Belgium’s financial regulator has escalated enforcement under the EU’s Markets in Crypto-Assets (MiCA) framework by issuing a fresh warning to consumers about six crypto-asset service providers (CASPs) it says are operating without authorization. The notice comes days after the EU’s MiCA transitional period ended, pushing regulators across member states into a more active licensing enforcement phase.

On Monday, the Financial Services and Markets Authority (FSMA) published a list of entities it identified as unauthorized CASPs active in Belgium. The regulator named Aurum Foundation, Bank Bit, Bithf Pro, Dxago, Global Dynamic Trade, and ZeriaFunding, and said it has added them to its roster of fraudulent CASPs.

Key takeaways

• FSMA warns consumers not to engage with six named crypto firms it says are not authorized under MiCA in Belgium.
• The regulator urges users to verify a provider’s status using the official FSMA CASP register before depositing funds or trading.
• MiCA entered into force at the end of 2024, and Belgium’s transitional licensing window closed on July 1.
• FSMA reiterates that crypto assets are volatile, may face liquidity constraints, and are not protected by compensation schemes that could reimburse losses.

FSMA names six unauthorized CASPs in Belgium

FSMA’s consumer warning is anchored in the idea that MiCA authorization is now the gatekeeper for crypto services offered in the country. In its notice, the regulator points out that the specified CASPs are operating without the required permission and therefore fall outside the legal perimeter set by Belgium’s MiCA guidance.

The FSMA advised consumers to reject offers from the named companies and to check whether any crypto-asset provider appears on its official CASP register. That emphasis matters for users because it shifts the compliance question from “is this company active?” to “is it authorized to operate what it claims to offer in Belgium?”

FSMA also reminded readers that even legitimate crypto activity carries risk: crypto assets can be highly volatile, liquidity can be limited, and—critically—losses are not covered by a compensation scheme that would reimburse clients in the event of provider failure.

MiCA licensing moves from transition to enforcement

MiCA entered into force at the end of 2024 and establishes a harmonized EU-wide framework for CASPs and issuers. According to FSMA’s guidance, authorized CASPs are the only entities permitted to offer a range of crypto asset services in Belgium, including custody, trading platforms, exchange services (both crypto-to-fiat and crypto-to-crypto), order execution, transfer services, advice, and portfolio management.

Belgium’s transitional regime expired on July 1—the same day by which existing providers across the EU were generally required to obtain authorization or stop offering crypto-asset services. In practice, that timing is what turns the MiCA deadline into an enforcement moment: regulators can more clearly differentiate between entities actively complying with authorization requirements and those that continue to market services without approval.

Earlier coverage from Cointelegraph noted that the transition period gave some companies time to apply and adjust operations ahead of the formal licensing cut-off. As that period ended, enforcement actions like FSMA’s warning suggest regulators are now leaning harder into compliance checks rather than relying on transitional cover.

Pressure on European crypto firms around July 1

The July 1 deadline has been a recurring stress point for crypto businesses that planned to operate within the EU while navigating authorization requirements. In June, Cointelegraph reported that Binance withdrew its MiCA application in Greece and intended to seek authorization in another EU jurisdiction just before the deadline.

At the time of the withdrawal, Binance said it was “not leaving Europe,” while acknowledging that some users could be affected during the compliance process. That episode illustrated a broader pattern: the closer firms got to July 1, the more authorization strategies became dependent on selecting the right jurisdiction and meeting local procedural requirements under the broader MiCA regime.

While FSMA’s latest warning focuses on unauthorized entities, the Binance case highlights the difference between firms that are actively attempting to route compliance correctly versus those that continue operating without authorization at all. For investors and users, that distinction is practical: the risk profile changes when a provider is unlicensed under the regime designed to regulate custody, exchanges, and related services.

What Belgium users should do now

FSMA’s notice is straightforward in its consumer orientation. The regulator’s advice is to avoid the named companies and to verify any crypto-asset provider through the official CASP register before sending funds or relying on services such as custody or trading access.

Given FSMA’s reminder that crypto exposures are not protected by compensation schemes, the regulator’s warning underscores a key investor takeaway: authorization is not just paperwork—it can signal that the provider falls under a supervisory perimeter, which matters when liquidity problems or platform disruptions occur.

Readers should watch how FSMA’s enforcement posture evolves in the weeks ahead, particularly whether additional CASPs are added to its warnings list and how quickly consumers see authorization status reflected in the regulator’s CASP register following the end of the transitional period on July 1.

The Trump administration’s push to establish a US Strategic Bitcoin Reserve has reportedly hit a roadblock, as the Commerce and Treasury departments are at odds over how the reserve should be structured and which agency should have primary oversight of the holdings.

US President Donald Trump’s March 2025 executive order called for the SBR to be housed inside the Treasury Department, while other agencies would assist with asset seizures to build the reserve. 

However, concerns have emerged over whether the Treasury has the legal authority to manage the Bitcoin (BTC) holdings, partly because of its volatility, Bloomberg reported Monday, citing people familiar with the matter. 

The Commerce Department has emerged as a contender to oversee the reserve, they said. The Department of Justice is also reportedly working with the departments to determine legally available options, they added.

The Bitcoin reserve is a key part of Trump’s plan to make the US the “crypto capital of the world,” marking a major shift in the government’s approach to digital assets by positioning Bitcoin as a strategic reserve asset rather than a seized commodity.

“To deliver on the President’s vision, the Trump administration continues to evaluate the best structure for a Strategic Bitcoin Reserve and US Digital Asset Stockpile,” White House spokesperson Liz Huston told Cointelegraph.

Source: Cointelegraph

The US currently holds 328,372 Bitcoin worth $21.1 billion — the most of any nation-state — but has sold portions through court-ordered actions over the years.

Senators look to codify the Bitcoin reserve

Efforts have been made to codify the Bitcoin reserve in Congress through the BITCOIN Act and ARMA Act, introduced in May, which seek to acquire 1 million Bitcoin over five years using budget-neutral strategies.

Related: Has Strategy’s capital overhaul put an end to ‘death spiral’ fears?

One of the White House’s top crypto advisers, Patrick Witt, described ARMA as “Version 2” of the BITCOIN Act and said the White House had spent significant time examining the legal implications of creating a Bitcoin reserve. 

“It’s a breakthrough as far as getting everything in place — legally sound — properly safeguarding the assets,” Witt said at the time.

Under ARMA, Bitcoin must be held for at least 20 years unless it is sold to reduce America’s national debt, which is nearing $40 trillion.

Bitcoin reserve developments viewed bullishly

Despite the interagency issues, many industry advocates say the SBR could strengthen the case for Bitcoin as a strategic reserve asset.

“The Strategic Bitcoin Reserve isn’t just bullish for Bitcoin. It validates an entirely new category of capital allocation,” Tim Kotzman, host of the Bitcoin Treasuries Podcast, said.

“Public companies moved first. Nation-states are beginning to follow.”

While 15 nation-states hold Bitcoin, El Salvador is the only country that has formally established a Bitcoin reserve and is making routine purchases.

Magazine: Does ‘Paper Bitcoin’ mean there’s an unlimited supply of BTC?

Crypto losses from hacks and scams dropped in the first half of 2026, according to new figures cited by CertiK. In the period, overall losses fell 46.8% year-on-year to $1.32 billion—yet the security firm argues the headline decline is deceptive, pointing to a shift toward more targeted and destructive attacks.

CertiK’s report breaks the half-year down by quarter: phishing drove $508.2 million in losses in Q1, while wallet compromises became the dominant threat in Q2 with $807.5 million attributed to that attack vector. The firm also highlighted that more than 70% of Q2 losses came from two major incidents—KelpDAO and Drift Protocol—events tied to North Korean state-sponsored hacking activity.

Key takeaways

• First-half 2026 crypto losses fell 46.8% year-on-year to $1.32 billion, but CertiK says the reduction does not indicate a safer ecosystem.
• Attack dynamics shifted: phishing dominated Q1 ($508.2M), while wallet compromises were the largest driver in Q2 ($807.5M).
• Over 70% of Q2 losses were linked to the KelpDAO and Drift Protocol hacks, which are believed to involve North Korean state-sponsored actors.
• CertiK warns attackers are becoming more “targeted and more financially destructive per event,” even if total dollars stolen appear lower.
• TRM Labs reported a sharp rise in the number of incidents in H1 2026 (83 to 207), reinforcing that volume—not just dollar totals—matters.

Why “losses down” may be the wrong signal

At first glance, the year-on-year decline looks encouraging. CertiK, however, cautions against interpreting the data as evidence that security has improved. The firm told Cointelegraph that a “headline reading” of losses down nearly 50% could mislead readers because the prior-year comparison was distorted by an exceptionally large theft.

CertiK specifically referenced the $1.4 billion Bybit hack as the type of outlier that can skew year-over-year comparisons. In the same reporting, CertiK noted that such comparisons can mask underlying changes in attacker behavior—particularly as threat actors adapt tactics and select targets more precisely.

This is where the firm’s analysis becomes investor- and operator-relevant: if the ecosystem is seeing fewer total dollars stolen but more attacks that are more damaging per incident, then risk is not actually decreasing. Traders may feel this first as volatility tied to exploit headlines, but the deeper impact lands on protocols, custodians, and institutions that must continually adjust defensive controls.

Phishing vs. wallet compromise: Q1 and Q2 split

CertiK’s quarterly breakdown shows how different attack categories shaped the first half of the year. In Q1, phishing was responsible for the bulk of losses, totaling $508.2 million. By Q2, the picture changed significantly: wallet compromises contributed $807.5 million, making that category the largest single driver of losses during the quarter.

For market participants and builders, that shift matters because it points to different failure modes. Phishing typically targets human behavior—seed phrases, approvals, and credentials—while wallet compromise often reflects deeper weaknesses around key custody, multisignature operations, signing procedures, and operational security. The change in the dominant vector suggests defenders cannot rely on improvements in one area alone; they have to treat the security stack as layered.

North Korean hacking remains central, and volume may be rising

CertiK’s report places disproportionate emphasis on state-linked activity during Q2. More than 70% of the losses in the quarter came from the KelpDAO and Drift Protocol hacks. Cointelegraph previously reported on both incidents, including coverage of KelpDAO being exploited and the Drift Protocol hack raising questions about the protocol’s response.

Beyond the immediate losses, the incidents also intersect with government-level discussion. The attacks reportedly even prompted a late-month meeting between US, Japanese and South Korean authorities focused on mitigating North Korea’s cyber activity and illicit revenue generation. Officials also acknowledged that North Korean IT workers are increasingly using AI to improve their schemes—an issue cybersecurity leaders believe can increase the scale, speed, and sophistication of protocol exploitation.

CertiK’s broader warning aligns with another dataset. TRM Labs, in its H1 2026 reporting, argued that declining total dollars stolen should not be mistaken for a safer environment. In TRM’s analysis, the number of incidents more than doubled from 83 to 207 in the first half of 2026, the highest number TRM has recorded across a six-month period. TRM also found that smart contract exploits accounted for 125 incidents—about 60% of all events—in H1.

That juxtaposition is important: even if fewer dollars are being stolen than in a year with record outliers, the ecosystem can still be exposed to a higher frequency of attacks. More incidents mean more operational disruptions, more incident response overhead, and more opportunities for failures—especially in fast-moving DeFi environments.

Private key management: the “most consequential” security surface

CertiK singled out private key handling as the area most likely to determine outcomes for attackers. According to the firm, private keys and multisignature wallet management remain the “most consequential security surface” for exploitation—particularly because weaknesses there can enable large transfers even when other controls appear in place.

To address this, CertiK urged protocols and institutions holding significant onchain assets to harden every layer of private key management. The recommendations span hardware security, multisignature governance, and even the geographic distribution of signers. The core argument is that defenses should be designed to reduce the chance that a single point of compromise results in irreversible loss.

CertiK also framed security investment as asymmetric: it said this is an area where spending on the right controls can produce unusually large risk reduction relative to the cost. That theme echoes long-standing guidance from hardware wallet providers. For example, Ledger has previously warned users to keep seed phrases offline and never share them, emphasizing that basic operational discipline remains one of the most effective barriers to phishing-driven theft.

While these recommendations may sound familiar, the data behind them—especially Q2’s wallet compromise losses—underscores that key management is not a “set it and forget it” task. Attackers often shift tactics toward whatever control surface shows the most leverage, and wallet compromise outcomes suggest that leverage is still available to criminals and state-linked groups.

Looking ahead, the key question is whether the first-half pattern persists: phishing-heavy losses in the first quarter followed by wallet compromises and concentrated state-linked incidents in the next. Readers should watch not only aggregate loss totals, but also incident frequency, which TRM’s reporting suggests is rising—an indicator that the threat environment may be intensifying even when dollar figures temporarily fall.

Richard Heathcote, the former chief investment officer of stablecoin issuer Tether, is reportedly looking to sell part of his stake in the company. Bloomberg, citing people familiar with the matter, said Heathcote wants to liquidate only a portion of his 1.26% ownership in Tether, after stepping down from the role in March to move into an advisory position.

Tether’s continued private ownership structure makes any sale by a senior insider notable. The company behind USDt (USDT)—the largest stablecoin by market capitalization—remains privately held even as it operates at massive scale, with circulating supply of roughly $184 billion and a reported share of about 59% of the stablecoin market, according to DefiLlama data.

Key takeaways

• Bloomberg reports Richard Heathcote plans to sell only part of his 1.26% stake in Tether, after leaving his chief investment officer post in March.
• USDT remains dominant in stablecoin markets, with DefiLlama estimating around $184 billion in circulating supply and ~59% share.
• The reported sale unfolds alongside increased regulatory friction for USDT in Europe, including delistings by MiCA-authorized platforms.
• Broader capital-market ambitions continue elsewhere in crypto, with multiple exchanges weighing—but adjusting—paths toward IPOs.

Insider ownership sale spotlights Tether’s private structure

Heathcote’s reported plan offers rare visibility into Tether’s ownership. With the company privately held, there is limited public detail on how large stakeholders are positioned, how their holdings evolve, or whether any strategic shifts accompany changes in leadership and investment oversight.

Bloomberg said Heathcote exited his chief investment officer role in March to take an advisory position after overseeing Tether’s investment portfolio. His stake, at 1.26%, is large enough that even a partial sale could be meaningful—though the report characterizes the intention as selling only a portion rather than unwinding his position entirely.

For investors and market participants, the significance is twofold. First, any insider distribution can become a proxy for internal confidence or liquidity planning. Second, ownership changes at a stablecoin issuer can matter indirectly to market confidence, because USDT is central to trading pairs, liquidity provisioning, and settlement across crypto markets.

USDT’s European regulatory headwinds continue

The ownership sale report arrives as Tether navigates regulatory pressure in Europe. Cointelegraph previously reported that USDT has been delisted by an increasing number of MiCA-authorized platforms after Tether chose not to comply with the European Union’s crypto framework.

One prominent example cited in that earlier reporting was Revolut’s decision to remove USDT from its platform, announced during the month covered by the Cointelegraph update. While platform-level delistings do not necessarily change the underlying global demand for USDT overnight, they can influence where consumers can access the token and how easily it can be onboarded through mainstream channels.

That dynamic matters for Tether because stablecoin access increasingly intersects with regulated on-ramps. If distribution opportunities narrow in certain jurisdictions, issuer narratives may shift from pure growth to compliance, market structure, and risk management. The partial nature of Heathcote’s reported sale suggests, at minimum, that liquidity planning is not necessarily tied to a single near-term regulatory decision—but the timing still reinforces that Tether is operating amid heightened oversight.

Crypto IPO plans keep shifting from exchange to exchange

While Tether leadership has been publicly skeptical about the need for an IPO, other crypto businesses have continued exploring public listings—often with delays driven by changing market conditions or internal restructuring.

Cointelegraph reported that Kraken has taken steps toward a public listing. Fortune previously reported in September 2025 that Kraken raised $500 million at a $15 billion valuation, fueling expectations for an IPO. Separately, Kraken announced it had confidentially filed a draft registration statement with the U.S. Securities and Exchange Commission for a proposed initial public offering in November 2025.

However, Bloomberg later reported that Kraken’s IPO plans could slip until 2027 after layoffs tied to the company’s expanding use of artificial intelligence. The implication for readers is that even when IPO work is underway, execution timelines can be highly sensitive to operational priorities and cost structure.

South Korean exchange Bithumb has also faced a moving target. Cointelegraph noted in April that Bithumb said it is delaying its IPO until after 2028, citing efforts to strengthen accounting policies and internal controls following earlier regulatory setbacks.

Taken together, these updates underline a broader theme in crypto’s attempted migration to traditional capital markets: going public has become less a straightforward fundraising event and more a compliance-heavy, execution-dependent process. Even companies that proceed with filings can still experience delays as they balance governance upgrades, regulatory expectations, and internal transformation.

What to watch next for Tether and the stablecoin market

Bloomberg’s report did not specify deal timing, counterparties, or regulatory requirements tied to Heathcote’s planned partial sale. The next key question for the market is whether the transaction influences investor perceptions of Tether’s governance and long-term positioning—especially as USDT continues to face uneven access across Europe. In the meantime, stablecoin holders and traders should monitor platform delistings, jurisdiction-by-jurisdiction compliance signals, and any additional transparency that may emerge around insider ownership and capital-market readiness across major crypto firms.

Bitcoin (BTC) fell from nearly $64,000 on Sunday to about $62,000 on Monday, and the primary trigger behind the move appeared to be a SEC disclosure showing Strategy’s largest ever sale of 3,588 BTC. The fuller explanation for the price action can be found deeper in the plumbing.

Sunday’s climb toward $64,000 was almost entirely futures driven. Net futures buying reached roughly $415 million for the day, capped by a single four-hour burst of about $687 million that force-closed some $33 million in bets against Bitcoin. Spot flows over the same session were slightly negative, and this gap matters since a rally with no cash buyers behind it rests on positions that can be forced to unwind at any moment.

Monday morning delivered the unwind, and it accelerated as Strategy’s filing landed. The largest corporate Bitcoin treasury holder sold BTC for $216 million to fund dividend payments, with a further $1.25 billion of sale capacity still untouched. 

Related: Bitcoin recovers from Strategy’s BTC sale, funding rates hit 9%: Are bulls back?

Following the news, Bitcoin futures flows swung to roughly $456 million of net selling in a single four-hour window. Liquidations hit both directions at once, roughly $42 million of bullish positions and $49 million of bearish ones. The Monday afternoon recovery looked different from Sunday’s rally as futures buying of about $568 million was joined, for the first time in days, by meaningful spot buying of about $143 million.

BTC/USD cumulative volume delta. Source: Hyblock

Through the price whipsaws, Bitcoin’s funding rate held firm in positive territory for over a week, including during Monday’s slide. With about $20.6 billion in open futures positions, the market’s leveraged optimism remains largely intact, but due to the funding rate and number of longs crowded into leveraged positions, the current setup is fragile.

BTC/USD open interest. Source: Hyblock

Two areas to keep an eye on are whether Strategy’s sale marks the beginning of a prolonged selling phase for the company and whether the unused $1.25 billion authorization will weigh on any rally. 

On Wednesday, the Federal Reserve releases minutes from its June meeting, with markets currently pricing in a 75.6% chance that rates will remain at 3.50%-3.75% in July. Any hawkish tone in the minutes may test crowded leveraged long positions, with pressure zones at $62,300 to $62,800 above the market and $61,000 and $59,500 below.