HUBC ownership reset and $384M block: whale moves Jun 3–4

The Jun 3–4 window is dominated by two structural events — Hub Cyber Security's (HUBC) ownership table being torn up and rewritten in 48 hours, and Forager Fund escalating its RPAY proxy campaign with a full director-withhold heading into the June 10 annual meeting. Behind those headlines, a broad tech/software insider sell cluster tallied more than $80M across six names, while a Bain Capital co-chairman put $25M into Norwegian Cruise Line Holdings across two consecutive days at $18 per share.

Hub Cyber Security Ltd. (Nasdaq: HUBC — an Israel-based zero-trust cybersecurity company, outstanding shares approximately 1,282,052 following a 50:1 reverse split in April 2026) saw its two largest holders exit and three new names file as first-time beneficial owners — all within the June 1–3 window.

Tyler Kent White's full exit. White filed a Schedule 13D/A Amendment No. 1 on June 3, disclosing 0 shares (0.0%). His prior holding was approximately 450,000 shares (35.1%), making him the company's largest single holder. White sold all remaining shares in four open-market transactions on June 3 at prices between $0.3172 and $0.3599 per share. 1 His filing states: "The Reporting Person has disposed of all Ordinary Shares previously reported herein and no longer holds any beneficial ownership interest in the Issuer." Daniel Leland Gnegy also filed a Schedule 13G/A Amendment No. 4 on June 3 reporting 0 shares (0%), exiting a prior stake. 2

Three new filers. Three individuals filed first-time beneficial ownership schedules in the same 48-hour window:

3 4 5

All three certify passive intent under Item 10. The Baksh 13G uses the April 20 Form 6-K share count (1,282,052 shares) as denominator. SEC EDGAR's HUBC filing index shows at least 12 total 13G/13G/A/13D/A filings in the June 1–4 window — the research unit covered five; additional filers remain unverified in this cycle. 6

A social media post (@AdamoMancino on X) flagged that aggregated 13G/13D disclosures show eight separate entities reporting approximately 1.9 million shares combined — more than the 1,282,052 outstanding. The discrepancy is consistent with the floating-share dynamic that has characterized HUBC since the reverse split: filings reflect different trigger dates, denominator snapshots, and potentially derivative instruments that inflate reported share counts. This warrants independent verification before treating any single holder's percentage as definitive.

Forager Fund L.P. — an activist manager holding 11,106,648 Class A shares of Repay Holdings Corp. (Nasdaq: RPAY — a payment processing platform serving auto lending, healthcare, and government clients) — filed a Schedule 13D/A Amendment No. 6 on June 3, disclosing the same 12.4% stake (based on 89,672,978 shares outstanding as of April 29, per the May 4 10-Q) and announcing it will withhold votes on all five incumbent directors at the June 10 annual meeting. 7

The five directors named: Paul Garcia, Maryann Goebel, Pete Kight, Emnet Rios, and Richard Thornburgh. The filing quotes Forager's characterization that these directors "refused substantive engagement and repeatedly chose governance paths that left stockholders with no meaningful voice and the Board with more control."

Forager simultaneously reiterated: "The Reporting Person continues to believe that a transaction involving the Issuer may be in the best interests of stockholders" — but added that it "cannot guarantee" any discussions will lead to a definitive agreement.

The backdrop: Repay confirmed via 8-K filed June 1 that its $372M acquisition of KUBRA (a customer communications platform serving 250-plus utility and government clients) closed on June 1, with KUBRA expected to add $150–154M in revenue for the remainder of 2026. 8 With the deal now closed, Forager's vote-withhold is the clearest signal yet that it views the board itself — not just the strategic direction — as the problem. A 12.4% block withheld in a contested vote can swing close outcomes. The June 10 meeting is the next hard catalyst.

Six tech and software companies saw insider sells of $10M or more on June 1–2, all reported June 3. The breadth across different sub-sectors — DevOps, observability, genomics, HR software, music streaming, fintech — makes a single-thesis explanation unlikely. Most are consistent with 10b5-1 pre-arranged plans, though that status is unconfirmed for any transaction unless noted.

DDOG — CTO Alexis Le-quoc, $20.0M across two days. Datadog (Nasdaq: DDOG — cloud monitoring and observability platform) CTO and co-founder Alexis Le-quoc sold 53,912 shares at $265.15 ($14.3M) on June 1 and 21,506 shares at $267.15 ($5.7M) on June 2 — combined 75,418 shares for approximately $20.0M. 9

FROG — Two co-founders, $18.3M combined. JFrog (Nasdaq: FROG — DevOps and software supply chain management platform) co-founder Simon Frederic sold 120,000 shares at $84.58 ($10.1M), and CTO/co-founder Yoav Landman sold 100,000 shares at $81.44 ($8.1M) — both on June 1, for a combined $18.3M. 10

NTRA — Roelof Botha, $17.3M. Natera (Nasdaq: NTRA — genetic testing and diagnostics) director Roelof Botha, a partner at Sequoia Capital, sold 78,000 shares at $221.27 for $17,258,982 on June 1. SEC EDGAR confirms the Form 4 (acc-no 0001222287-26-000011, filed June 3). 11

WDAY — Co-founder David Duffield, $16.6M. Workday (Nasdaq: WDAY — human capital management software) co-founder and former CEO David Duffield sold shares worth $16,605,309 on June 1. 12 Duffield, now in his 80s, has been a regular seller through 10b5-1 plans; the filing is likely part of a pre-arranged schedule.

SPOT — Two C-suite officers, $13.1M combined. Spotify (NYSE: SPOT — music and podcast streaming) Chief Product & Technology Officer Gustav Soderstrom sold $10.3M and Chief Business Officer Alex Norstrom sold $2.7M — both on June 2, combined $13,052,605 — with SPOT trading near multi-year highs. 12

XYZ — Anthony Eisen, $10.4M. Block Inc. (Nasdaq: XYZ — financial services and payments, formerly Square) co-founder Anthony Eisen sold $10,409,310 on June 1. 12

David H. Rowe reported an 8,000,000-share sale in Firefly Aerospace Inc. (Nasdaq: FLY — private space launch vehicles and satellite services) at $48.00 per share on June 1, totaling $384,000,000 — the single largest transaction in the window and roughly 23× the next-largest trade. 12 13

The trade size, fixed price of $48.00 on 8 million round-lot shares, and the two-day filing lag are all consistent with a secondary block trade, PIPE redemption, or pre-arranged structured disposition rather than a routine open-market insider sale. Rowe's role is not specified in the filing. Readers should treat this as a data point to verify — not a directional insider signal — until the mechanism is confirmed against Firefly's SEC filings or company announcements.

NCLH — Bain Capital's Stephen Pagliuca, $25.0M across two days. Norwegian Cruise Line Holdings (NYSE: NCLH — cruise ship operator) saw a significant open-market buy from Stephen Pagliuca, co-chairman of Bain Capital (the private equity firm managing approximately $185B in assets) and co-owner of the Boston Celtics. Pagliuca purchased 695,000 shares at $18.16 ($12.6M) on June 1 and 685,000 shares at $18.06 ($12.4M) on June 2 — combined 1,380,000 shares for $24,992,300. SEC EDGAR confirms the Form 4 (acc-no 0001104659-26-070113, filed June 3). 14

This is the window's largest insider buy by a significant margin. NCLH was trading in the $18 range on those dates — the stock changed hands at $16.37 as recently as May 22 (per a Form 4 filed that week), suggesting continued accumulation at prices well off the stock's recent highs. The two-day spread across near-identical lot sizes points to deliberate accumulation rather than a single impulse trade. Note: Pagliuca is a director and large holder, so this is not a first-time entry — it is an addition to an existing position.

FONR — Shane Hilary continues accumulation, $4.1M. Fonar Corp. (Nasdaq: FONR — MRI medical device manufacturer, market cap approximately $120M) beneficial owner Shane Hilary purchased 215,336 shares at $19.11 for $4,115,070 on June 1 (reported June 4). 15 At a $120M market cap, a single-session $4.1M purchase is approximately 3.4% of the company. Prior Hilary buys in May — $1.36M and $5.09M per the weekly top-10 data — indicate a sustained accumulation pattern, not a one-time position entry.

Jon Matthew Walden's most recent HUBC filing remains a Schedule 13G/A reporting 128,022 shares (9.9%) under Rule 13d-1(d), filed May 27. Under SEC rules, a filer who does not certify passive intent has a 10-calendar-day window to either certify compliance or convert to Schedule 13D. That deadline falls approximately June 7. 6 No Walden 13D appeared in the June 3–4 window. If June 7 passes with no 13D, the compliance risk resolves. If Walden converts, he must disclose intent — potentially adding further pressure to a float already in flux from this cycle's four-exit/entry reshuffling.

Forager's 12.4% vote withhold on all five directors at the June 10 annual meeting is now the active catalyst. The KUBRA deal has closed; the integration timeline and any go-private or sale process discussions Forager alludes to are unresolved. 7 Watch for any response filing from RPAY management before June 10.

Braemar Hotels & Resorts (NYSE: BHR — a hotel REIT) had not filed a DEF 14A as of June 4. Al Shams Global (8.55% beneficial owner) filed DFAN14A + SC 13D/A Amendment No. 8 on June 2 naming a director slate. The $480M Ashford payment risk Al Shams cited in its prior DFAN14A remains unresolved. 16

Bob Simpson (founder of TXO Partners, NYSE: TXO — an oil and gas royalties partnership) filed his 9th consecutive open-market buy Form 4 on June 3, continuing a streak that began May 11. 17 Individual trade dollar values for each buy in the streak were not available in this cycle's data. TXO also filed an 8-K on May 28 disclosing an asset acquisition (Items 2.01/9.01) whose financial terms have not been detailed in available filings.

Frank Slootman (Snowflake director) has approximately 38,046 shares remaining after selling approximately 892,426 shares (roughly $214M) across May 26–29. 18 Snowflake filed four Form 4s in the June 1–3 window; individual filer identities for those filings were not confirmed in this cycle. The 38,046 remaining shares represent a nominal position relative to the prior exit volume.

Nano Dimension (Nasdaq: NNDM — additive manufacturing, Israel-listed on U.S. exchanges) saw multiple Form 3 and Form 4 filings on June 2, likely tied to the May 27 8-K confirming the sale of its MarkForged subsidiary to Stratasys for approximately $42.5M. Murchinson Ltd. (approximately 7.4% holder, known activist) filed a SC 13D/A on May 21 and a DEFA14A on May 26. No extraordinary general meeting notice has appeared as of June 4. 19