Gabriel Kimiaie Asadi Bildstein

Gabriel Kimiaie Asadi Bildstein (born July 11, 1999, in Tarbes, France) is a French individual alleged to have participated in a series of high-profile cyberattacks under the pseudonyms Kuroi'SH and Nclay and as a member of the hacking groups GnosticPlayers and ShinyHunters. He has been linked to cybersecurity breaches involving NASA, Google Brazil, Vevo, Coinrail, GateHub, and Canva. Although he has been indicted in both France and the United States, he has not been convicted. His diagnosis of Asperger syndrome has reportedly influenced legal assessments of criminal responsibility.

Allegations In 2015, Bildstein allegedly participated in the defacement of subdomains belonging to NASA and Google Brazil under the alias "Kuroi'SH". Messages such as "Hacked by Kuroi'SH" appeared on the compromised pages. The campaign was attributed to a group calling itself "The Intrud3rs".

In May 2018, he and another individual using the alias "Prosox" were involved in defacing the Vevo YouTube channel, altering popular music videos, including Luis Fonsi's Despacito. The attack changed the titles, descriptions, and thumbnails of the videos to reflect messages attributed to Kuroi'SH and Prosox. Both individuals were later arrested and charged in France.

Bildstein was linked to the June 2018 breach of Coinrail, a South Korean cryptocurrency exchange. Approximately $40 million in cryptocurrency was stolen. He reportedly admitted involvement to French investigators in 2021 and was indicted in connection with the hack in 2025.

Bildstein is believed to have been a key member of the hacking group "GnosticPlayers", which claimed responsibility for breaches affecting companies including Canva, MyFitnessPal, Zynga, MyHeritage, and Dubsmash.

In 2019, Bildstein was allegedly involved in the theft of more than $9.5 million in XRP tokens from the GateHub platform. Authorities seized multiple luxury vehicles from his home in Tarbes. He was arrested and charged in France. Other suspected involvement Bildstein is also suspected of involvement with the group ShinyHunters, linked to data breaches of Microsoft, AT&T, and Ticketmaster. In 2022, French police raided his home in Tarbes. He was questioned by FBI agents and later indicted by the United States Department of Justice for conspiracy to commit computer intrusion. Due to France's policy of not extraditing its nationals, it is unlikely he will be tried in the U.S.