South Korean crypto exchange Upbit has rejected claims that it is participating in the issuance of Open USD after being listed among more than 140 organizations associated with the proposed stablecoin.

According to a statement issued by Upbit, the exchange has not agreed to issue or help launch the dollar-backed stablecoin, despite its operator, Dunamu, appearing on Open Standard’s published list of participating businesses. The company said it had only expressed a willingness to consider joining the OpenStandard ecosystem if it expands in the future.

The clarification follows similar statements from several South Korean companies that were also named by Open Standard earlier this week. Those responses have raised new questions about how many organizations have formally committed to the project after Open Standard introduced OUSD as a stablecoin backed by the U.S. dollar.

South Korean firms deny formal participation

Following Samsung Electronics’ earlier response, more companies have now distanced themselves from Open Standard’s announcement. As reported by crypto.news, Samsung said it had not held formal discussions with the project and did not know what role it was expected to play.

Dunamu, Shinhan Bank and K-Bank also confirmed they had received inquiries from Open Standard but said they were still reviewing the proposal and had not approved participation.

Those statements differ from Open Standard’s announcement on Tuesday, which described more than 140 organizations, including Visa, Mastercard, BlackRock, Google, Samsung Electronics and Dunamu, as businesses that had “signed up to use” OUSD.

The project also described many of those companies as founding partners that would participate in governance and share income generated from the stablecoin’s reserve assets.

Open Standard has also said participating businesses would be able to mint and redeem OUSD without paying fees or facing volume limits. According to the project’s announcement, earnings generated from reserve assets would be distributed among participating companies.

Regulatory uncertainty continues to cloud commitments

Outside the consortium debate, industry figures have questioned parts of Open Standard’s proposal. Circle CEO Jeremy Allaire previously raised concerns about whether free, unlimited minting and redemption could be maintained over time.

Separately, ARK Invest research director Lorenzo Valente described the announcement as a “giant” letter of intent, suggesting many of the listed relationships may still be preliminary rather than finalized.

South Korea’s regulatory position has added another layer of uncertainty. The country has not yet passed the Digital Asset Basic Act, leaving unresolved who will be allowed to issue stablecoins and what role different businesses can legally perform within such networks.

As crypto.news previously reported, lawmakers have continued debating whether stablecoin issuance should be limited to banks or extended to qualified non-bank companies. Until those rules are finalized, questions remain over licensing requirements, reserve management standards and the responsibilities of companies joining stablecoin ecosystems.

With several listed organizations now publicly stating that discussions remain preliminary, Open Standard’s published consortium has come under closer scrutiny as companies continue evaluating whether to participate once South Korea’s regulatory framework becomes clearer.

Belgian authorities have arrested a 19-year-old man they say was a central figure in a European phishing and money-laundering operation that netted more than €500,000 by targeting victims with fake government emails and phone calls. The suspected scheme relied on remote-access software to carry out fraud, and investigators say cryptocurrencies were used to move and launder the proceeds.

According to a Federal Judicial Police report cited by Belgian law enforcement, the arrest took place in Antwerp at an Airbnb, where a second suspect was also found. The investigation began in March 2026, when regional authorities escalated phishing as a priority.

Key takeaways

• Belgian police say the suspected phishing crew used fake government communications to trick victims into installing remote-access software.
• The operation allegedly involved money mules and cash carriers before converting proceeds into cryptocurrencies.
• Investigators characterize crypto as serving multiple roles in phishing—both as part of laundering workflows and as an enabling tool.
• Broader industry data cited in the report reinforces that phishing and social engineering remain leading drivers of crypto theft.
• Recent warnings about malicious ads on Google highlight how attackers are continuing to target users through mainstream search advertising.

Arrest in Antwerp and a laundering pipeline using crypto

In the Belgian case, the Federal Judicial Police reported that the suspected mastermind was detained in an Airbnb in Antwerp. A second suspect was discovered at the location as well, and the primary suspect was subsequently brought before an investigating judge, who issued an arrest warrant.

While authorities did not detail the full operational workflow in the cited report, they described the alleged criminal method: victims were contacted via fake government emails and phone calls designed to induce them to install remote-access software. That is a classic social-engineering pattern in phishing campaigns, because it converts a digital entry point into remote control capabilities.

Police also said the network used intermediaries—money mules and cash carriers—to process and move funds before laundering. The critical addition for the crypto angle is that investigators allege the gang ultimately laundered proceeds through cryptocurrencies, demonstrating how digital assets can be integrated into stages of criminal finance rather than remaining isolated as a payment layer.

Why this matters for crypto users and compliance

The Belgian arrest underscores a recurring reality for the crypto ecosystem: many of the highest-impact losses do not begin with vulnerabilities in smart contracts or protocol code. Instead, fraudsters frequently use human-targeted tactics to obtain access to accounts, wallets, or other assets—and then use crypto to obscure trails.

From an investor and operator standpoint, this has practical implications. It suggests that even if a platform’s underlying technology is secure, users may still face outsized risk through phishing campaigns that impersonate trusted entities. It also points to why transaction monitoring and compliance controls remain relevant even when the entry attack is “off-chain.”

For builders and exchanges, the lessons tend to be operational rather than technical: account security, verification processes for high-risk requests, user education, and fraud response playbooks can all influence outcomes when scams target individuals rather than software.

Phishing and social engineering still dominate crypto losses

The broader threat landscape aligns closely with the Belgian case. Phishing and social engineering scams are described as major contributors to crypto theft, including in reported loss figures for early 2026.

According to Hacken, phishing and social engineering accounted for $306 million of the $482 million lost in the first quarter of 2026. That data, as presented in the source reporting, frames phishing as the most prevalent mechanism behind real-world losses—even as decentralized finance security debates often focus on exploits and protocol failures.

Attackers have long exploited predictable human behavior: creating urgency, impersonating authority figures, and using convincing messaging to bypass caution. The persistence of those tactics is why the crypto community continues to treat user manipulation as a top-tier security concern, not a fringe risk.

Malicious Google ads and evolving tactics

Recent warnings show that phishing campaigns are not limited to email and direct calls. On May 25, onchain analyst “b-block” warned that scammers used Google to run malicious phishing ads impersonating decentralized exchange Uniswap, reportedly stealing more than $400,000 from victims. The warning adds another layer to the problem: threat actors may be leveraging established advertising ecosystems to reach users at scale.

In parallel, DeFiLlama said fake ads on Google are a common source of phishing attacks. Separately, Crypto cybersecurity group Security Alliance reported in April that there was a significant uptick in phishing activity on Google Search in March. Together, these points indicate that mainstream discovery channels—search ads and ad placements—can become a distribution method for crypto scams.

Blockchain security company CertiK’s Skynet report also highlighted phishing and social engineering among leading tactics used by malicious actors associated with North Korea-linked operations. The source further notes that CertiK attributed the 2022 Ronin Bridge exploit to a spearphishing campaign that involved a fake LinkedIn recruiter and a malware-laden PDF—an example of how phishing can lead into broader compromise chains.

What to watch next

With Belgian authorities tying phishing directly to crypto laundering techniques, and with multiple reports indicating phishing remains the largest share of reported losses, the next signal to track is whether law enforcement actions and platform security measures reduce scam distribution channels—especially ads and impersonation attempts—or whether attackers continue to shift to new mainstream touchpoints faster than users can adapt.

Gnosis Pay has revealed that a software flaw dating back to October 2023 enabled the $1.5 million exploit of its card safe infrastructure, while confirming that all affected users have been fully reimbursed.

According to a postmortem published by Gnosis Pay on Friday, the vulnerability was traced to version 3.4.0 of the Zodiac smart contract framework and had remained undiscovered since Oct. 30, 2023.

The company said the weakness was exploited on June 1, allowing attackers to gain control of about $1.5 million in digital assets held across its decentralized self-custodial payment network.

The report states that Gnosis Pay’s monitoring systems, operated by treasury manager NOCA, detected the first unauthorized transfer at 06:17 UTC on June 1. Engineers identified the root cause within two hours of the initial alert, after which the company suspended card services, temporarily halted its bridge to Gnosis Chain, and shared attacker wallet addresses with stablecoin issuers to help trace the stolen funds. Gnosis Pay also notified external projects that could have been exposed to the same vulnerability.

Funds restored after staged recovery

Following the incident, Gnosis Pay restored customer access in several phases. The company said the first affected accounts regained access to their balances and payment cards by the night of June 3 after new card-safe modules had been deployed. Installation continued over the following days, restoring service for 99% of users by June 6, while the remaining accounts were recovered shortly afterward.

Gnosis Pay said it absorbed the financial losses itself, leaving customers with no losses from the exploit. According to the postmortem, the attackers stole mostly GNO, EURe, USDC.e, and several other digital assets. The company added that roughly $300,000 worth of assets had not yet been recovered and recovery efforts remain ongoing.

The report also disclosed that 5,281 wallets holding at least $1 were affected by the exploit. Gnosis Pay published the attacker’s wallet address used during the incident, identifying it as 0x5a7…7a35, while explaining that the exploit targeted two components within its card safe infrastructure, the Delay Module and the Roles Module.

Smart contract exploits continue to pressure crypto platforms

The disclosure comes as security incidents continue to affect crypto infrastructure providers. As crypto.news reported earlier, Humanity Protocol recently confirmed it is repositioning toward enterprise artificial intelligence products after a $36 million exploit accelerated an internal restructuring that had already been under consideration for several months.

During an interview, Humanity Protocol founder Terence Kwok said the company had been reviewing its long-term direction for six to nine months before the breach. He explained that the exploit sped up those plans, while adding that digital identity will remain central because enterprise AI systems will require reliable ways to verify people and credentials.

Meanwhile, concerns over crypto-related cybercrime have also reached government leaders. Earlier, G7 leaders issued a joint statement after their summit in Evian-les-Bains, France, calling for coordinated action against North Korea’s cryptocurrency thefts and cybercrimes.

The statement linked the issue to long-standing concerns that stolen digital assets have helped finance Pyongyang’s nuclear and ballistic missile programs under international sanctions, a claim repeatedly supported by Western governments and blockchain analytics firms.

A pseudonymous defendant has moved to dismiss a New York lawsuit seeking ownership of 39,069 dormant Bitcoin addresses, arguing that Bitcoin addresses are merely data strings that cannot be sued.

The defendant, identifying themselves as “John Doe 33,” filed a notice of appearance and motion to dismiss on Thursday, claiming they control one of the dormant wallets named in the lawsuit.

According to the motion, the lawsuit is legally defective because Bitcoin address strings are neither persons nor legal entities subject to the court’s jurisdiction. The filing argues that a public Bitcoin address cannot itself be “found” under New York’s lost-property law because it has always been publicly visible on the blockchain.

The filing challenges the lawsuit filed in May by plaintiff “Noah Doe” and two Wyoming-based LLCs, ABC Company and XYZ Company. The plaintiffs claim the Bitcoin tied to the listed addresses constitutes abandoned property that they reported to the New York Police Department and claimed under New York lost-property law.

Regardless of how the court rules on ownership, it remains unclear how the plaintiffs could recover any Bitcoin without possessing the private keys needed to access the wallets.

Defendant files a motion to dismiss the case seeking ownership of 39,069 Bitcoin wallets. Source: iapps.court.state.ny.us  

The complaint lists 39,069 Bitcoin addresses, including wallet addresses widely associated with Bitcoin creator Satoshi Nakamoto and the Mt. Gox hacker. The listed wallets collectively hold an estimated 3.7 million BTC (worth about $234 billion), according to Sani, founder of Bitcoin analytics platform Timechain Index.

Related: Bitcoin miner MARA spent $4.3M on CEO security in 2025 as crypto attacks rise 

Defendant appears to control $300 million Bitcoin wallet

Blockchain data suggests that “John Doe 33” controls a wallet holding 5,000 BTC received in April 2014 that has remained untouched for more than 12 years, making it worth more than $300 million at current prices, according to a Friday X post from Galaxy Digital head of research Alex Thorn.

“That’s ~100x the median defendant address. This is a real holder with real standing choosing to fight, not a bystander.”

Source: Alex Thorn

Thorn added that the filing prevented what had been a “near-certain” default judgment and challenged jurisdictional and statutory defects in the plaintiffs’ case.

The supply of Bitcoin has been dormant for the past five and 10 years. Source: Bitbo

There are currently 3.5 million BTC, worth about $215 billion, that have been dormant for the past 10 years and another 6.6 million coins, worth around $406 billion, that have been dormant for over five years, Bitbo data shows.

Magazine: How crypto laws changed in 2025 — and how they’ll change in 2026

TLDR

• European regulator expands MiCA registry with 37 additional crypto service providers.
• Major financial institution Standard Chartered receives EU crypto authorization.
• Total licensed crypto asset service providers in EU reaches 280.
• Cyprus emerges as top contributor with six newly approved CASPs.
• EU regulatory framework transitions from development to active enforcement phase.

Europe’s securities watchdog has expanded its MiCA-compliant crypto registry with 37 additional firms following the conclusion of the transition window. This expansion brings the total number of authorized providers to 280. The development marks a pivotal shift from regulatory development to active market oversight.

European Crypto Registry Receives Significant Update

ESMA released its initial registry revision following the conclusion of MiCA’s transitional window on Wednesday. The Friday announcement included companies that successfully obtained crypto-asset service provider authorization. Consequently, the registry now offers enhanced transparency regarding licensed European Union operators.

ESMA’s previous registry update, issued on June 26, documented 243 crypto-asset service providers. The current revision increased this figure to 280. This expansion means 37 additional companies have entered the European Union’s structured crypto regulatory framework.

Notable additions to the registry include Standard Chartered, FalconX, Sygnum Europe, and Ronin EM. Furthermore, the electronic money token section welcomed Crédit Agricole’s CACEIS division. Notably, ESMA did not document any new asset-referenced token issuers during this update cycle.

Major Bank Secures European Crypto Authorization

Standard Chartered emerged as one of the most prominent additions in ESMA’s recent registry expansion. Luxembourg’s financial authorities granted the banking institution MiCA authorization on June 25. This approval establishes a compliant pathway for the bank’s cryptocurrency operations throughout Europe.

The financial institution simultaneously obtained an Electronic Money Institution license from Luxembourg authorities. This credential enables electronic money issuance and payment processing services. Combined, these authorizations facilitate custody operations, token-related services, and payment-integrated digital asset activities.

Standard Chartered indicated these licenses align with its broader European digital asset strategy. The institution has previously expanded digital asset custody capabilities across Asian and Middle Eastern markets. MiCA provides a unified regulatory structure for comprehensive EU market participation.

Mediterranean Nation Dominates Recent Authorization Cycle

Cyprus emerged as the frontrunner in the latest ESMA registry expansion, contributing six newly authorized crypto-asset service providers. France, Italy, and Malta each contributed five companies. The Czech Republic and Spain registered four providers respectively.

Luxembourg contributed three new registrations, while the Netherlands added two companies. Germany, Liechtenstein, and Latvia each registered one licensed provider. This geographic distribution demonstrates how individual national authorities contribute approvals to the centralized ESMA registry.

Cyprus has now issued 21 MiCA authorizations through its securities regulatory body. Germany maintains the overall leadership position with 58 authorizations under BaFin supervision. Nevertheless, smaller jurisdictions remain competitive by offering streamlined and transparent licensing procedures.

Regulatory Framework Transitions to Enhanced Oversight

The most recent ESMA registry update reveals inconsistent advancement across MiCA’s different categories. The asset-referenced token registry remains without any approved issuers. The non-compliant entities roster stayed static at 162 companies.

This disparity indicates that service provider licensing is advancing more rapidly than certain token issuance approvals. Exchanges, brokers, custodial services, and financial institutions now have established pathways. However, token issuers continue facing more stringent requirements and extended approval processes.

The registry now functions beyond a simple compliance database. It influences market access decisions, counterparty verification processes, and institutional risk assessment procedures. ESMA has transformed MiCA into an operational gateway for European Union crypto market participation.

Meta CEO Mark Zuckerberg has sounded a note of caution on the pace of “agentic” AI development, telling employees that progress on autonomous agents has not accelerated as quickly as expected despite heavy investment by major technology and crypto firms.

Speaking during a company meeting on Thursday, Zuckerberg said the “trajectory of the agentic development over at least the last four months hasn’t really accelerated in the way that we expected,” Reuters reported after reviewing a recording of the call. He added that the broader bet on agent adoption “hasn’t come to fruition yet,” even as leadership pushed harder into agent-focused infrastructure earlier this year.

Key takeaways

• Zuckerberg said Meta’s agentic AI progress has not matched expectations over the past four months, according to Reuters.
• Meta executives accelerated agent-focused infrastructure plans in January due to concerns they were moving too slowly.
• Meta still expects returns from its AI spending within three to six months, Zuckerberg said.
• Meta expanded its Meta Business Agent globally for businesses across Instagram, Messenger, and WhatsApp.
• Blockchain data suggests AI-agent transaction activity remains limited, including only about $2 million in x402-facilitated volume over the last 30 days, per Artemis.

Meta’s AI agents: expectations versus delivery

Zuckerberg’s remarks highlight a growing mismatch between the industry’s timeline for autonomous AI agents and how quickly real-world systems can scale and deliver value. While agentic AI has captured attention from both software giants and crypto-adjacent companies, Zuckerberg indicated that even within a company widely positioned for rapid experimentation, momentum has been slower than planned.

Reuters reported that Zuckerberg pointed to a lack of acceleration in the “last four months,” despite a push intended to close perceived speed gaps. He acknowledged that an aggressive January push into agentic infrastructure was driven by fears that Meta wasn’t advancing “fast enough,” while also framing the current state as not yet reaching the level of adoption leadership expected.

At the same time, Zuckerberg said he believes Meta’s AI investments will start paying off within the next three to six months. That timeframe matters for investors and teams because it signals management still expects near-term results—even if the broader agent ecosystem remains behind schedule.

Business Agent rollout across Meta’s messaging and social apps

Meta’s comments came alongside new product deployment. On Thursday, the company expanded its Meta Business Agent globally, aiming to bring agent capabilities to businesses operating across Instagram, Messenger, and WhatsApp.

According to Meta, the Business Agent is designed to handle customer inquiries, make product recommendations, and close sales without requiring human intervention. For businesses, the appeal is straightforward: agent systems can reduce response times and staffing pressure while enabling commerce flows inside channels where customers already interact.

Zuckerberg also previously said in March that he was building a personal AI agent to support CEO decision-making, reinforcing Meta’s view that agent tooling can move beyond customer-facing automation into internal workflows.

Crypto’s agent payments thesis faces measured on-chain activity

Zuckerberg’s reality check lands amid a crypto industry that has largely embraced the idea that AI agents could become major users of blockchain payments. Executives including Coinbase CEO Brian Armstrong and Circle CEO Jeremy Allaire have previously predicted that AI agents may become dominant users of blockchain-based payment rails in the coming years, as noted in coverage referenced by Cointelegraph.

In support of that narrative, several integrations have been announced in recent months. Cointelegraph previously reported that Amazon Web Services integrated Coinbase’s x402 payments protocol into Amazon Bedrock AgentCore in May, enabling agents to transact using the USDC stablecoin. Other examples cited include a Visa-supported virtual card for AI agents from Oobit launched in April for purchases in USDt (USDT).

However, the gap between “capability” and “usage” is showing up in on-chain volume. Artemis data cited by Cointelegraph suggests that AI-agent transaction activity facilitated through the x402 protocol remains comparatively small: only $2 million in trading volume over the past 30 days.

This matters because the crypto payments story around autonomous agents depends not just on integrations being possible, but on consistent demand emerging from actual agent behavior. Low volume can indicate early-stage adoption, experimentation without sustained deployment, or limitations in how agents currently interact with payment endpoints.

What to watch next for agentic AI and stablecoin payments

Zuckerberg’s comments suggest the industry may need to plan for a slower-than-hoped transition period as agentic systems mature and as businesses learn where automation genuinely outperforms human-led workflows. At the same time, Meta’s investment outlook—expecting payback within three to six months—signals continued pressure to convert AI spending into operational results.

For the blockchain segment, the next checkpoint should be whether on-chain payment volume tied to agent infrastructure increases materially from current levels, and whether new business-facing deployments like Meta Business Agent lead to measurable downstream demand for stablecoin payment rails.

Shielded Labs has raised the possibility of delaying Zcash’s Ironwood network upgrade, warning that ecosystem participants like exchanges, mining pools and wallets may not have enough time to prepare their systems for the planned activation in late July. 

Jason McGee, executive director of Shielded Labs, said in a Zcash community forum post that two major projects are moving forward at the same time. Alongside Ironwood, infrastructure providers are being asked to replace Zcash’s longstanding node and wallet software, zcashd, with a new collection of tools known as the Z3 stack.

The concerns highlight the trade-off between quickly restoring confidence in Zcash’s shielded supply and giving ecosystem participants enough time to deploy and audit the new infrastructure safely. 

Ironwood was proposed after researchers discovered an “infinity” bug in Orchard, Zcash’s main private transaction pool. The flaw could theoretically have allowed an attacker to create an unlimited amount of counterfeit ZEC tokens inside the pool without detection. Developers said there was no evidence that the pool had been exploited. However, Orchard’s privacy features make it impossible to prove that no fake coins were created. 

Source: Zooko Wilcox

Ironwood rollout collides with Zcash software migration

Ironwood would open a replacement private pool and prevent new activity inside the existing Orchard pool. Funds leaving Orchard would have to pass through an accounting checkpoint that prevents more ZEC from exiting than what originally entered. This would allow users to verify that the circulating supply remains within Zcash’s intended limits. 

At the same time, Zcash is retiring zcashd, the software used by many ecosystem participants to connect to the network and process transactions. Its replacement stack includes Zebra for operating a network node, Zaino for supplying blockchain data to applications and Zallet for wallet functions. 

The network’s official guidance documents said operators may need to modify their systems as some zcashd functions will not have direct replacements. 

Related: Why ZEC fell 40% even after Zcash patched a shielded pool bug

McGee said Zallet and Zaino were still under development and not ready for production use. Feedback gathered from infrastructure providers suggested that some expect to be ready by late July, while others need more time, he added.

McGee said no delay has been finalized. 

Zcash founder Zooko Wilcox said security reviews had found no additional serious bugs so far and that developers are also working to verify the new system before Ironwood activates. 

Magazine: Bitcoin decouples from tech stocks, Ether eyes ‘selling wave’: Market Moves