SEC approves sandbox rollout

Under the approval, BlockShoals will operate using a crypto-asset intermediary model that allows users in the Philippines to access selected products and services through its global crypto-asset service provider partner, Binance. 

The SEC document stated that BlockShoals must first complete system integration with a local virtual asset service provider during an initial 90-day phase before proceeding with the approved testing program.

Once that integration is completed, the testing plan will move forward under regulatory oversight and applicable safeguards, including user registration and onboarding through Binance as its global CASP partner, according to the SEC approval.

The final approval follows the SEC’s earlier clearance of BlockShoals’ Stratbox application in November 2025, after the company fulfilled the remaining regulatory requirements set by the Commission.

BSP licensing question remains

The latest SEC approval comes weeks after the Bangko Sentral ng Pilipinas clarified that neither Binance nor BlockShoals currently holds a Virtual Asset Service Provider license required for certain crypto payment and transaction services.

As previously reported by crypto.news, the BSP said participation in the SEC’s Stratbox program does not replace the need for a separate central bank license because the two regulators oversee different parts of the country’s financial sector. The central bank also noted that BlockShoals would need to integrate with a licensed domestic VASP before onboarding users through Binance’s infrastructure could begin.

While Yi He described the development as Binance’s official entry into the Philippines, the SEC approval itself authorizes BlockShoals to begin sandbox testing and identifies Binance as its global CASP partner. The document does not state that Binance has obtained a Philippine VASP license.

Binance has been working to strengthen its regulatory position in several jurisdictions. On July 1, the exchange told affected European Union users that withdrawals and other account options would remain available as MiCA-related service changes took effect, while it continued pursuing authorization to operate under the bloc’s new crypto rules.

That speed can remove old buffers. Automated margin calls, instant redemptions, and 24/7 settlement could make liquidity needs appear faster than firms can manage them. Adrian warned that risk could move away from bank balance sheets and toward the platforms, code, and service providers that run tokenized markets.

Banks test tokenized settlement rails

The warning comes as large financial firms move tokenization deeper into regulated finance. As crypto.news reported, major U.S. banks are backing a tokenized deposit network through the Clearing House, with a launch targeted for the first half of 2027. The system would allow banks to settle tokenized deposits around the clock while keeping deposits inside the banking sector.

Recent market activity also shows that tokenization is spreading into securities. As previously reported, Securitize tokenized its own NYSE-listed shares on Solana and Avalanche on the day it began public trading. Ondo Finance also brought BlackRock’s IVV ETF and Micron shares onto Ethereum through a model designed to keep the underlying securities inside regulated U.S. custody.

Regulators weigh ownership and code oversight

The IMF said tokenized finance needs clear rules on settlement assets, platform governance, interoperability, and the role of central banks. It also said legal clarity matters because investors must know whether tokenized records prove ownership, whether settlement is final, and which court has authority when markets cross borders.

In the United States, regulators are already reviewing tokenized securities. As crypto.news reported, the SEC has explored an innovation exemption for tokenized securities that could let some blockchain-based products trade under tailored rules. Later, the agency reportedly delayed the proposal after exchanges raised questions about shareholder rights and ownership verification.

The IMF’s message adds a global policy layer to that debate. Faster settlement may improve market systems, but weak standards could split liquidity across competing platforms. If tokenized assets move across borders in real time, supervisors may also have less time to respond during stress.

Adrian said central banks, regulators, and market operators must decide how tokenized finance should use public and private money. They must also decide how platforms should connect and how critical smart contracts should be supervised. Without common rules, tokenization may stay split across separate systems instead of becoming a safer settlement model for global finance.

This piece separates what these models actually change from what the panic gets wrong, and it does so without treating a single headline as the whole picture. The central question is not whether AI makes crypto security riskier; it does. The harder question is where the added risk actually sits, whether it is in smart contracts themselves, bridges, human operations, signing flows, or the speed at which attackers can now move from disclosure to exploit. The answer is less cinematic than the fear, but more useful for anyone holding funds or building protocols.

What came back, and what did not

The distinction between the two models is the first thing to get right, because they are not equally available. Fable 5 is the public, safeguarded member of the Mythos class, released in June 2026 and priced at roughly twice the cost of Anthropic’s prior flagship. It returned to global users on July 1 across Anthropic’s platforms. Mythos 5 is the less-restricted version that carries the full cyber capability, and it did not return to the public.

Anthropic restored Mythos 5 only to a set of vetted U.S. organizations that operate and defend critical infrastructure, through an opt-in program called Glasswing, following government approval in late June. So the model most crypto observers worry about is not the one now sitting behind a consumer subscription. The distinction matters because public access changes the risk surface very differently from vetted critical-infrastructure access. A powerful model in the hands of security teams is not the same thing as a powerful model available to every attacker with a credit card.

The episode that pulled both offline is worth understanding, because it colors the risk debate. In June, researchers at Amazon showed a jailbreak that got Fable 5 to identify software vulnerabilities and write exploit code, and the U.S. government responded with an emergency export-control order that Anthropic complied with by disabling the models entirely, since it could not restrict access by nationality in real time. The controls were lifted at the end of June, and access returned in the first days of July, with Fable 5 global and Mythos 5 limited. Anthropic’s own account of the incident cuts against the loudest fears: its review, conducted with the government, found that the reported technique did not reveal a uniquely Mythos-level capability, and that several weaker models could reproduce the same vulnerabilities.

The company argued the capability had been oversold, and it deployed a new safety classifier it says blocks the specific technique in more than 99% of cases, routing risky cybersecurity prompts to a weaker model in fewer than 5% of sessions. That is the company’s framing, and it matters, but it is not the whole story either. The point for crypto is narrower: even if public access is constrained, the capability exists, it is improving, and weaker models already reproduce parts of it. That means the security problem cannot be solved by focusing on one model alone.

What Mythos-class models can actually do

The capabilities that alarmed the security world are real and documented, not hypothetical. Under its restricted program, Mythos-class models reportedly surfaced more than 10,000 high and critical-severity vulnerabilities in systemically important software, and found critical flaws across more than 1,000 open-source projects, including widely used components such as the Linux kernel and a popular media library. In one cited case, the model generated a working proof-of-concept exploit for a complex issue in under 31 minutes. Cloudflare reported that an earlier Mythos preview chained bugs into working exploits across more than 50 of its code repositories before refusing to produce a live demonstration.

The capability that most changes the math for defenders is speed. Anthropic has warned that the window between a vulnerability being disclosed and being exploited is collapsing, in some cases from days to hours. Its researchers concluded that a single operator with this class of model could turn a month of software patches into working exploits in a single afternoon, for a cost measured in a few thousand dollars. Security practitioners have started describing the shift as moving from an era of N-days, where attackers had weeks or months after a disclosure, to something closer to N-hours.

When a patch ships, it also reveals the flaw it fixes, and a model that can read the patch, understand the bug, and build an exploit in hours compresses the defender’s response window dramatically. None of this is the same as inventing a new class of attack. It is acceleration and scale. The model reads public code, compares versions, summarizes audits, and reasons about weaknesses faster and cheaper than a human team, which lowers the cost and expertise needed to do work that skilled attackers already do.

That distinction, acceleration rather than invention, is the fault line the entire debate runs along. For crypto teams, the practical implication is brutal: slow patching, stale dependencies, and unaudited forks become more dangerous when attackers can automate the boring parts of vulnerability discovery. The frontier model does not need to be magical to change the economics. It only needs to make the existing attack pipeline cheaper and faster.

Why crypto is uniquely exposed

Crypto sits in the blast radius for reasons specific to how it works. Smart contracts are public by design: the code that controls billions of dollars is visible on-chain for anyone, including an AI, to read and analyze. Bridges, the infrastructure that moves assets between blockchains, concentrate the collateral of many chains into a single set of contracts and message-verification systems, which makes them the highest-value targets in the space. An attacker who can scan code at machine speed has an unusually rich, unusually open field in crypto compared with closed corporate systems.

The backdrop is a genuinely bad year. Crypto has lost more than $840 million to hacks in 2026, with some tallies putting the figure past $940 million across more than 120 incidents, and April alone set a record near $600 million. The two largest losses tell the story of where the damage comes from. Kelp DAO lost roughly $292 million when attackers forged a cross-chain message on its bridge, exploiting a setup that let a single compromised node approve fraudulent withdrawals.

Drift Protocol lost about $285 million not to a code bug but to a six-month social engineering operation that ended in compromised administrative keys. Bridges have accounted for the largest share of losses, and North Korean groups have been linked to a large portion of the total. That pattern is the key context for the AI debate, because it shows where crypto actually bleeds. The biggest 2026 losses came less from novel smart-contract bugs than from human error and operational failure: social engineering, exposed keys, flawed signing flows, and misconfigured infrastructure.

Any assessment of what a Mythos-class model changes has to start from that reality, not from the image of an AI writing an exotic new exploit from scratch. The crypto risk surface is not only code. It is bridges, multisigs, admin keys, custody practices, signing devices, deployment scripts, and teams that still operate under startup-style security despite controlling institutional-scale money. AI makes that whole surface easier to search.

The alarm case

The bearish read is straightforward and has serious voices behind it. Simon Dedic, a well-known crypto investor, warned that a public Mythos-class model could sharply lower the cost and expertise needed to find exploitable flaws in smart contracts, and that unaudited protocols would become, in his words, sitting ducks. The argument is about barriers. Finding a subtle vulnerability in a contract used to require rare skill and considerable time.

If a model compresses that to hours and pennies, the population of people capable of attacking a weak protocol expands enormously, and the long tail of small projects, forks, and unaudited contracts becomes far more exposed. The numbers give the argument weight. Analysts have linked part of 2026’s elevated hacking losses to the growing use of advanced AI in identifying vulnerabilities, and the trend line points toward more automated, faster reconnaissance. In this view, even if the very best human attackers gain little, the marginal attacker gains a great deal, and crypto has no shortage of marginal attackers or of weak targets for them to point a capable model at.

The alarm is less about the top of the skill curve and more about how many more people can now operate near it. That is why small DeFi forks, rushed launches, and unaudited protocols are the obvious danger zone. A well-resourced protocol with continuous audits and strong operational controls may use AI defensively. A copy-paste fork with weak key management may simply become easier to attack.

The skeptics’ case

The counterargument is equally serious, and it comes from builders and from Anthropic itself. Michael Egorov, the founder of a major decentralized exchange, argued that smart contracts typically contain only a few thousand lines of code and are already well understood by human auditors and existing AI tools, so a more capable model changes less about direct contract exploits than the panic suggests. In his view, operational security failures and supply-chain attacks are the larger risk, and those are not primarily a smart-contract-analysis problem. That view fits the loss data, where administrative compromises and bridge failures dominate the largest incidents.

Anthropic’s post-incident review reinforces the skeptical case from an unexpected direction. The company found that the jailbreak technique that triggered the export controls did not reveal a uniquely Mythos-level capability, and that weaker models, its own and others, could reproduce the same vulnerability findings. If a capability is broadly available across many models rather than locked inside one frontier system, then restricting or releasing that single system changes less than it appears to. The skeptics do not claim the models are harmless; they claim the marginal danger of any one release is smaller than the headlines imply, because the underlying capability is diffuse and because the hardest part of most real attacks is not finding the flaw.