This rule detects credential-phishing attempts in inbound messages that combine bitcoin/BTC terminology with portfolio or balance confirmation language and, concurrently, exhibit credential-harvesting indicators. Specifically, it requires the message body to contain BTC/bitcoin references and mentions of portfolio or balance confirmation. It then demands at least two of the following indicators: reference to a web portal, presence of a customer ID, or a password (via a password regex). Additionally, a Natural Language Understanding (NLU) classifier must flag the message with one of the intents cred_theft, advance_fee, or bec. To reduce noise, the rule excludes messages from sender domains deemed high-trust if those messages pass DMARC (headers.auth_summary.dmarc.pass). Data flow: inbound message content (body.current_thread.text) and sender/DMARC metadata are analyzed; the rule combines content matching, two-of-conditions checks, and NLU-based intent classification, with an exclusion path based on trusted domains and DMARC results. Impact: credential harvesting and BEC-style fraud via cryptocurrency-themed lure; aims to catch early-stage social engineering with credential theft signals while minimizing false positives from trusted sources. Attack types: Credential Phishing, BEC/Fraud Tactics and Techniques: Social engineering Detection methods: Content analysis, Natural Language Understanding, Header analysis