚀

IXS, in partnership with OpenTrade, has launched the BlackRock High-Yield Corporate Bond Vault—bringing real-world bond yields to DeFi. Here’s why this is a game-changer:

🔹 Access BlackRock’s iShares 0–5 Year High Yield Corporate Bond ETF (SHYG) on-chain
🔹 Earn up to 8.5% APY, with daily interest accrual and zero fees during promo
🔹 Deposit USDC on Avalanche—no brokers, no onboarding delays
🔹 Withdraw anytime—no lockups, no gas hurdles
🔹 Backed by $6.4B in assets and a 4-star Morningstar rating
🔹 Real yield from real bonds, not just simulated returns
🔹 Fully tokenized, compliant, and always-on for digital-first investors
🔹 Brings institutional-grade fixed income directly to on-chain capital

The future of yield is here: transparent, credible, and powered by the world’s largest asset manager. 💎🌐

https://www.ixs.finance/news/ixs-launches-blackrocks-high-yield-corporate-bond-vault

https://coinmarketcap.com/currencies/ix-swap/

post photo preview
👀 OBE Master DISCOVERS MASSIVE CITY Underneath GREAT PYRAMID - Scientists CONFIRM! | Darius J. Wright

Darius J. Wright discusses his out-of-body experiences revealing ancient technologies and structures beneath the Great Pyramid, suggesting they were built by the Anunnaki. He describes tunnel systems, tablets encoded with Crystal Light information, and the presence of entities from various dimensions.

Darius emphasizes the pyramids' role in energy manipulation and transportation, using sound and frequency. He also highlights the importance of purifying the body to enhance psychic abilities and achieve true freedom.

The conversation touches on the spiritual implications of these discoveries and the potential for humanity to unlock advanced technologies and achieve higher consciousness.

Timecodes:
0:00 - Episode Teaser
5:35 - How does Darius leave his body?
7:19 - Is astral travel dangerous?
13:36 - Were giant trees real?
16:45 - Are fairies and gnomes real?
21:03 - What’s the purpose of the tunnels?
23:29 - Were pyramids stargates?
26:15 - Who built the pyramids?
27:23 - What’s inside the ...

📚 How to Liquid Stake XPRT and Add Liquidity to stkXPRT/XPRT Pool on Persistence DEX 📚

Dinarian Note: The tutorial shows you how to turn your XPRT into Liquid staked stkXPRT, which can then on top of being staked earn you extra yield via the pools on the Persistence DEX. Note: I put a list of the current pools available below. Check out the APR% on these 😉 This is what makes Defi so attractive to investors. Putting your money to work 101. Instead of just staking your XPRT for 16%, you can put it in a pool and make upwards of 50% or more. Note: These values constantly fluctuate. Even if you don't want to partake in this, it's good practice and extremely good to know! This will be invaluable once your a multi-millionaire, unless you plan on keeping your funds in a criminal run BANK! 🤣

⚠ If you reside in the USA, you MUST use a VPN. I set it to Singapore and it works just fine! ~ Namasté 🙏 Crypto Michael ⚡ The Dinarian


This tutorial will guide you through the process of adding liquidity to the stkXPRT/XPRT pool on Persistence DEX.

Table of Contents:

🔹 How to ...

post photo preview
Dubai regulator VARA classifies RWA issuance as licensed activity
Virtual Asset Regulatory Authority (VARA) leads global regulatory framework - makes RWA issuance licensed activity in Dubai.

Real-world assets (RWAs) issuance is now licensed activity in Dubai.

~ Actual law.
~ Not a legal gray zone.
~ Not a whitepaper fantasy.

RWA issuance and listing on secondary markets is defined under binding crypto regulation.

It’s execution by Dubai.

Irina Heaver explained:

“RWA issuance is no longer theoretical. It’s now a regulatory reality.”

VARA defined:

- RWAs are classified as Asset-Referenced Virtual Assets (ARVAs)

- Secondary market trading is permitted under VARA license

- Issuers need capital, audits, and legal disclosures

- Regulated broker-dealers and exchanges can now onboard and trade them

This closes the gap that killed STOs in 2018.

No more tokenization without venues.
No more assets without liquidity.

UAE is doing what Switzerland, Singapore, and Europe still haven’t:

Creating enforceable frameworks for RWA tokenization that actually work.

Matthew White, CEO of VARA, said it perfectly:

“Tokenization will redefine global finance in 2025.”

He’s not exaggerating.

$500B+ market predicted next year.

And the UAE just gave it legal rails.

~Real estate.
~Private credit.
~Shariah-compliant products.

Everything is in play.

This is how you turn hype into infrastructure.

What Dubai is doing now is 3 years ahead of everyone else.

Founders, investors, ecosystem builders:

You want to build real-world assets onchain.

Don’t waste another year waiting for clarity.

Come to Dubai.

It’s already here.

 

Source

🙏 Donations Accepted 🙏

If you find value in my content, consider showing your support via:

💳 PayPal: 
1) Simply scan the QR code below 📲
2) or visit https://www.paypal.me/thedinarian

🔗 Crypto – Support via Coinbase Wallet to: [email protected]

Or Buy me a coffee: https://buymeacoffee.com/thedinarian

Your generosity keeps this mission alive, for all! Namasté 🙏 Crypto Michael ⚡  The Dinarian

 

Read full Article
post photo preview
🎬Proof the Deep State Planned This War for Years🎬
Nation First outlines how the Israeli attack on Iran was planned by the Deep State and the Military Industrial Complex over 15 years ago.

Prepare to have your mind blown

~Namasté 🙏 Crypto Michael ⚡ The Dinarian

Dear friend,

What just happened in Iran wasn’t a surprise attack. It wasn’t a last-minute decision. It wasn’t even Israel acting alone.

It was a war plan written years ago — by men in suits, sitting in think tanks in Washington and New York. And yesterday, that plan was finally put into action.

Here’s the truth they don’t want you to know: this war was cooked up long before Trump ever became President — and it was designed to happen exactly this way.

Let’s start with what just happened.

Israel launched a massive, unexpected strike on Iran. They hit nuclear facilities. They killed military generals. They struck deep inside Iranian territory — and now the whole region is on edge, ready to explode into full-blown war.

The media is acting shocked. But I’m not. You shouldn’t be either.

Why?

Because we have the documents. They told us this was coming. Years ago.

Exhibit A: The Brookings Institution.

The Brooking Institution is a fancy name for what’s basically a war-planning factory dressed up as a research centre. Back in 2009, Brookings published a report called Which Path to Persia?

It laid out exactly how to get the U.S. into a war with Iran — without looking like the bad guy.

Here’s the sickest part:

“The United States would encourage — and perhaps even assist — the Israelis in conducting the strikes… in the expectation that both international criticism and Iranian retaliation would be deflected away from the United States and onto Israel.”

Let that sink in.

They literally suggested using Israel to start the war, so America could stand back and say, “Wasn’t us!”

They even titled a chapter of this report: “Leave It to Bibi” — naming Netanyahu as the guy to light the match.

Exhibit B: The Council on Foreign Relations (CFR).

The Council on Foreign Relations is an another Deep State operation. Also in 2009, CFR published a “contingency memothat laid out the whole military plan for an Israeli strike on Iran — step by step.

  • What routes the jets would fly (over Jordan and Iraq).

  • What bombs they’d use (the biggest bunker-busters in the U.S. arsenal).

  • Which Iranian sites to hit (Natanz, Arak, Esfahan).

  • And how Iran might respond (missiles, drones, threats to U.S. bases).

It’s like they had a time machine. Because those exact strikes just happened following the routes, likely using the bombs and hitting the sites that the CFR outlined.

Exhibit C: The Plot to Attack Iran by Dan Kovalik.

This one really blows the lid off.

US human rights lawyer and journalist Dan Kovalik, in his book The Plot to Attack Iran: How the CIA and the Deep State Have Conspired to Vilify Iran, shows how the CIA and Israel’s Mossad have been working together for decades — not just watching Iran, but actively sabotaging it. Killing scientists. Running cyberattacks. Feeding lies to the media to make Iran look like it’s always “six months away” from building a nuke.

He even reveals how they discussed false flag attacks — faking an Iranian strike to justify going to war. That’s not a conspiracy theory. That’s documented strategy.

And here’s where President Trump comes in.

Unlike the warmongers who wrote these plans, Trump wasn’t looking to bomb Iran. He wanted to talk. Negotiate. Make a deal — like he did with North Korea.

In fact, peace talks with Iran were just days away.

But someone didn’t want peace. Someone wanted war.

So Israel went in — just like the Brookings script said — and lit the fuse.

Trump didn’t authorise it. He didn’t want it. But they gazumped him. They went around him. And now, the peace he was trying to build has been blown to bits.

This was never about Iran being a threat. It was about keeping the war machine fed.

Think tanks, defence contractors, foreign lobbies — they don’t profit from peace. They thrive on tension. On fear. On war.

And now, thanks to them, the world’s one step closer to the edge.

If you’ve never trusted the mainstream media, you’re right not to.

If you’ve ever suspected there’s a shadowy agenda behind every war, you’re not paranoid.

You’re paying attention.

Because the documents are real. The war was planned. And the bombs are falling — right on schedule.

Pray for Iran’s civilians.

Pray for the Israelis caught in the crossfire.

Pray for a President who still wants peace.

And pray that we wake up before it’s too late.

Because the war has started.

But the truth has just begun to spread.

Until next time, God bless you, your family and nation.

Take care,

George Christensen

Source:

George Christensen is a former Australian politician, a Christian, freedom lover, conservative, blogger, podcaster, journalist and theologian. He has been feted by the Epoch Times as a “champion of human rights” and his writings have been praised by Infowars’ Alex Jones as “excellent and informative”.

George believes Nation First will be an essential part of the ongoing fight for freedom:

The time is now for every proud patriot to step to the fore and fight for our freedom, sovereignty and way of life. Information is a key tool in any battle and the Nation First newsletter will be a valuable tool in the battle for the future of the West.

— George Christensen.

Find more about George at his www.georgechristensen.com.au website.

🙏 Donations Accepted 🙏

If you find value in my content, consider showing your support via:

💳 PayPal: 
1) Simply scan the QR code below 📲
2) or visit https://www.paypal.me/thedinarian

🔗 Crypto – Support via Coinbase Wallet to: [email protected]

Or Buy me a coffee: https://buymeacoffee.com/thedinarian

Your generosity keeps this mission alive, for all! Namasté 🙏 The Dinarian

 

Read full Article
post photo preview
The Possible Impact Of USDC On The XRP Ledger And RLUSD
Key Points
  • It seems likely that USDC on the XRP Ledger (XRPL) boosts liquidity, benefiting XRP, though some see it as competition for RLUSD.
  • Research suggests both stablecoins can coexist, enhancing the XRPL ecosystem.
  • The evidence leans toward increased network activity being good for XRP, despite potential competition.

The recent launch of USDC on the XRP Ledger has sparked discussions about its impact on the ecosystem, particularly in relation to RLUSD, Ripple's own stablecoin. This response explores whether this development is more about competition for RLUSD or if it enhances liquidity on the XRPL, ultimately benefiting XRP.
 

Impact on Liquidity and XRP

The introduction of USDC, a major stablecoin with a $61 billion market cap, likely increases liquidity on the XRPL by attracting more users, developers, and institutions. This boost can enhance DeFi applications and enterprise payments, potentially driving demand for XRP, the native token used for transaction fees. While some may view it as competition for RLUSD, the overall effect seems positive for the XRPL's growth.
 

Competition vs. Coexistence with RLUSD

USDC and RLUSD cater to different needs: USDC appeals to those valuing regulatory compliance, while RLUSD, backed by Ripple, may attract users preferring ecosystem integration. Research suggests both can coexist, increasing options and fostering innovation, rather than purely competing.
 

Detailed Analysis of USDC on XRPL and Its Implications

The integration of USDC on the XRP Ledger (XRPL), announced on June 12, 2025, by Circle, has significant implications for the ecosystem, particularly in relation to RLUSD, Ripple's stablecoin launched in 2024. This section provides a comprehensive analysis, exploring whether this development is more about competition for RLUSD or if it enhances liquidity on the XRPL, ultimately benefiting XRP.
 

Understanding RLUSD and Its Role

RLUSD, Ripple's stablecoin, received approval from the New York Department of Financial Services (NYDFS) in 2024 and is designed to be fully backed by cash and cash equivalents, ensuring stability. It is available on both the Ethereum and XRP Ledger blockchains, aiming to enhance liquidity, reduce volatility, and serve cross-border payments. With a current market cap of $413 million, RLUSD is smaller than USDC's $61 billion but has regulatory credibility, particularly appealing to institutions.
 

Impact of USDC on the XRPL

The launch of USDC on the XRPL is a significant development, given its status as the second-largest stablecoin by market cap.
 
Key impacts include:
  • Liquidity Boost: USDC's integration can attract more users, developers, and institutions, increasing overall liquidity. This is crucial for DeFi applications, as Circle's announcement emphasizes its use in liquidity provisioning for token pairs and FX flows.
  • Increased Utility: USDC enhances the XRPL's utility for enterprise payments, financial infrastructure, and DeFi, potentially making it more attractive for global money movement and transparent settlements.
  • Regulatory and Institutional Appeal: As a regulated stablecoin issued by Circle, USDC can bring institutional users to the XRPL, aligning with Ripple's goals for regulated financial activities.
  • Network Growth: Supporting a widely recognized stablecoin like USDC on 22 blockchains, including the XRPL, increases the network's visibility and adoption, potentially driving more activity.

Competition vs. Complementarity with RLUSD

While USDC's launch could be seen as competition for RLUSD, the evidence suggests a more nuanced relationship:
  • Competition: Both are stablecoins on the XRPL, and USDC's larger market presence ($61 billion vs. RLUSD's $413 million) might attract users and developers away from RLUSD. However, competition can drive innovation, such as lower fees or better services, benefiting the ecosystem
  • Complementarity: Different stablecoins cater to different needs. USDC appeals to users valuing regulatory compliance and widespread adoption across multiple blockchains, while RLUSD, backed by Ripple, may attract those preferring ecosystem integration and regulatory approval from NYDFS. The XRPL can benefit from having multiple options, increasing liquidity and fostering a diverse ecosystem.
  • Coexistence Benefits: Research suggests that having multiple stablecoins enhances liquidity and provides users with more choices, potentially leading to higher network activity. For example, institutions might use USDC for global payments and RLUSD for specific XRPL-integrated applications, creating a symbiotic relationships.

Impact on XRP

The introduction of USDC, alongside RLUSD, is likely beneficial for XRP, the native token of the XRPL, for several reasons:
  • Increased Liquidity and Activity: Higher liquidity on the XRPL, driven by both stablecoins, can increase transaction volumes. XRP is used for transaction fees, with some fees burned, potentially reducing supply over time and increasing demand.
  • DeFi and Enterprise Use Cases: Both USDC and RLUSD enhance DeFi and enterprise applications, such as liquidity pools and cross-border payments, which can drive demand for XRP as a settlement token.
  • Network Growth: A more liquid and active XRPL is more attractive to developers and users, potentially leading to long-term growth for XRP, as increased utility can drive its value.
Expert analyses, such as those from u.today and ledgerinsights.com, suggest the launch is a "massive boost" for liquidity and adoption, with RLUSD also playing a significant role.
 

Comparative Analysis: USDC vs. RLUSD

To further illustrate, consider the following table comparing key attributes:
 
Given the evidence, it is more accurate to view the introduction of USDC on the XRPL as beneficial for liquidity, which is ultimately good for XRP, rather than solely as competition for RLUSD. The XRPL benefits from increased options, with both stablecoins enhancing liquidity, utility, and network growth. While some competition exists, the overall impact is positive, fostering a robust ecosystem that can drive demand for XRP. This conclusion aligns with expert analyses and community discussions, acknowledging the complexity of the stablecoin market within the XRPL.
 

🙏 Donations Accepted 🙏

If you find value in my content, consider showing your support via:

💳 PayPal: 
1) Simply scan the QR code below 📲
2) or visit https://www.paypal.me/thedinarian

🔗 Crypto – Support via Coinbase Wallet to: [email protected]

Or Buy me a coffee: https://buymeacoffee.com/thedinarian

Your generosity keeps this mission alive, for all! Namasté 🙏 The Dinarian

Read full Article
See More
Available on mobile and TV devices
google store google store app store app store
google store google store app tv store app tv store amazon store amazon store roku store roku store
Powered by Locals