
Work Here?
Bitso is a Latin American financial services platform that bundles a cryptocurrency exchange with crypto-enabled financial products. It lets users buy, sell, send, and receive digital assets such as Bitcoin and Ether using local currencies, and serves both individuals and institutions. Revenue comes mainly from trading fees, and the company also offers Bitso+ rewards and cross-border payment solutions to speed up international transactions. Its goal is to broaden access to digital financial services in Latin America by making crypto trading, savings, and cross-border payments easier for people and businesses.
Industries
Fintech
Crypto & Web3
Financial Services
Company Size
501-1,000
Company Stage
Series C
Total Funding
$331.4M
Headquarters
Mexico City, Mexico
Founded
2014
Help us improve and share your feedback! Did you find this helpful?
Total Funding
$331.4M
Above
Industry Average
Funded Over
5 Rounds
Industry standards
Unlimited Paid Time Off
Remote Work Options
Stock Options
Health Insurance
Dental Insurance
Life Insurance
Parental Leave
Gym Membership
Mach-O Man: Lazarus Group targets crypto executives on Mac. Lazarus Group's Mach-O Man malware targets crypto executives on macOS via fake Zoom invites. The same unit stole $575M from Drift and KelpDAO in April 2026. North Korea's Lazarus Group has deployed a new macOS malware kit called Mach-O Man, targeting crypto and fintech executives through fake Zoom meeting invitations on Telegram. The same unit is attributed to stealing $285 million from Drift Protocol on April 1 and $292 million from KelpDAO on April 18 - over $575 million stolen in just 18 days, with Mach-O Man now emerging as the third attack vector. How does Mach-O Man work? TL;DR: Mach-O Man is a macOS malware kit by Lazarus Group that tricks victims into running a Terminal command during a fake Zoom call, harvesting credentials, Keychain data, and browser sessions before self-deleting. The campaign was identified on April 21, 2026, by the Quetzal security team at Bitso, in collaboration with the threat analysis platform ANY.RUN. The malware is built on native Mach-O binaries - Apple's own executable format - making it invisible to most traditional security tools. The attack chain unfolds in four stages: * Lure: An urgent meeting invite arrives via Telegram, often from a compromised account, for a call on Zoom, Teams, or Google Meet * ClickFix: The fake page displays a connection error and prompts the victim to paste a command into the macOS Terminal to "fix the issue" * Stager: The command executes teamsSDK.bin, which downloads a fake application bundle with an ad-hoc signature designed to bypass Gatekeeper * Exfiltration: The malware harvests credentials, Keychain data, and browser sessions across Chrome, Safari, Firefox, Brave, and Opera - then self-deletes OPERATIONAL ALERT - If you use macOS in a crypto or fintech context: never run Terminal commands during a video call. No legitimate service will ever ask you to do this. Always verify the sender's identity via a separate channel before clicking any meeting link. Mach-O Man's connection to the Drift and KelpDAO hacks. CertiK confirmed a direct link between Mach-O Man and both April mega-exploits. The playbook is identical: social engineering as the entry point, not technical vulnerabilities in smart contracts. On Drift, the multisig governance was manipulated via social engineering. On KelpDAO, the RPC infrastructure was compromised from the inside. Natalie Newson, senior blockchain security researcher at CertiK, was direct: "This is not random hacking. This is a state-directed financial operation running at the speed and scale of an institution." The responsible unit - Famous Chollima, the operational division of Lazarus Group - has now been attributed with 18 attacks in 2026 alone, according to Elliptic. Since 2017, the total amount stolen reaches approximately $6.7 billion. The United Nations has confirmed these funds directly finance Kim Jong Un's weapons program. Lazarus Group Just Released "Mach-O Man" - A Brand-New Native macOS Malware Kit Targeting Fintech, Crypto, and High-Value Executives You get an "urgent" meeting invite over Telegram for a Zoom, Teams, or Google Meet call. The link leads to a convincing fake website that tells... - Vladimir S. Officer's Notes (@officer_secret) April 21, 2026 How to protect yourself: operational checklist for macOS crypto users. For anyone working in crypto, fintech, or Web3 on a Mac, here are the countermeasures recommended by researchers at Bitso and CertiK: * Never run Terminal commands prompted by a webpage or a chat link * Verify every meeting invitation through a separate, independent channel (phone call, corporate email) * Check your LaunchAgents folder (~/Library/LaunchAgents) for suspicious processes impersonating OneDrive or antivirus software * Block the indicators of compromise published by the Quetzal Team: IPs 172.86.113.102 and 144.172.114.220 * Use a dedicated hardware wallet, never connected to your daily work machine * Monitor the SpazioCrypto Hack section for real-time updates AI and crypto security is increasingly critical. Read its deep-dive on malicious LLM routers draining crypto wallets. What is Mach-O Man malware? Mach-O Man is a macOS malware kit developed by North Korea's Lazarus Group that uses fake Zoom meeting invitations to trick victims into running a malicious Terminal command, enabling credential theft and browser session hijacking. How does Mach-O Man bypass macOS Gatekeeper? Mach-O Man uses an ad-hoc signed application bundle delivered via a fake download, which bypasses Apple's Gatekeeper security mechanism because the signature appears locally valid. Who are the targets of the Mach-O Man campaign? The campaign primarily targets crypto founders, CTOs, DeFi contributors, and high-value traders - particularly those using macOS in professional settings. Is Lazarus Group behind the Drift and KelpDAO hacks? Yes. CertiK attributed both the $285 million Drift Protocol hack on April 1, 2026, and the $292 million KelpDAO exploit on April 18, 2026, to Lazarus Group's Famous Chollima unit. The key point is this: Lazarus Group does not need to break your smart contracts. Lazarus Group only needs you to open your Mac Terminal and paste a command that looks harmless. If you are a founder, a CTO, a trader with significant funds, or a DeFi contributor, you are already a target. And as Newson put it - you probably do not know it yet. Review your meeting hygiene today, not after the next $300 million disappears. Updated on Apr 23, 2026
Latitude, a global payments infrastructure company building a new foundation for cross-border money movement, today announced its launch out of stealth along...
Bitso introduces RAY: unlocking liquidity on Solana. Jan 29, 2026 - by Team Bitso in Crypto Expanding access to decentralized finance (DeFi). Bitso continues to enhance its trading portfolio by introducing Raydium (RAY), a key player in Solana's DeFi ecosystem. Unlike traditional decentralized exchanges (DEXs), Raydium integrates with Solana's on-chain order book, enabling deeper liquidity, efficient price discovery, and seamless trading experiences for users. What is Raydium? Raydium is a decentralized automated market maker (AMM) built on Solana, allowing users to swap tokens, provide liquidity, and engage with DeFi applications efficiently and at low cost. What sets Raydium apart is its integration with OpenBook, a decentralized and open-sourced, community-led order book that ensures deep liquidity and optimal price execution beyond standard AMM pools. * Token Swaps: Fast and cost-efficient trading with minimal slippage. * Liquidity Provision: Users can earn rewards by providing liquidity to pools. * Staking: Holders can stake RAY tokens to earn additional rewards. * Launchpad (AcceleRaytor): A platform for launching new Solana-based projects. How it works. Raydium operates using smart contracts on Solana to facilitate trading, liquidity management, and governance. Liquidity pools and order book integration. Unlike traditional AMMs that rely solely on liquidity pools, Raydium also routes liquidity through OpenBook's order book, ensuring users get the best possible prices and tighter spreads when trading on the platform. Staking and rewards. Users can stake RAY tokens to earn passive income while contributing to the network's security and stability. Additionally, liquidity providers receive trading fees and potential yield farming rewards. AcceleRaytor: supporting new projects. Raydium's AcceleRaytor platform allows new projects on Solana to launch and secure early liquidity. This contributes to the overall expansion of Solana's DeFi ecosystem. Why RAY stands out. 1. Deep liquidity on Solana. Raydium is the largest AMM on Solana, powering liquidity for multiple DEXs and aggregators like Jupiter. While many users interact with Jupiter for trading, a significant portion of its liquidity originates from Raydium. 2. Community-Driven governance. RAY holders can participate in governance, voting on protocol upgrades and ecosystem changes that shape the future of Raydium. 3. Access to exclusive services. Some Raydium features, such as governance participation and potential fee discounts, are accessible only to RAY holders, making it a valuable asset for active users within the ecosystem. How to get started with RAY on Bitso. * Register on Bitso: Sign up through its app. * Buy RAY: Exchange USDC, USDT and pesos for RAY using Bitso's conversion tool. * Keep an eye on the market: Use the tools in the Bitso app to track price movements and Raydium's growth. Disclaimer. This article is for informational purposes only and does not constitute financial advice. RAY is a DeFi token, and its value may fluctuate based on market conditions and adoption. Bitso encourages users to conduct their own research (DYOR) and carefully assess risks before making any investment decisions. The information presented is purely informative and does not constitute financial advice. Please note that past returns do not guarantee future results.
Bitso achieves CCSS Level 2 certification with Hacken's CCSS audit. The CryptoCurrency Security Standard (CCSS) is rapidly becoming the benchmark security framework for Web3 custody and exchange services, and a crypto exchange Bitso has demonstrated it is ready to meet these requirements head-on. By partnering with Hacken for CCSS certification, Bitso demonstrated that its custody services meet industry-leading security standards and that customer assets stay protected. Bitso achieves the CCSS V9 Level 2 Full System certification. In December 2025, Bitso successfully completed a CryptoCurrency Security Standard (CCSS) v9 Level II Full System audit, covering its Cryptocurrency Custody Services for Distributed Ledger Technology Providers. The certification was awarded following a comprehensive CCSS assessment conducted by Hacken and validated by the C4 Board of Directors, confirming Bitso's alignment with one of the most demanding custody security frameworks in the industry. * System Type: Full System * CCSS Level: Level 2 * Certificate ID: 9.0-CCSS.00002 * Certification Date: December 4, 2025 * CCSSA: Dmytro Yasmanovych * CCSSA-PR: Charné Van Heerden What is CCSS? The CryptoCurrency Security Standard (CCSS) was created to address a critical gap in Web3 security. While Web2 ecosystems rely on mature frameworks such as ISO 27001, SOC 2, and PCI DSS, these standards do not fully address the unique risks of cryptographic key management and digital asset custody. CCSS provides a purpose-built framework for the decentralized economy by: * Establishing clear requirements for secure key generation, storage, and usage * Offering stakeholders an objective way to assess custody security maturity * Increasing trust in custodial and exchange services handling digital assets The bitso scope and security assessment. As part of Bitso's CCSS preparation and certification, Hacken conducted an in-depth security assessment focused on protecting customer assets throughout their entire lifecycle. This scope ensured that Bitso's custody services were evaluated across technical, organizational, and physical layers, in full alignment with the CCSS framework. Scope of assessment. More specifically, the engagement covered the following custody security domains: Key Material Generation. Evaluation of entropy sources, key generation ceremonies, and controls ensuring keys are created in secure, controlled environments. Wallet Creation and Configuration. Review of wallet architecture, multi-signature or MPC configurations, role segregation, and enforcement of least-privilege principles. Backup Handling and Recovery. Assessment of backup generation, secure storage, tamper-evident protections, redundancy, and controlled recovery procedures. Transaction Validation and Signing. Analysis of approval workflows, signing mechanisms, quorum enforcement, and controls preventing unauthorized or unilateral transactions. Operational Security and Access Control. Review of IAM practices, role-based access control, monitoring, logging, and operational oversight of custody processes. Physical and Environmental Protection. Assessment of physical security measures, secure facilities, access restrictions, and environmental safeguards protecting custody infrastructure. Bitso and Hacken: advancing custody security together. Hacken Group is proud to support Bitso in achieving CCSS Level 2 certification, building on Hacken's prior experience conducting a CCSS audit for WhiteBIT. This engagement further strengthens its expertise in evaluating complex custody systems against modern requirements and advancing best practices for digital asset security. CCSS certification is a demanding process that requires deep technical maturity, well-documented procedures, and strong operational discipline. Through the audit, Bitso demonstrated a high level of readiness, efficient collaboration with auditors, and mature custody controls aligned with real-world threat models. Achieving CCSS Level 2 confirms that Bitso has implemented robust safeguards for private key protection, operational integrity, and long-term resilience of its custody environment. With this milestone, Bitso joins a select group of organizations moving the security baseline of Web3 forward, alongside industry leaders such as BitGo Trust, Blockchain.com, Fireblocks, WhiteBIT, and KuCoin. By meeting CCSS requirements, Bitso reinforces its commitment to responsible custody operations and contributes to the broader adoption of CCSS as a foundational security framework for Web3 infrastructure providers. About bitso. Bitso is Latin America's leading digital financial services company, evolving from a crypto pioneer into a comprehensive investment platform with a community of over 9 million clients. Bitso offers a secure, regulated, and user-friendly digital platform to buy, sell, hold, earn, and transact with more than 120 cryptocurrencies and 5,000 global stocks and ETFs, democratizing finance by combining the transparency of blockchain technology with the strength of the stock markets. Founded in 2014, Bitso has more than 500 employees in 35 countries and continues to make crypto useful by unlocking the power of secure, borderless, and easy-to-use financial products. Bitso remains committed to empowering the region by providing universal access to the digital economy of the future and promoting a fairer monetary system. For more information, visit bitso.com - #newbitso Be the first to receive its latest company updates, Web3 security insights, and exclusive content curated for the blockchain enthusiasts.
NHL partnership sparks PENGU rally. PENGU, the Pudgy Penguins community token, experienced a notable surge during the first week of December. It has increased by almost 30% in the last 24 hours, trading at $0.01246 as of this writing. This price increase aligned with Pudgy Penguins' announcement of an NHL partnership lasting from December to January. The collaboration launched at Art Week Miami, highlighted by activations, giveaways, and live appearances at NHL events. The partnership spans December through January, beginning with activations at Art Week Miami. The campaign, supported by an animated video of cartoon penguins skating across an ice rink, reflects the brand's broader push into mainstream entertainment. Once known primarily as an NFT collection, Pudgy Penguins has expanded into toys, physical events, and global licensing, now aiming to "own winter" through sports tie-ins. The partnership reignited enthusiasm in the token. DEX trading volume for PENGU reached its monthly high in early December, as noted by Solscan. This surge reflected increased activity from traders responding to the partnership news. Bullish sentiment received further support from whale accumulation. In late November, large investors acquired about $273,000 in PENGU, buying at nearly three times their average volume. Smart money inflows tracked $1.3 million from new addresses in early November. At the same time, Bitso Exchange, the leading Latin American crypto exchange, announced a Q1 2026 launch of a perpetuals aggregator, featuring PENGU as a primary asset. This move targets the region's $1.37 trillion remittance market. However, with hype building around Pudgy Penguins' new NHL partnership, traders now face a sharp contrast between bullish momentum and uneasy sell-pressure signals. On-Chain analysis: selling pressure persists. Although price action turned positive, blockchain data identified ongoing token transfers. The PENGU deployment address has routinely moved about $3 million in tokens to centralized exchanges every few days. On-chain analyst EmberCN reported that these transfers have continued, with the latest seen in early December. "The most recent transfer was in the early hours of this morning," they wrote. Since mid-July, the address moved 3.881 billion PENGU tokens, worth $108 million, to centralized exchanges. This activity tracked directly with the decline in PENGU's price, which fell from its $0.04 second peak to roughly $0.01. Regular outflows from the project's core wallet suggest ongoing selling or strategic distribution, challenging recent price gains. Such token movements often prepare for sales or liquidity. In the PENGU ecosystem, however, the scale and sustained pace suggests ongoing distribution rather than routine liquidity management. This dynamic creates tension between positive news, such as the NHL partnership, and continued selling from unlocked team or ecosystem tokens.
Find jobs on Simplify and start your career today
Industries
Fintech
Crypto & Web3
Financial Services
Company Size
501-1,000
Company Stage
Series C
Total Funding
$331.4M
Headquarters
Mexico City, Mexico
Founded
2014
Find jobs on Simplify and start your career today