B1 first appeared on a dark web forum called /void/chat, posting a decrypted copy of a pharmaceutical company’s internal safety report — not to extort them, but to expose that a faulty batch of insulin had been quietly buried. No ransom note. No manifesto. Just the data, timestamped, with a PGP signature reading B1 .
For three years, B1 has been the most elusive, contradictory, and oddly principled operator in the global cyber underground. Not quite a black hat. Not quite a white hat. Something else entirely. “B1 isn’t a person. It’s a role,” says Dina Kaur, a former NSA cyber threat analyst who has tracked the entity since 2023. “The name comes from chess — the B1 square. It’s the starting position of a knight. That piece doesn’t move in straight lines. It jumps.” hacker b1
No ransom. No threat. Just a warning — delivered illegally, but undeniably useful. B1 first appeared on a dark web forum
But a rival theory has emerged recently. In April of this year, a cybersecurity firm published an analysis of B1’s coding style: unusually clean, heavily commented, and adhering to military-grade secure coding standards. The conclusion: B1 might be a defector from a nation-state cyber unit — someone who learned to break systems at scale, then turned that knowledge against negligence rather than enemies. Just the data, timestamped, with a PGP signature reading B1