Gabriel Kimiaie Asadi Bildstein | |
|---|---|
| Born | July 11, 1999 Tarbes, France |
| Other names | Kuroi'SH, Nclay |
| Known for | Alleged involvement in high-profile cyberattacks associated with hacking groups ShinyHunters and GnosticPlayers. |
Gabriel Kimiaie Asadi Bildstein (born July 11, 1999, in Tarbes, France) is a French individual alleged to have participated in a series of high-profile cyberattacks under the pseudonyms Kuroi'SH and Nclay and as a member of the hacking groups GnosticPlayers and ShinyHunters. [1] He has been linked to cybersecurity breaches involving NASA, Google Brazil, Vevo, Coinrail, GateHub, and Canva. [2] [3] Although he has been indicted in both France and the United States, he has not been convicted. His diagnosis of Asperger syndrome has reportedly influenced legal assessments of criminal responsibility. [4]
In 2015, Bildstein allegedly participated in the defacement of subdomains belonging to NASA and Google Brazil under the alias "Kuroi'SH". Messages such as "Hacked by Kuroi'SH" appeared on the compromised pages. [5] The campaign was attributed to a group calling itself "The Intrud3rs". [6]
In May 2018, he and another individual using the alias "Prosox" were involved in defacing the Vevo YouTube channel, altering popular music videos, including Luis Fonsi's Despacito . [7] The attack changed the titles, descriptions, and thumbnails of the videos to reflect messages attributed to Kuroi'SH and Prosox. [8] Both individuals were later arrested and charged in France. [9]
Bildstein was linked to the June 2018 breach of Coinrail, a South Korean cryptocurrency exchange. Approximately $40 million in cryptocurrency was stolen. [10] He reportedly admitted involvement to French investigators in 2021 and was indicted in connection with the hack in 2025. [11]
Bildstein is believed to have been a key member of the hacking group "GnosticPlayers", [12] which claimed responsibility for breaches affecting companies including Canva, MyFitnessPal, Zynga, MyHeritage, and Dubsmash. [13]
In 2019, Bildstein was allegedly involved in the theft of more than $9.5 million in XRP tokens from the GateHub platform. [14] Authorities seized multiple luxury vehicles from his home in Tarbes. [15] He was arrested and charged in France. [16]
Bildstein is also suspected of involvement with the group ShinyHunters, linked to data breaches of Microsoft, AT&T, and Ticketmaster. [17] In 2022, French police raided his home in Tarbes. [18] He was questioned by FBI agents and later indicted by the United States Department of Justice for conspiracy to commit computer intrusion. [19] Due to France's policy of not extraditing its nationals, it is unlikely he will be tried in the U.S. [20]