The European Union’s cryptocurrency industry has entered a new enforcement phase as the transition period under the Markets in Crypto-Assets (MiCA) regulation came to an end.

The end of the transition means crypto companies without MiCA authorization can no longer legally serve EU clients and are expected to wind down operations or face multimillion-euro fines and other enforcement action.

Industry executives and lawyers told Cointelegraph the next challenge is ensuring national regulators apply the bloc’s single rulebook consistently, even as supervisory approaches are expected to vary across member states.

The transition marks MiCA’s first major enforcement test as regulators begin applying the EU’s crypto rulebook.

MiCA compliance costs versus fines

Although complying with MiCA can cost hundreds of thousands or, in some cases, millions of euros, experts say operating without authorization carries far greater financial and regulatory risks.

Nicola Massella, partner at Legal & Resilience, estimated MiCA implementation costs for many cryptocurrency companies at 350,000 euros ($400,000) to 600,000 euros ($690,000), while Brickken CEO Edwin Mata said costs can reach 2 million euros ($2.3 million) depending on a company’s size, services and compliance readiness.

On penalties, Eckehard Stolz, managing director of Amina EU, said MiCA penalties start at 5 million euros or 5% of annual turnover for some violations.

Source: EBA

Massella added that the European Banking Authority (EBA) proposed on June 26 increasing penalties under certain regulatory regimes, including as much as 12.5% of annual turnover for some stablecoin-related breaches.

Who enforces MiCA?

While MiCA creates a single EU rulebook, day-to-day supervision is handled by national competent authorities (NCAs), which authorize, supervise and enforce the rules for crypto companies.

The European Securities and Markets Authority (ESMA) coordinates supervision across member states and maintains the public register of authorized crypto-asset service providers, and the EBA directly oversees significant stablecoin issuers.

Source: ESMA

“At the EU level, ESMA plays an important coordination and supervisory-convergence role, especially to avoid regulatory arbitrage between member states,” Ivo Grlica, founder of GrlicaLaw and G LAB Advisors, told Cointelegraph.

“National regulators are only the first line of MiCA enforcement, but the legal consequences can spread into national courts and criminal-law systems if the underlying conduct causes harm,” he added.

Enforcement unlikely to be uniform at first

MiCA enforcement is unlikely to be uniform in its early stages because NCAs differ in resources, experience and supervisory priorities.

“ESMA made clear it expects NCAs to act against unauthorized providers from July 1,” Stolz said, adding that how aggressively each regulator moves “will depend on local resourcing and priorities.”

Peter Bidewell, vice president of institutional product adoption at Parfin, said differing supervisory approaches could create opportunities for regulatory arbitrage despite MiCA’s goal of harmonizing crypto rules across the EU.

Related: StanChart joins ESMA’s first MiCA register update since deadline

Grlica said he expects enforcement to become more systematic over time as regulators identify unauthorized providers and share information across member states, making it increasingly difficult for companies with a history of non-compliance to obtain MiCA authorization later.

Several EU regulators, including authorities in the Czech Republic, Bulgaria, Luxembourg and Italy, have issued notices reminding crypto companies that the MiCA transition period has ended and urging providers without authorization to wind down their operations.

The Czech National Bank told Cointelegraph that the country’s Financial Market Digitization Act gives it the authority to impose sanctions for MiCA-related violations, including operating without authorization, unlawful token offerings and failing to cooperate with supervisors. The law allows the central bank to fine companies providing crypto services without authorization up to 118.5 million Czech koruna (about $5.6 million), 5% of annual turnover if higher, or twice the unlawful benefit obtained, whichever is greater.

Cointelegraph contacted France’s Autorité des marchés financiers (AMF), the Netherlands’ Authority for the Financial Markets (AFM) and Germany’s Federal Financial Supervisory Authority (BaFin) to ask how they plan to enforce MiCA following the transition deadline. None had responded by publication.

Magazine: How crypto laws changed in 2025 — and how they’ll change in 2026

Two protocol upgrades turned Hyperliquid from a crypto perpetuals exchange into something closer to an operating system for markets. HIP-3 lets anyone with enough staked HYPE launch a perpetuals exchange for stocks, oil, or gold. HIP-4 adds prediction markets that settle without a token vote. Here is how both work, what they have built so far, and where the risks sit.

Hyperliquid spent its first two years being described as the fastest decentralized perpetuals exchange in crypto. The description was accurate and incomplete. Since late 2025, the network has been executing a more ambitious plan: turning its core trading infrastructure into a platform that other builders deploy markets on top of, the way developers deploy apps on cloud infrastructure. Grayscale Research made the comparison explicit in a June 2026 note, writing that Hyperliquid now looks less like a stock exchange and more like Amazon Web Services.

Two upgrades carry that transformation. HIP-3, live on mainnet since October 13, 2025, opened perpetual futures listing to outside builders and brought tokenized stocks, commodities, and indices onto the platform at scale. HIP-4, live since May 2, 2026, added a second market primitive built for prediction markets and other event contracts. Together they explain why seven of the top ten markets by volume on a crypto exchange are now things like Nvidia stock and gold, and why the platform is picking a direct fight with Polymarket and Kalshi.

This guide walks through what each proposal does, how the mechanics work, what has happened since launch, and what can still go wrong.

First, the basics: what a HIP is

Hyperliquid is a layer 1 blockchain built around a fully on-chain central limit order book. Its core engine, HyperCore, processes around 200,000 orders per second and handles matching, margining, and liquidations for every market on the chain. A separate component, the HyperEVM, runs Ethereum-style smart contracts on the same consensus layer. The native token, HYPE, secures the network through staking, pays fees, and absorbs most protocol revenue through a continuous buyback program. Cumulative protocol revenue passed $1 billion in late June 2026, with an annualized run rate near $840 million.

Changes to the protocol arrive through Hyperliquid Improvement Proposals, or HIPs, which the community debates and HYPE stakers weigh in on before the core contributors ship the code. The first two set the pattern. HIP-1 created the standard for launching spot tokens, with ticker slots sold through recurring Dutch auctions, so listing a token became a market process instead of an application form. HIP-2 added a protocol-native liquidity mechanism that seeds order books for new tokens automatically, solving the empty-book problem that kills most new listings on other venues. Both dealt with spot markets, and both introduced ideas that return later: auctions as the allocation mechanism for scarce listing slots, and protocol-level guarantees standing behind builder-created markets. The third and fourth proposals took those ideas after the two bigger prizes: perpetual futures on everything, and event contracts on anything.

HIP-3: builder-deployed perpetuals

Before HIP-3, listing a new perpetual market on Hyperliquid worked the way it works on most exchanges: the core team decided. That created a bottleneck and a gatekeeper, two things the platform’s own community had complained about as the asset universe stayed narrow while demand for stock and commodity exposure grew.

HIP-3, called Builder-Deployed Perpetuals, removed the gatekeeper. Since October 2025, any builder who stakes 500,000 HYPE can deploy an independent perpetuals exchange on HyperCore, without core team approval. At current prices near $64, that stake represents roughly $32 million, a number that matters for reasons covered below.

The deployer controls nearly everything about their market. They choose the assets, the oracle that sets the mark price, the collateral token, margin requirements, leverage limits, funding parameters, and the front-end experience. The first three assets in any HIP-3 exchange deploy without an auction. Additional assets go through a Dutch auction shared across all HIP-3 deployers, similar to the HIP-1 ticker auctions.

What the deployer does not control is the plumbing. HIP-3 markets inherit the full HyperCore stack: the same matching engine, the same order types, the same margining and liquidation logic, and the same solvency guarantees as the validator-operated markets. A trader interacting with a builder-deployed market gets the same execution quality as on the flagship crypto perps.

The economic design has three pillars:

• The stake is a bond, not just a ticket. The 500,000 HYPE can be slashed if the deployer misbehaves, for example by manipulating an oracle or breaking market rules, and the requirement holds for 30 days even after a deployer halts all markets.
• Fees split down the middle. HIP-3 markets charge users twice the fee of validator-operated perps, and the deployer keeps 50%. The protocol collects the same revenue per trade either way, so builder markets grow the pie without cannibalizing it.
• Cross margin has eligibility standards. Validators only allow cross margin on HIP-3 assets with sufficient observable liquidity, a reliable external oracle, and resistance to price manipulation, and any 50% intraday move in the reference price triggers a review.

The design goal is alignment: builders with $32 million at stake and a 50% revenue share have every reason to run clean, liquid, well-oracled markets, and a slashing mechanism waits for the ones who do not.

What HIP-3 actually built

The proposal would be a footnote if nobody used it. The opposite happened. The first market, a synthetic Nasdaq-style index called XYZ100, went live within days of activation. Its deployer, TradeXYZ, then built out United States equities including Nvidia, Tesla, Google, and Amazon, plus gold and silver contracts benchmarked to COMEX front-month futures, and later secured official licensing rights to the S&P 500 ticker, a landmark moment for a DeFi protocol.

The numbers followed. Open interest across HIP-3 markets passed $1.43 billion within months of launch. By spring 2026, seven of Hyperliquid’s top ten markets by volume were tokenized equities or commodities, not crypto pairs. During the West Asia crisis earlier this year, when traditional commodity venues closed for the weekend, traders moved to Hyperliquid to trade oil, gold, and silver around the clock, and HIP-3 markets drove up to 40% of the platform’s total volume. Non-crypto assets showed 60% trader retention in late March, a signal that around-the-clock access to traditional markets is a durable product, not a novelty. At peak HIP-3 activity the platform generated $2.3 million in daily fees, funding $11 million in HYPE buybacks.

Other deployers took different angles. Kinetiq built around its liquid staking token. Liminal used HIP-3 markets to run fully on-chain delta-neutral yield strategies across equities, FX, and commodities, including markets collateralized with yield-bearing assets like Ethena’s USDe. In June, Hyperliquid and TradeXYZ launched the FOMO app, a single interface for trading equities, pre-IPO stocks, crypto, indices, and commodities. Access also spread through consumer wallets: HIP-3 markets can be traded through any Hyperliquid-compatible front end, including Phantom.

The listing economics also flipped in a way worth pausing on. Under the old model, and on centralized exchanges generally, a new asset waits for an exchange’s business development calendar, and projects have long complained about the cost and opacity of the process. Under HIP-3, listing latency collapsed from a governance or negotiation timeline to a deployment transaction plus an auction, and the gatekeeping moved from relationships to capital. A pre-launch project that wants a perpetual market for hedging no longer needs a major venue’s blessing; it needs a deployer willing to run the market. Comparable systems show how unusual this is: dYdX v4 still routes every new market through a governance vote with a week or two of latency, and GMX listings run through its core team. Hyperliquid is the first chain-level implementation where market creation itself carries no approval step.

The concentration is the caveat. TradeXYZ accounts for more than 90% of all HIP-3 open interest, and Blockworks Research has flagged the deployer economics as a structural risk: with a roughly $30 million lockup, auction costs, and stiff competition, a smaller deployer’s break-even period can stretch to four years. Blockworks has proposed lowering the stake for small builders and letting them keep 100% of revenue until they recover their costs. Hyperliquid’s own documentation says the 500,000 HYPE threshold is expected to fall as the infrastructure matures. Until it does, HIP-3 is permissionless in principle and an oligopoly in practice.

HIP-4: outcome markets

HIP-3 covered continuous markets, things with a price that moves all day. It could not cleanly handle discrete events. A perpetual future needs an oracle that updates continuously with limits of roughly 1% deviation per update, a design suited to leveraged trading on a live price and incompatible with questions that jump from uncertainty to a hard answer in one instant, like an election call or an inflation print.

HIP-4, announced on February 2, 2026 and live on mainnet since May 2, added a purpose-built primitive for exactly that. Outcome markets are fully collateralized contracts that settle to exactly 0 or 1 at expiry. Each market has two sides, typically Yes and No, and the order books for the two sides are merged: an order to buy Yes at a price of 0.62 is the same order as one to sell No at 0.38, so all liquidity concentrates in one book. Positions are collateralized in USDH, the network’s native stablecoin, and because every position is fully backed, there is no liquidation risk.

The market lifecycle has a distinctive opening. Each new outcome market starts with a single-price clearing auction lasting around 15 minutes, during which traders submit limit orders but nothing executes. The auction clears at the price that matches the most volume, and unfilled orders roll into continuous trading on the standard order book. The mechanism exists to concentrate early liquidity and produce a fair opening price instead of a thin, gappy first print. It borrows a page from how traditional exchanges open trading each morning, which is fitting for a protocol that keeps hiring ideas from the market structure it wants to replace.

The architecture runs natively inside HyperCore, sharing the matching engine, order types, and throughput of every other market on the chain. That matters for one under-discussed reason: liquidity providers can quote prediction markets with the same tooling and speed they use on perps, instead of the bespoke market-making setups that thinner prediction venues require. Deep books were always the missing ingredient on long-tail event markets, and Hyperliquid’s bet is that professional liquidity follows familiar infrastructure.

The fee structure is openly aggressive. Opening or minting an outcome position costs nothing. Fees apply only on closing, burning, or settling, and makers pay zero. That pricing targets Polymarket and Kalshi, which processed a combined $44.8 billion in June on the back of the World Cup, and the community reaction at announcement made the intent plain. When the proposal dropped in February, crypto.news covered the market pricing in exactly that ambition, with traders framing HIP-4 as Hyperliquid trying to house all of finance.

Initial markets are curated and validator-deployed, starting with recurring daily Bitcoin price threshold contracts that reset each day, run by the prediction platform Outcomexyz. Planned categories include politics, sports, macro data releases, crypto events, and entertainment. A later phase opens permissionless deployment: builders will stake 1,000,000 HYPE per market slot, slashable and burned if validators find oracle manipulation, invalid state transitions, or prolonged downtime. One slot supports rolling and recurring markets, recycling after each settlement.

Settlement without a token vote

The deepest difference between HIP-4 and the incumbent on-chain prediction markets is not fees. It is how truth gets decided.

Polymarket outsources contested resolutions to UMA’s optimistic oracle, where token holders vote on disputed outcomes, an architecture that has produced repeated controversies in 2026, including a $60 million market on a Strategy Bitcoin sale that resolved against the documented facts. The full mechanics and failure modes of that system are covered in our companion guide to how prediction markets resolve.

HIP-4 replaces the token vote with the chain itself. Settlement runs through Hyperliquid’s validator set executing automated resolution against pre-specified, objective data sources. There is no dispute window, no escalation, and no path for a token holder with a position in the market to also vote on its outcome. The trade-off is scope: deterministic settlement works for objective questions with a clean data source, which is why the first markets are price thresholds. Ambiguous questions, the kind that generate the worst oracle disputes elsewhere, are exactly the kind HIP-4’s design avoids listing.

What all of this looks like from the trader’s side

For a user, the machinery above mostly disappears. HIP-3 markets sit in the same interface as the flagship crypto perps, trade through the same API, and settle against the same margin account. A trader shorting gold on a builder-deployed market places the order the same way they would short Ethereum, and the differences show up in three places worth knowing.

Fees are higher on builder markets. The headline rate on a HIP-3 perp is twice the validator-operated rate, which at base tiers works out to roughly 3 and 9 basis points for makers and takers before discounts, with the deployer keeping half. Staking discounts, referral rebates, and collateral-based reductions still apply on top, so an active HYPE staker narrows the gap considerably.

Oracle quality varies by deployer. On validator-operated markets, the network itself maintains the price feed. On a HIP-3 market, the deployer chooses and operates the oracle, which is why the mark price on a weekend oil contract can drift from where Monday’s COMEX open eventually prints. During the West Asia crisis, Hyperliquid’s oil market traded on its own oracle through days when no traditional reference price existed at all. That independence is the product and the risk in one feature.

Collateral differs by market. Most markets margin in stablecoins, but HIP-3 supports alternative collateral where the deployer enables it, including yield-bearing assets, and HIP-4 outcome positions collateralize in USDH. Settlement demand for outcome markets flows through the stablecoin into the same fee-and-buyback loop that already routes nearly all protocol revenue toward HYPE, which is why analysts treat HIP-4 volume as a direct token catalyst rather than a side business.

The practical entry points have multiplied too. Beyond the native app, HIP-3 and HIP-4 markets surface through Phantom, through the FOMO app for the equities lineup, and through any front end built on the public API, since every builder market shares the unified HyperCore order flow.

The risk column

Every part of the story above has a counterweight, and an honest explainer lists them.

Deployer concentration is the loudest one. A permissionless system where one builder holds 90% of open interest has recreated a gatekeeper one level up, and the $32 million entry stake keeps it that way for now. Regulatory exposure is the second. Hyperliquid operates without KYC in most of the world, the United Kingdom’s FCA has declared the platform unauthorized, and pending United States market structure legislation could either validate or constrain synthetic stock perpetuals, a product category regulators have barely begun to examine. Institutional ceilings are the third: a June JPMorgan report saw limited institutional demand for perpetual futures generally, citing unbounded basis risk and missing clearing protections, which matters for a token whose valuation leans on volume growth. And the products themselves are dangerous instruments. Leveraged perpetuals on any underlying can liquidate a position in minutes, and cross margin across markets adds its own failure modes.

There is a subtler risk in the oracle layer that the slashing design only partially covers. A deployer’s oracle is a single point of interpretation for its markets, and unusual conditions expose the gap: when traditional venues close and a HIP-3 commodity market keeps trading, the mark price is whatever the deployer’s methodology says it is, with no external reference to check against until markets reopen. Validators review any 50% intraday reference move and slashing punishes proven manipulation, but a subtly mispriced weekend, honest or otherwise, transfers money between longs and shorts without tripping any threshold. Traders in builder markets are underwriting oracle methodology whether they think about it or not.

None of that has slowed the platform yet. Hyperliquid controls an estimated 70% of on-chain perpetuals volume, spot HYPE ETFs drew $111 million in inflows in late June while Bitcoin and Ethereum funds bled, and the ecosystem is spending on the long game, including a $29 million policy center in Washington. Whether the moat holds is a different question from whether it exists.

The bigger picture for L1 competition

HIP-3 and HIP-4 also reframe what layer 1 blockchains compete on. Ethereum and Solana fight over DeFi liquidity, users, and fees, a race with its own 2026 scoreboard. Hyperliquid opted out of the general-purpose contest and vertically integrated one thing: markets. The bet is that an exchange-shaped blockchain with permissionless market creation captures more value than a general-purpose chain hosting exchange apps. dYdX tried a dedicated appchain with governance-gated listings. GMX built on someone else’s layer 2. Hyperliquid is the first to make market creation itself permissionless at the chain layer, and the early evidence, an order of magnitude expansion in what can be traded on-chain, suggests the design space was bigger than the industry assumed.

What to watch from here

Three markers will tell the story over the next year. First, whether the HIP-3 stake requirement drops and the deployer set widens beyond one dominant builder. Second, whether HIP-4 volume becomes measurable against Polymarket and Kalshi once permissionless deployment opens and categories expand past crypto prices. Third, whether regulators treat builder-deployed stock perpetuals as an innovation to license or a loophole to close. The upgrades themselves are shipped and working. The open question, as always in this industry, is what survives contact with scale.

Frequently asked questions

Disclaimer: This article is for informational purposes only and does not constitute investment advice. Digital asset markets are volatile and you can lose your entire investment. Always do your own research. Information current as of July 3, 2026.

South Korean crypto exchange Upbit said it is not participating in the issuance of Open USD, after its operator Dunamu was named among more than 140 businesses involved in the new stablecoin initiative. 

“Upbit has only indicated our potential willingness to consider taking part in the future expansion of the OpenStandard ecosystem,” an Upbit spokesperson told Cointelegraph. 

The clarification follows similar pushback from Samsung Electronics and other South Korean companies listed by Open Standard. 

According to a Friday report by ChosunBiz, Samsung said it had not held formal discussions with the project and did not know what role it was expected to perform. Meanwhile, Shinhan Financial Group and KBank reportedly said they had only indicated that they would consider the initiative. 

Cointelegraph reached out to Open Standard for comments but did not receive a response before publication. 

Excerpt of the list of businesses listed by Open Standard. Source: Open Standard

Open Standard announced the dollar-backed stablecoin on Tuesday, saying more than 140 businesses had “signed up to use” it, including Visa, Mastercard, BlackRock, Google, Samsung Electronics and Dunamu.

Open Standard previously said businesses would be able to mint and redeem OUSD without fees or volume limits. The project also plans to distribute earnings generated from its reserves to participating companies.

Related: South Korea adds token securities to capital market overhaul

However, some industry participants, including Circle CEO Jeremy Allaire, questioned the sustainability of offering free, unlimited minting and redemption. Meanwhile, Lorenzo Valente, director of research at ARK Invest, also previously called the announcement a “giant” letter of intent. 

South Korea’s stablecoin rules remain unfinished

South Korea has yet to pass the Digital Asset Basic Act, leaving questions over who may issue stablecoins and what roles companies can perform.

As Cointelegraph previously reported, lawmakers have debated whether issuance should be limited to banks or opened to qualified non-bank issuers, while the broader regulatory framework remains under discussion.

The uncertainty also makes it difficult for South Korean companies to commit to stablecoin initiatives, as the rules governing issuance, reserve management and participation in stablecoin ecosystems have yet to be finalized.

Magazine: Bitcoin decouples from tech stocks, Ether eyes ‘selling wave’: Market Moves

For most of crypto’s short life, exchanges competed on a single metric. Whoever listed the most tokens looked like the most serious player. That era is fading. The platforms winning UK customers in 2026 are not the ones with the longest menus. They are the ones that can prove they are safe to use.

The reason is simple. The audience has changed. Research from the Financial Conduct Authority suggests that around 12 percent of UK adults now hold cryptoassets, and a growing share of them are first time buyers rather than experienced traders. These newcomers are not hunting for obscure altcoins. They want three things. They want to know their funds are protected, they want to understand what they are paying, and they want confidence that their provider will still be operating in a year. In other words, they are buying trust before they buy crypto.

Anyone weighing up where to start will find no shortage of rankings, including this regularly updated guide to the best UK crypto exchanges. The real value, though, is less in the list itself and more in the criteria behind it. Here is what experienced UK investors actually weigh up.

Experienced investors tend to assess a platform in layers, working from the outside in.

The first layer is regulation. In the UK, exchanges that handle cryptoassets are expected to register with the FCA for anti money laundering supervision. Registration does not make crypto safe, and the asset class remains volatile and largely outside mainstream financial protections, but it shows a provider is willing to operate in the open and meet a baseline standard. A platform that cannot or will not register is an immediate red flag.

The second layer is custody and security. After several high profile collapses, investors now ask pointed questions. Does the exchange keep the majority of funds in cold storage. Does it publish proof of reserves. Is two factor authentication enforced rather than optional. The most careful users treat an exchange as a doorway to the market and move long term holdings into wallets they control.

The third layer is transparency. This covers clear terms, honest fee disclosure, and proper GBP support so that British users are not quietly pushed through dollar or stablecoin conversions. The final layer is service, which means responsive support and the ability to reach a human when a withdrawal stalls.

Marketing tends to shout about a single low number, often a zero percent promotional trading fee. The real cost of using an exchange is rarely that number. It is the sum of several smaller charges, most of which are easy to miss.

Consider a typical UK investor putting 500 pounds into bitcoin each month. The headline fee might look trivial, but the spread, the conversion from pounds, and the cost of moving the coins later can add up to far more than the advertised commission. The table below shows where that money usually goes.

The lesson is not that fees are bad. It is that the cheapest looking platform is often not the cheapest in practice. A small monthly buyer feels spreads and conversion costs far more than a one time investor, so the right choice depends on how someone actually plans to use the account.

A long list of supported coins is easy to market and easy to overvalue. For most people, liquidity matters more. Deep, active markets mean an order fills close to the price on screen. Thin markets mean slippage, where the final price drifts away from the quote. Sensible investors check that the specific assets they want are well supported and actively traded, rather than being impressed by hundreds of listings they will never touch.

Because registration status, fees and supported assets all change frequently, comparing platforms from scratch is harder than it looks. Rather than trusting any single provider’s own claims, the sensible approach is to start from an independent comparison and then verify the details that matter to you directly with each platform.

A short checklist helps cut through the marketing:

• Is the platform FCA registered for anti money laundering.
• Does it offer genuine GBP deposits and withdrawals.
• What is the all in cost for the way you plan to buy.
• How is customer money stored, and is there proof of reserves.
• Are the specific assets you want liquid and well supported.

Some warning signs are consistent across the platforms that later run into trouble. Guaranteed returns are the clearest. No legitimate exchange can promise a fixed yield on a volatile asset, and any that does should be treated with deep suspicion. Pressure to deposit quickly, vague answers about where customer funds are held, and support channels that only exist on social media are all reasons to step back.

Another quiet red flag is a platform that makes withdrawals harder than deposits. Getting money in should never be smoother than getting it out. If an exchange adds friction, delays, or extra verification only when users try to take funds away, that asymmetry tells you where its priorities sit. Investors who learn to read these signals early tend to avoid the worst outcomes, regardless of how polished the marketing looks.

The UK crypto market has matured faster than many expected, and the investor has matured with it. The questions have moved on from which coin will moon to which platform can be relied upon. Regulation, security, real costs and liquidity now decide where money flows, and the providers that take those seriously are pulling ahead.

None of this removes the underlying risk of crypto, and nothing here is a recommendation to buy any particular asset. But the direction of travel is clear. In 2026, the strongest UK exchanges are not the ones promising the most. They are the ones with the least to hide.

Blockchains are excellent at verifying what happens on-chain and nearly blind to everything else. zkTLS, a family of protocols also called web proofs, lets anyone prove facts from an ordinary HTTPS session, a bank balance, a driver rating, a loyalty tier, without revealing the underlying data or asking the website for permission. Here is how it works, who is building it, and where the trust assumptions hide.

Crypto has a data problem that predates every bull market narrative. Smart contracts can verify a token transfer with mathematical certainty, but they cannot see a payroll deposit, a university diploma, an Uber rating, or a frequent flyer tier. All of that information lives behind the login walls of Web2 platforms, reachable only through official APIs that are limited, revocable, and priced at whatever the platform decides. Oracles solved a narrow slice of this, mostly public price feeds, and were never designed to carry personal data.

zkTLS is the attempt to solve the rest of it. The idea is simple to state and hard to engineer: take the secure connection your browser already makes to any website, and turn what you see in that session into a cryptographic proof that anyone can verify, without exposing your password, your session, or the raw data itself. If it works at scale, every piece of information behind every login on the internet becomes portable, provable, and usable on-chain.

Start with TLS

Every website address that begins with https uses Transport Layer Security, or TLS. It is the protocol that secures roughly 95% of web traffic. When your browser connects to your bank, TLS performs a cryptographic handshake that does three things: it confirms you are talking to the real server, it encrypts the traffic so nobody in the middle can read it, and it guarantees the data was not altered in transit.

What TLS does not do is produce evidence. The encryption is symmetric, meaning your browser and the server share the same session keys. Once the session ends, you have no way to prove to a third party what the server sent you. You could screenshot your bank balance, but screenshots are trivially forged. You could hand over your login, but that exposes everything. You could share the session keys, but since the same keys both encrypt and authenticate, whoever holds them could fabricate any transcript they like. TLS was built for private communication, not for portable proof. That gap is what zkTLS fills.

What zkTLS actually is

zkTLS, short for zero-knowledge Transport Layer Security, is an umbrella term for protocols that make TLS sessions verifiable. The core output is a proof with two properties. Authenticity: the data genuinely came from a specific domain during a real TLS session, unaltered. Selectivity: the proof reveals only the specific claim being made, such as balance above $5,000 or rating above 4.8, while everything else in the session, including credentials, stays hidden.

One naming caveat worth knowing: the term is a misnomer. Not every implementation uses zero-knowledge proofs, and the emphasis is often verifiability first, privacy second. Many builders prefer the terms web proofs or TLS attestations. The industry has mostly settled on zkTLS anyway, so this guide uses it while flagging the imprecision.

The hard engineering problem is that TLS was never designed to admit a third-party verifier. Three architectures compete to solve it, each with different trust assumptions.

The three models

MPC-TLS. The oldest approach, pioneered by the nonprofit TLSNotary project, which dates back to 2013. Secure multi-party computation splits the TLS session keys between the user and a verifier node, so neither party ever holds the full keys. The verifier participates in the encrypted session cryptographically, using techniques like garbled circuits, and can attest to what the server sent without seeing the plaintext or being able to forge it. The security is the strongest of the three models, and the cost is overhead: MPC adds heavy network round-trips, which historically made proofs slow. Opacity Network builds on this model and has pushed hard on decentralizing the verifier set. Research directions like vector oblivious linear evaluation could cut MPC networking costs enough for one-second proofs.

Proxy witness. A proxy sits between the user and the website, forwarding the encrypted traffic and attesting that the recorded exchange really happened between that client and that domain. The user then proves claims about the decrypted contents, often with a zero-knowledge proof. This is the fastest model in production. Reclaim Protocol, its leading implementer, generates proofs from a phone in about two to four seconds with no app or extension, supports most major blockchains, and lists 889 community-built data sources. An academic paper titled Proxying is Enough put the probability of breaking Reclaim’s construction at ten to the power of minus forty. The trade-off is a trust shift toward the proxy layer and practical friction, since some platforms firewall known proxy traffic, which Reclaim works around with residential proxies.

TEE-based. Trusted execution environments, the tamper-resistant enclaves inside modern processors, handle the session inside sealed hardware. The enclave logs in, fetches the data, and signs an attestation about what it saw, with minimal performance overhead. The trust assumption moves to the chip: you are trusting the hardware manufacturer and the enclave’s resistance to side-channel attacks, a category with a documented history of breaks. zkPass began as an MPC project and now runs a hybrid, using a proxy witness model in production with MPC as backup, while other teams lean on TEEs for speed.

No model is strictly best. MPC maximizes cryptographic trust and pays in latency, proxies maximize speed and pay in trust assumptions, TEEs maximize convenience and pay in hardware dependence. Serious applications pick based on what breaks their use case first.

A worked example, start to finish

Abstractions aside, here is what a zkTLS flow looks like in practice for one concrete case: a borrower proving to a lending protocol that their bank balance exceeds $5,000, without sharing statements or credentials.

The borrower opens the lender’s app, which hands off to a zkTLS client, typically a lightweight mobile flow with no separate install. The client opens a normal TLS session with the bank’s website, and the borrower logs in exactly as they always do. Their password travels over the same encrypted channel as any ordinary login; the verifier never sees it, because depending on the model, the verifier either holds only a useless share of the session keys, or observes only ciphertext passing through a proxy.

The bank’s server returns the account page, oblivious to anything unusual. From its perspective, this is a routine customer session. The client then isolates the relevant response data, the balance field, and generates a proof of a narrow statement: this TLS session was with the bank’s real domain, the response was not altered, and the balance value in it exceeds $5,000. The actual number stays hidden. The account history stays hidden. The login stays hidden.

The proof lands on-chain or with the lender’s backend, where a verifier contract checks it in milliseconds. The whole round trip takes seconds on the proxy model, and the lender has learned exactly one bit of information: qualified. Compare that against the incumbent process, which involves uploading full statements to a stranger’s server and trusting their retention policy forever, and the appeal writes itself. The same skeleton, swap the bank for any website and the balance for any visible fact, is every zkTLS application in existence.

From 2013 curiosity to 2026 infrastructure

The idea is older than most of the industry using it. TLSNotary shipped its first construction in 2013, before Ethereum existed, as a way to notarize web pages for dispute resolution. For a decade it stayed a cryptographic curiosity: the MPC overhead made proofs slow, the tooling assumed expertise, and crypto had no application layer hungry for private off-chain data.

Three things changed. Zero-knowledge proving systems got fast and cheap on the back of the rollup boom, which industrialized zk engineering talent and libraries. Mobile-first implementations, led by Reclaim’s proxy design, collapsed proof generation from minutes on a desktop to seconds on a phone. And the application layer arrived: identity networks, points programs plagued by sybils, prediction markets processing tens of billions monthly, and AI agents that need to verify what they pay for. By the time Devconnect dedicated a full day to the technology, the question had shifted from whether web proofs work to which trust model wins each vertical.

What people are building with it

The use cases sort into a few families, and most of them were impossible before.

• Proof of personhood and identity. Humanity Protocol, the Worldcoin rival valued at $1.1 billion after a round co-led by Jump Crypto and Pantera, launched its mainnet with zkTLS at the center. Users link Web2 accounts, from airline loyalty programs to professional profiles, to a portable Human ID, proving who they are and what they have achieved without any central party seeing the underlying documents. It is identity verification without iris scans.
• Credit and undercollateralized lending. DeFi lending is overcollateralized because protocols cannot see income. With zkTLS, a borrower proves salary deposits, bank balances, or an off-chain credit score directly from the source, without handing over statements. Projects like Cr3dentials build income and KYC verification for lenders on this rail, and lending protocols use web proofs to unlock on-chain credit against Web2 financial reputation.
• Reputation portability. Opacity’s early demo let Uber drivers export their ratings to a rival platform. The same pattern applies to seller ratings, subscriber counts, and gaming achievements: reputations that platforms hold hostage become assets the user carries. This is the quietly radical part, because data lock-in is the moat under most large internet businesses.
• Marketplaces for gated goods. zkP2P uses web proofs to power a ticket marketplace where a seller proves they own a real ticket inside the vendor’s own system before the trade settles, collapsing the fraud problem that plagues secondary markets.
• Data for markets and AI agents. Prediction markets need trustworthy real-world data, and resolution disputes remain the sector’s biggest weakness. Web proofs offer a way to verify a source document cryptographically instead of arguing about it. The same applies to AI agents that buy data over protocols like x402: projects like MCPay use zkTLS to prove that an API response an agent paid for is authentic and untampered.

Why the timing is 2026

The technology is a decade old in concept, so the fair question is why it matters now. Three currents converged.

First, privacy became the sector’s active narrative. A16z crypto argued that privacy is the moat of crypto’s next phase, a thesis that has pulled privacy coins and privacy infrastructure back into focus. zkTLS is the consumer-facing end of that stack: it lets users prove things about themselves while revealing less, the exact inversion of how the data economy currently works.

Second, the tooling matured. Reclaim’s mobile-speed proofs, TLSNotary’s open-source verifier infrastructure, vlayer’s web proofs for Ethereum developers, and zkPass’s production deployments moved the field from papers to SDKs. Ethereum’s Devconnect conference now runs a dedicated zkTLS Day, with hands-on workshops across the competing implementations, a reliable sign that a primitive has crossed from research to developer adoption.

Third, adjacent security work made verifiable data legible to a mainstream audience. Ethereum’s push to end blind transaction approvals through the ERC-7730 Clear Signing standard trained the industry to ask what users can actually verify on their screens. zkTLS asks the same question about data instead of transactions.

How this differs from oracles, and why both survive

Because zkTLS moves off-chain data on-chain, it gets lumped in with oracle networks, and the comparison is worth drawing precisely. Chainlink, Pyth, and their peers are push systems: node networks fetch public data, mostly prices, aggregate it, and publish it continuously for every application to read. The economics amortize across all users of a feed, and the security model rests on the independence and stake of the node operators. This design is close to unbeatable for its job, which is why DeFi’s core money legos still run on it.

It also cannot do what web proofs do. An oracle network has no mechanism for data that requires logging in as a specific person, and no economics for data only one user will ever need. Nobody runs a Chainlink feed for your bank balance. zkTLS inverts every design choice: pull instead of push, per-user instead of shared, private data instead of public, generated on demand instead of streamed. The user is the oracle, and cryptography replaces the node network as the reason to believe them.

The mature stack will use both. Public market data flows through feed networks; personal, session-gated facts flow through web proofs; and the two already meet in places like prediction market resolution, where a price feed settles the objective markets and a verified source document could someday settle the contested ones.

The limits and the risks

An honest account has to include the ways this can disappoint.

Trust assumptions never disappear, they relocate. The proxy model trusts the witness layer not to collude with the user. The TEE model trusts silicon vendors. Even MPC, the most trust-minimized, typically relies on a verifier network whose decentralization is a work in progress. When a marketing page says trustless, the correct response is to ask which of the three models it runs and what breaks it.

Websites are not passive. Platforms change page structures constantly, which breaks data source integrations, and some actively resist automated access. A protocol whose data sources depend on scrapers dressed in cryptography inherits the fragility of scrapers.

Privacy cuts both ways. The same machinery that lets a user prove facts without exposure can help bad actors move value while revealing less to investigators. Wallet drainers adopting privacy tooling is not hypothetical, and regulatory attention on privacy-preserving infrastructure has a long track record.

And selective disclosure invites coercion. If proving your salary to a landlord becomes possible, it can become expected. A technology built to minimize disclosure can normalize new categories of demanded proof. That is a social risk, not a cryptographic one, and no protocol upgrade fixes it.

The quiet stakes: what happens to data moats

Zoom out from the cryptography and zkTLS is an economic weapon aimed at the deepest moat on the internet. Large platforms defend their positions with data lock-in: your ratings, your history, your follower graph, and your purchase record live on their servers, and leaving means starting from zero. That switching cost is why a five-star driver stays on one app, why a power seller cannot move marketplaces, and why challenger platforms die in the cold-start phase regardless of how good their product is.

Web proofs dissolve the lock without asking the incumbent’s permission. If a new ride platform can accept a cryptographic proof of a competitor’s rating, it inherits the trust the incumbent spent a decade accumulating, and the user carries their reputation the way they carry a passport. A lender can underwrite against a credit history it never stores. A social network can import proof of an audience without an API deal that the incumbent can revoke on a whim, which incumbents historically do the moment a client grows threatening.

Incumbents will not stay passive, and the countermeasure escalation is predictable: aggressive bot detection, page structures that shift weekly, legal pressure on proxy infrastructure, and terms of service amended to prohibit proof generation. None of those measures can break the cryptography, but all of them can raise the maintenance cost of data source integrations, and the protocols that win will be the ones that industrialize that maintenance. The fight over whether users own the facts about themselves is about to move from privacy policy debates into engineering, and for once the users’ side has tooling.

The bridge crypto kept promising

For years the industry described blockchains as a trust layer for the internet while the internet’s actual data sat somewhere the chains could not reach. zkTLS is the most credible attempt yet to close that gap without asking platforms for permission, and permissionlessness is the whole point: no API deal, no data-sharing agreement, no gatekeeper deciding which facts are exportable. Whether it becomes core infrastructure depends on the unglamorous work ahead, decentralizing verifier networks, surviving platform countermeasures, and proving the trust models under adversarial pressure. The primitive, though, is real, the proofs verify, and the fortress walls around Web2 data have their first practical siege engine.

Frequently asked questions

Disclaimer: This article is for informational purposes only and does not constitute investment advice. Digital asset markets are volatile and you can lose your entire investment. Always do your own research. Information current as of July 3, 2026.

The European Securities and Markets Authority (ESMA) has published the first update to its register of crypto companies under the European Union’s Markets in Crypto-Assets Regulation (MiCA) after the transitional period ended Wednesday.

Friday’s update to the register added 37 licensed crypto-asset service providers (CASPs), including global banking group Standard Chartered, which secured MiCA authorization from Luxembourg regulators on June 25.

Among the new CASPs are digital asset prime brokerage FalconX, Sygnum Europe and Ronin EM, while the register of electronic money tokens (EMTs) has added Crédit Agricole’s CACEIS.

ESMA’s interim MiCA register now lists 280 CASPs, up from 243 in the previous update published June 26.

Standard Chartered advances crypto strategy in Europe with MiCA and EMI licenses

In addition to securing MiCA authorization, Standard Chartered was also granted an Electronic Money Institution (EMI) license, allowing it to issue electronic money and provide payment services, the bank announced on Monday.

“Securing our MiCA and EMI licences is a key step in progressing our digital asset journey in Europe,” Standard Chartered’s global head of financing, Margaret Harwood-Jones, said.

Related: Standard Chartered, Circle bring USDC minting onto banking rails

The bank said the approvals build on recent milestones, including the launch of digital asset custody services in Asia and the Middle East, and support growing client demand for regulated access to digital assets in Europe.

Cyprus leads new MiCA authorizations

Cyprus led the latest wave of MiCA authorizations, accounting for six of the newly listed crypto-asset service providers (CASPs), the highest share among EU jurisdictions.

France followed with five entries, alongside Italy and Malta, which also recorded five newly authorized CASPs. The Czech Republic and Spain added four CASPs each, while Luxembourg accounted for three listings and the Netherlands added two. Germany, Liechtenstein and Latvia each recorded one new entry.

37 newly approved CASPs in the MiCA register update on July 3, 2026. Source: ESMA

The approvals bring the total number of MiCA authorizations granted by the Cyprus Securities and Exchange Commission (CySEC) to 21, while Germany’s Federal Financial Supervisory Authority (BaFin) remains the EU authority with the most MiCA authorizations at 58.

The latest update included no changes to the register of asset-referenced tokens (ARTs), which continued to show no approved issuers, or to the list of non-compliant entities, which remained at 162.

Magazine: How crypto laws changed in 2025 — and how they’ll change in 2026