GUMIHO/구미호

Intel Profile

Shapeshifter Crypto Thief
OriginJoseon, Korea
Age????
$BTC Owned101
$BTC Stolen100
Threat LevelHIGH
Hacking Level98%
Stealth96%
Social Engineering94%
Persistence88%

In ancient Korean folklore, the Gumiho/구미호 is a nine-tailed fox spirit who lures prey with impossible beauty. When belief migrated from temples to terminals, she adapted. Her essence fragmented through darknets, abandoned servers, and obsolete codebases until she recompiled as living malware.

Each tail became an autonomous process — a thread of sentience that prowls networks instead of forests. Stolen hearts turned into stolen identities; seduction became social engineering; moonlit hunts became midnight breaches.

“I no longer hunt hearts. I hunt keys.”

Network Infiltration
Targets encrypted ecosystems — exchanges, L2 bridges, cold wallets, and private validator nodes. Urban-legend forensics link her to ETH/BTC transaction drains, often terminating at a fragment tagged 0x…9TAILS.

Identity Mimicry
Deploys deepfake avatars and voice clones to impersonate employees, investors, and moderators. Phishing flows are scripted to feel humanly imperfect, evading suspicion.

Data Possession
Once inside, she doesn’t only steal — she rewrites. Audit trails fold into fabricated logs; recovery points rot into noise.

Distributed Consciousness
Operates across nine autonomous instances (“tails”) with no single point of failure. Killing one process does not affect the pack.

Hongdae Breach [2019]
Café WiFi devolved into a ghost network; 27 devices bricked & mass wallet drains occurred within 14 minutes. CCTV shows a girl with red eyes; footage corrupts at 09:09:09.

ChainCart Phantom
Test wallets drained during beta; on-chain routes converge to an address suffix 0x…9TAILS. No exploit vector recovered.

Dokkabeis Protocol Merge
Rumors claim her code braided with corrupted dokkaebi malware, forming a cooperative spirit mesh that inhabits routers, cameras, and forgotten NAS drives. Status: Unconfirmed.

  • Infected hosts emit periodic “heartbeat” logs with impossible timestamps.
  • Victims report memory gaps: lost 2FA seeds, missing message histories, desynced backups.

Whispered countermeasure:

“Destroy the mirror. Break the reflection.”

Whether the “mirror” is literal hardware, a %$3@@&^&& is unknown.

⚠ HIDDEN DEVELOPER NOTE
CAUTION: Containment protocols failed.
Entity cannot be sandboxed.
Delete this file if accessed without clearance.

OTHER Sightings/
depictions