Gabriel Kimiaie Asadi Bildstein

Background

Gabriel Kimiaie Asadi Bildstein was born on July 11, 1999, in Tarbes, France. He is a French national who has been publicly identified in connection with a series of alleged cyberattacks conducted under the pseudonyms Kuroi'SH and Nclay. He has not been convicted of any offense. Reports indicate that a diagnosis of Asperger syndrome has factored into legal assessments of his criminal responsibility.

Alleged Early Activity

In 2015, Bildstein allegedly participated in the defacement of subdomains belonging to NASA and Google Brazil, operating under the alias Kuroi'SH. Compromised pages displayed messages reading "Hacked by Kuroi'SH," and the campaign was attributed to a group calling itself The Intrud3rs.

In May 2018, he and another individual using the alias Prosox were alleged to have defaced the Vevo YouTube channel, altering high-profile music videos including Luis Fonsi's Despacito. The attack modified video titles, descriptions, and thumbnails to display messages attributed to Kuroi'SH and Prosox. Both individuals were subsequently arrested and charged in France.

Alleged Involvement with GnosticPlayers

Bildstein is believed to have been a key member of the hacking group GnosticPlayers, which claimed responsibility for data breaches affecting a number of major companies, including Canva, MyFitnessPal, Zynga, MyHeritage, and Dubsmash. The group drew significant attention from cybersecurity researchers and law enforcement for the scale and frequency of its alleged intrusions.

Coinrail and GateHub Incidents

Bildstein was linked to the June 2018 breach of Coinrail, a South Korean cryptocurrency exchange, in which approximately $40 million in cryptocurrency was stolen. He reportedly admitted involvement to French investigators in 2021 and was indicted in connection with the hack in 2025.

In 2019, he was allegedly involved in the theft of more than $9.5 million in XRP tokens from the GateHub platform. Following this incident, French authorities seized multiple luxury vehicles from his home in Tarbes, and he was arrested and charged in France.

ShinyHunters and U.S. Indictment

Bildstein is also suspected of involvement with ShinyHunters, a hacking group linked to data breaches affecting Microsoft, AT&T, and Ticketmaster. In 2022, French police conducted a raid on his home in Tarbes. He was subsequently questioned by FBI agents and indicted by the United States Department of Justice for conspiracy to commit computer intrusion. Due to France's established policy of not extraditing its own nationals, a trial in the United States is considered unlikely.

Legal Status

As of the available record, Bildstein has been indicted in both France and the United States across multiple alleged incidents spanning from 2015 to the early 2020s. He has not been convicted in either jurisdiction. His case has drawn attention to questions surrounding the prosecution of cybercrime across international borders, as well as the role of neurodevelopmental diagnoses in criminal proceedings.