TeraWulf shares have dropped more than 7% after New York ordered a one-year pause on new environmental permits for large-scale data centers.

According to an executive order signed by New York Governor Kathy Hochul on Tuesday, the state will temporarily stop issuing new environmental permits for certain large data center projects while regulators prepare a statewide framework to assess their environmental impact.

The order gives the Department of Public Service up to one year to complete a Generic Environmental Impact Statement, which will establish standards for future data center developments. The governor’s office said the review will examine electricity demand, water use and quality, and air quality before the moratorium is lifted.

Alongside the executive order, Hochul said she is also pursuing legislation to remove sales tax exemptions currently available to large data centers across New York.

Investors reacted quickly to the announcement. TeraWulf’s Nasdaq-listed shares closed down 7.08% at $19.41 on Tuesday.

Despite the market reaction, TeraWulf said the order does not affect its existing operations or development timeline in the state.

Paul Prager, TeraWulf’s founder and chief executive officer, echoed that view in a post on X, saying the company is evaluating on-site power generation for the Lake Hawkeye project, which he said aligns with the governor’s priorities for new electricity generation.

AI business continues to expand

While its New York projects remain unchanged, TeraWulf continues to grow its artificial intelligence and high-performance computing business.

Last week, the company signed a 20-year lease agreement with Anthropic for its Justified Data campus in Hawesville, Kentucky. TeraWulf said the agreement is expected to generate about $19 billion in contracted revenue over its full term.

As crypto.news previously reported, the company is also preparing to raise about $3.5 billion through leveraged loans and high-yield bonds to finance construction of the Kentucky AI campus. Bloomberg reported that Morgan Stanley is expected to lead the financing, although final terms have not been announced.

According to TeraWulf, the Kentucky facility will support about 401 megawatts of critical computing capacity, with initial operations expected in the second half of 2027 and full deployment planned for early 2028.

The company’s latest financial results also show how its revenue mix is changing. During the first quarter of 2026, TeraWulf reported $21 million in high-performance computing lease revenue, exceeding digital asset mining revenue of just under $13 million for the first time. Total quarterly revenue stood at $34 million, compared with $34.4 million a year earlier.

TeraWulf has said its AI infrastructure business is designed to provide more predictable contracted income while continuing to use its existing power and data center assets developed during its bitcoin mining operations.

Ark Invest has expanded its exposure to Circle and Block while cutting its Robinhood position, adding nearly $15.4 million worth of shares across the three companies.

According to Ark Invest’s latest daily trading disclosure, the investment firm purchased 220,012 shares of Circle Internet Group across its ARK Innovation ETF (ARKK), ARK Next Generation Internet ETF (ARKW), and ARK Fintech Innovation ETF (ARKF). Based on Tuesday’s closing price of $63.22, the acquisition was worth about $13.9 million.

Ripple has burned another 10 million RLUSD tokens, extending a run of treasury operations that has reduced the circulating supply of its dollar-backed stablecoin. 

Blockchain data reported on July 14 showed the tokens moving from the RLUSD Treasury to a null address, permanently removing them from circulation.

The latest operation follows 10 million-token burns recorded on July 13, twice on July 10, and once each on July 9, July 8, July 7 and July 6. Ripple also minted 20 million RLUSD on July 6. The sequence shows active supply management as redemptions and new issuance change the amount available onchain.

RLUSD supply falls from its late-May peak

RLUSD’s market capitalization now stands near $1.52 billion. That is about $380 million below its late-May peak near $1.9 billion, representing a decline of roughly 20% in circulating value.

A lower stablecoin supply does not automatically show weaker adoption. Fiat-backed stablecoins expand when issuers create tokens against new dollar deposits and contract when holders redeem tokens for cash. Burns therefore record the removal of redeemed supply rather than directly measuring transaction demand or user growth.

Repeated burns follow active treasury management

The latest burn adds to several similar transactions within little more than one week. According to the reported Ripple Stablecoin Tracker data, at least 80 million RLUSD has been burned since July 6, while 20 million tokens were minted during the same period.

Those transactions show how quickly stablecoin supply can change when large holders redeem or issue tokens. The movements do not explain who redeemed the RLUSD or why. Ripple has not publicly tied the recent burns to one customer, market event or change in its wider stablecoin strategy.

Ripple expands RLUSD use beyond basic payments

The supply contraction comes as Ripple continues adding new uses for RLUSD. As per report, Ripple joined the x402 Foundation as a Premier Member as the Linux Foundation moved the open payment standard under formal governance.

The initiative focuses partly on machine-to-machine payments. XRP and RLUSD can support payments by AI agents through x402 on the XRP Ledger, giving autonomous software a way to settle transactions using blockchain-based assets.

Ripple also introduced new tools aimed at developers building AI payment applications. As previously reported, the company launched the XRPL AI Starter Kit in June, allowing developers to build software agents that can send and receive payments.

The company is positioning RLUSD as one settlement asset that developers can use for those transactions. The work adds another potential use case for the stablecoin beyond exchange trading and traditional cross-border transfers.

RLUSD remains active across the XRP Ledger

Recent supply reductions also follow a period of growing RLUSD activity on the XRP Ledger. Evernorth said RLUSD pairs had generated more than $2.5 billion in XRP Ledger trading volume since launch.

The figures included about $900 million in volume from the RLUSD/XRP pair over six months. Evernorth also reported that the XRP Ledger held slightly more than half of RLUSD’s circulating supply by late June.

That distribution can change as minting, burning and cross-chain transfers continue. However, the figures show that RLUSD remains active across trading and settlement markets even as its total circulating supply falls from its May peak.

Ripple has also continued expanding RLUSD through institutional and payment partnerships. A coverage showed that the company is increasingly connecting the stablecoin with automated payment infrastructure and emerging machine-to-machine transaction systems.

The latest 10 million RLUSD burn reflects another reduction in outstanding supply while Ripple continues building new payment and settlement uses. The market will now watch whether the current burn cycle continues or whether new minting resumes as demand changes.

At about $1.52 billion in market capitalization, RLUSD remains below its May peak. Future treasury movements could provide a clearer picture of whether the recent contraction represents a temporary redemption cycle or a longer period of lower circulating supply.

Base creator Jesse Pollak says he is stepping back from leading the Base App after admitting he made a “wrong bet” on social, leaving the chain to fall behind on prediction markets and perpetual futures. 

In a post to X on Wednesday, Pollak said he had bet that creator, content and messaging apps would drive adoption, but instead the market “disintegrated completely.” 

“We realized how our focus on social had meant that base had fallen behind in key areas that were now increasingly critical — we had perps (shoutout avantis!) and prediction markets (shoutout limitless!), but both were well behind scaled competitors.”

Pollak’s comments give further insight into the reversal of Base’s growth strategy earlier this year. While Base initially focused on social products such as Farcaster, Zora and miniapps to bring crypto to “a billion people,” Pollak said financial applications are the way forward for the network, with a focus on trading, payments and AI agents. 

Limitless Exchange’s monthly notional volume is only a fraction of its larger competitors. Source: Dune Analytics

Pollak added he will be returning leadership of the Base App to Coinbase, under Jordan Fish, known on X as “Cobie,” while he focuses on the Base blockchain. 

Coinbase CEO: “We messed up” on content coins

Pollak’s post came just days after Coinbase CEO Brian Armstrong acknowledged content coins “didn’t work,” prompting the company to pivot earlier this year. 

“We messed up, time to turn the page,” Armstrong said on Monday. 

In February, Base sunset its Creator Rewards program and Farcaster-powered social feed as part of a strategic shift to tradable assets. 

Related: Moonbeam to pivot from Polkadot to Base, unveils AI agent framework

The Creator Rewards program launched in July 2025 and was intended to make the Ethereum layer-2 Base a more social ecosystem, where activity and engagement translate into earnings. Meanwhile, Pollak admitted the Base App was an “imperfect Farcaster client.” 

Base’s work on stablecoins, AI agents 

Last week, Base activated its B20 token standard on the mainnet, introducing a native framework for stablecoins, tokenized real-world assets (RWAs) and other fungible tokens.  

In May, Base launched Base MCP (Model Context Protocol), a tool that lets users manage their crypto directly from an AI model’s chat interface and interact with crypto protocols such as Morpho, Moonwell, Uniswap, Aerodrome, Avantis, Bankr and Virtuals.

In April, Base said it was upgrading key systems in preparation for an AI agent economy as part of its 2026 roadmap. It highlighted real-world asset (RWA) tokenization, stablecoins, and prediction markets as being key growth areas in 2026.  

“We’re going to build base into the blockchain for global finance and do everything we can to be the place that the world’s money settles over the next century,” Pollak said on Wednesday.  

Magazine: Is Robinhood Chain’s success bullish or bearish for ETH the asset?

Ethereum-backed EthSystems has launched with support from Bitmine, SharpLink and Consensys CEO Joe Lubin, adding another independent organization to Ethereum’s institutional development network after the Foundation cut 54 roles.

According to an announcement from EthSystems on Tuesday, the for-profit company will build confidential infrastructure for banks, asset managers, and other regulated institutions using Ethereum.

Bitmine and SharpLink, two major Ethereum treasury companies, have backed the venture alongside Lubin, who co-founded Ethereum and later founded Consensys.

EthSystems was spun out of the Ethereum Foundation and was established by former Foundation employees Mo Jalil, Oskar Thorén, and Aaryamann Challani. The three founders previously worked on the Foundation’s Institutional Privacy Task Force.

EthSystems targets confidential institutional finance

The company said it will help financial institutions use public Ethereum without exposing sensitive information such as trading positions, transaction details, or client identities to the full network.

Its work is expected to include privacy systems based on zero-knowledge cryptography, which can verify transactions without revealing the underlying data.

“The business model is simple: bespoke consulting, focused on solving the hardest blockers for institutional adoption,” the team wrote.

“In practice, this means continuing a lot of the work we have been doing, only charging money for it,” it added. “Commercial engagements often require a commercial counterparty.”

Alongside paid consulting, EthSystems said it will continue publishing protocol specifications and contributing to open-source projects.

While working within the Institutional Privacy Task Force, the founders held hundreds of discussions with central banks, regulators, and financial institutions, according to the company.

Their previous work included private bonds using zero-knowledge proofs, confidential stablecoin transfers, private cross-chain settlements and the Ethereum Privacy Map.

“Our mission: help institutions build confidential systems on public Ethereum without giving up what makes Ethereum worth using,” the team wrote.

EthSystems has emerged during a major reorganization of the Ethereum Foundation and its technical teams.

On June 23, the Foundation cut 54 jobs, equal to about 20% of its workforce, after a months-long review of its spending, staffing and long-term responsibilities.

The organization reorganized its work into five divisions covering protocol, access, users, community, and institutional activity. Separate groups continue to manage operations and administration.

The Foundation said the restructuring would allow it to direct staff and resources towards responsibilities that it believes only the organization can perform.

“These decisions were hard, but they are necessary,” the Foundation said in June. “We must be resourced and organized in a way that allows us to focus on the critical work that only EF can, and therefore must, do in the coming years.”

In July, the Foundation also dissolved its Protocol Support team, which had coordinated All Core Developers meetings, network upgrade tracking, Ethereum Improvement Proposal support, Forkcast, and the Ethereum Protocol Fellowship.

Mario Havel, who worked with Protocol Support for more than five years, said he remained at the Foundation but confirmed that the rest of the team had been dissolved.

“I am still part of EF, continuing my work and figuring out what’s most needed in the future,” Havel wrote on X. “However, all of my team, Protocol Support, that I have been part of for 5+ years, has been dissolved.”

Independent Ethereum groups take on new roles

EthSystems joins Ethereum Institutional and EthLabs, two other independent organizations backed by Bitmine, SharpLink, and Lubin.

EthLabs is expected to take on major Ethereum protocol research and development work, while Ethereum Institutional has been positioned as a neutral contact point for financial companies building on the network.

Lubin previously told The Block that he expected at least three organizations to emerge from the Foundation as it concentrated on censorship resistance, open-source development, privacy, and security under its CROPS framework.

“As EF continues doubling down on cypherpunk fundamentals, especially with a focus on individuals, there’s room for an independent for-profit entity that can make different choices in the trade-off space,” EthSystems wrote.

Despite the restructuring, the Foundation’s protocol division remains responsible for Ethereum’s core technology, including privacy, security, decentralization and censorship resistance.

Ethereum developers are also continuing work on the Glamsterdam upgrade, which includes proposed changes to block construction, data access, and network performance.

Hyperliquid has added a pre-IPO perpetual market linked to ChangXin Memory Technologies, or CXMT, giving traders synthetic exposure to the Chinese chipmaker before its Shanghai debut.

The contract, listed as xyz, traded near $8 on July 15, according to on-chain market data cited by Hyperinsight. Applied to CXMT’s expected post-IPO share count of 66.881 billion shares, that price implies a valuation near $535 billion, about 6.3 times its official IPO valuation.

Hyperliquid opens a synthetic route to CXMT

The CXMT contract operates through Hyperliquid’s HIP-3 framework, which allows outside deployers to create perpetual markets linked to assets beyond cryptocurrencies. These markets trade as derivatives rather than spot securities, so the CXMT contract does not provide ownership, dividends or voting rights in the Shanghai-listed company.

Individual investors on China’s STAR Market generally face a RMB 500,000 asset threshold and a two-year trading-experience requirement. Hyperliquid offers a separate synthetic market that can give eligible users price exposure without access to the underlying A-share. The distinction also means the contract price can differ sharply from CXMT’s official share price.

CXMT contract trades far above IPO valuation

CXMT priced its IPO at RMB 8.66 per share and expects to raise about RMB 57.9 billion, or $8.55 billion, before any over-allotment option. Reuters reported that the deal will be Asia’s largest IPO of 2026 so far and China’s biggest A-share semiconductor offering, surpassing SMIC’s 2020 share sale.

At the offer price, CXMT’s expected post-listing value is about RMB 579.2 billion, or roughly $85.5 billion. A synthetic price near $8 implies about $535 billion, placing the Hyperliquid contract around 526% above the dollar equivalent of the IPO price. The gap reflects pricing in a separate derivatives market and does not set CXMT’s official equity valuation.

China’s largest DRAM maker prepares for listing

CXMT is China’s largest DRAM producer and ranks fourth globally, behind Samsung Electronics, SK Hynix and Micron. Recent market estimates place its global DRAM share near 8%. The company has expanded as China invests heavily in domestic semiconductor production and demand for memory chips grows alongside artificial intelligence infrastructure.

Reuters also reported that CXMT secured a long-term memory supply agreement with Tencent worth more than RMB 20 billion, or about $2.94 billion. Investor subscriptions for the STAR Market offering begin on July 16, while the shares are scheduled to start trading in Shanghai on July 27. CXMT plans to use the IPO proceeds for production and technology investment.

Hyperliquid widens its real-world asset markets

Hyperliquid’s HIP-3 framework allows builders to launch perpetual markets linked to stocks, commodities and other real-world assets. A pre-IPO SpaceX contract also traded through the framework, showing how on-chain derivatives can create markets around companies before their public shares become available.

Hyperliquid has also expanded its connection to tokenized securities. As reported by crypto.news, Ondo Finance brought 35 tokenized U.S. stocks and ETFs to HyperEVM in June. Those products differ from the CXMT perpetual because tokenized securities can use structures backed by assets held through custodians, while perpetuals provide synthetic price exposure.

The CXMT market gives traders another route to speculate on a major public offering before its debut. Attention will now turn to whether the 526% premium narrows before subscriptions start and after the underlying shares begin trading on the STAR Market.

CFTC has ordered Kalshi to keep operating in Michigan despite the platform already unwinding sports event trades to comply with a state court order, deepening the dispute over who regulates prediction markets in the U.S.

According to a July 14 order from the U.S. Commodity Futures Trading Commission (CFTC), Kalshi must not comply with Michigan’s directive to stop offering sports event contracts and should continue operating, even after the company said it had already reversed trades to satisfy the state court’s requirements.

The conflicting instructions have left the CFTC-regulated prediction market platform caught between state and federal authorities. In a statement posted on X, Kalshi’s head of enforcement and legal counsel, Robert DeNault, said the company had already unwound the affected trades because the Michigan court required it to do so.

“We are disappointed by this decision and believe it is unfair to Kalshi,” DeNault said. 

“We already acted and unwound the trades, as the Michigan court order required us to do. We are being put in an impossible position, looking to follow state court orders that may contradict our federal regulatory obligations. We did not have a choice.”

A Kalshi spokesperson told Reuters the company is reviewing the CFTC’s order and weighing its next steps.

The regulator said Michigan became the first state to attempt to interfere with derivatives contracts after they had already been executed, describing the move as a challenge to the federal framework governing designated contract markets.

CFTC Chair Michael Selig said canceling completed trades could create uncertainty across financial markets.

“Canceling trades that have already been executed is an unprecedented step that risks a cascading effect on the entire marketplace and undermines the certainty in contracting that is a necessary component of a functioning market,” Selig said.

“The Commission will not allow states or state courts to bully registered entities into violating the Commodity Exchange Act and CFTC regulations,” he added.

Speaking on Fox Business last week, Selig also said it was “critical” that the CFTC preserve its authority over prediction markets.

He added that the agency had already sued nine states and would continue taking legal action against any state seeking to impose civil or criminal penalties on CFTC-registered exchanges.

Michigan case adds to national legal fight

The latest order follows a June 29 ruling by Ingham County Circuit Court Judge Rosemarie Aquilina, who temporarily barred Kalshi from offering sports event contracts to Michigan residents while the state’s lawsuit proceeds. The court warned the company it could face fines of up to $120,000 per day if it failed to meet geolocation requirements.

Michigan Attorney General Dana Nessel has argued that Kalshi’s sports event contracts operate as unlicensed gambling products under the state’s Lawful Sports Betting Act. Kalshi has maintained that its event contracts fall under the Commodity Exchange Act and therefore remain subject to the CFTC rather than state gaming regulators.

Michigan is one of several states challenging Kalshi’s sports contracts. Massachusetts has secured a preliminary injunction blocking the platform from offering similar products while litigation continues, and a court recently allowed state authorities to expand their complaint with new allegations, including claims that Kalshi targets users under 21.

New York has also handed Kalshi an early setback. Earlier this month, Judge Analisa Torres denied the company’s request for a preliminary injunction, allowing the state’s lawsuit to continue after finding Kalshi had not shown it was likely to succeed on its argument that federal commodities law preempts New York’s gambling laws.

As the legal disputes expand, the CFTC continues to argue that Congress granted it exclusive authority over federally regulated prediction markets, while several states maintain that sports event contracts function as sports betting and should remain subject to state gaming laws.

The whole operation took less than an hour, and the most valuable thing the attacker stole was not money. It was credibility. On Sunday, July 12, the verified X accounts of SpaceX and Starlink, with two million and 1.6 million followers between them, reposted promotional content for a memecoin called SCATMAN.

The repost sat in the normal flow of the accounts’ output, alongside routine posts about Grok model updates, with no defacement, no changed banner, none of the usual tells of a takeover. It simply looked like SpaceX had something to say about a token.Buyers responded the way buyers respond. In the first twenty minutes the token rose 575%. By the time the posts came down on Sunday evening and the accounts were restored, the attacker had minted ten trillion SCATMAN, sold the supply across two wallets for roughly 73.7 ether, and walked away with about $135,000. Everyone who bought on the strength of a SpaceX repost held a worthless token.

The dollar figure is almost embarrassing. A hundred and thirty five thousand dollars is a rounding error next to the eight figure hacks that define crypto’s security discourse, and it is nothing at all next to the $1.16 billion in bitcoin sitting on SpaceX’s own balance sheet. That gap between the scale of the brand exploited and the size of the payday is the actual story, and it points at something the industry has not solved: the cheapest attack surface in crypto is not a smart contract or a bridge. It is a login.

Every serious defense crypto has built assumes the attacker must beat cryptography, economics, or code. The July 12 attacker beat none of those. They beat a password, borrowed a decade of accumulated public trust for roughly forty minutes, and converted it directly into ether at the expense of anyone who believed what a verified account told them.

What happened, in order

The sequence, reconstructed from onchain analytics and screenshots circulated before the posts were deleted, is short enough to fit in a paragraph and repeatable enough to fit in a playbook.An account calling itself Sam Catman appeared, displaying an affiliation badge that falsely tied it to SpaceX’s artificial intelligence work. The name was a pun on Sam Altman, timed to the ongoing public feud between Elon Musk and the OpenAI chief executive, a feud that had produced a $150 billion lawsuit and had Musk himself posting about scamming the day before the breach. The joke did work that the token itself could not: it made the promotion feel like something SpaceX might plausibly amplify. Musk’s companies post irreverently. A crude swipe at a rival chief executive, delivered as a memecoin, sits within the observed behavior of the brand, and that plausibility was engineered rather than lucky.

The SCATMAN token was deployed on Robinhood Chain, the trading platform’s layer 2 network that had gone live eleven days earlier and permits anyone to deploy a token without approval. The SpaceX and Starlink accounts then reposted the Sam Catman promotion, complete with the contract address and ticker.

Trading exploded. Reported peak market capitalization varies sharply by source and by measurement window, from roughly $800,000 in the first twenty minutes to $2 million on some trackers to $32 million at the high water mark reported by onchain analysts, with twenty four hour volume around $5.7 million. The spread itself tells you something about the quality of the market: on a token this thin, market capitalization is a number generated by the last trade, not a measure of anything real.The attacker sold. Onchain analytics firm Lookonchain traced ten trillion tokens dumped for 59 ether, worth about $108,000, from one wallet, and a further 59.28 million tokens sold for 14.7 ether, about $27,000, from a second wallet controlled by the same actor. Liquidity drained. The price collapsed. The posts were removed, the Sam Catman account was suspended, and control of the SpaceX and Starlink handles was restored the same evening.

As of publication, neither SpaceX nor X has explained how the accounts were compromised. Robinhood has not commented on its chain hosting the token. Every figure in the paragraphs above comes from third party onchain analysis, not from any company disclosure, which is itself worth noticing: the only institution that produced a public account of what happened was the blockchain.

Credibility arbitrage is the business model

Strip away the specifics and the attack has one moving part. Attackers are not building audiences. They are borrowing them, for the length of a single post, and converting borrowed trust into ether before the loan comes due.The economics are brutal in their simplicity. A memecoin launched by an anonymous wallet reaches nobody. The same token, reposted by an account with two million followers that has spent a decade earning the right to be believed, reaches a market instantly. The attacker does not need the trust to last. They need it to survive for the length of a candle.

This is why the payday size is misleading as a measure of severity. The constraint on the attacker’s profit was not the audience or the credibility. Those were enormous. The constraint was market depth: there simply were not enough buyers with enough capital in the pool to absorb ten trillion tokens at a higher price. The attacker extracted essentially all the liquidity that existed. On a deeper chain, or with a slower response from Musk’s security team, the same attack with the same inputs produces a much larger number. The record supports that reading. When attackers seized the dormant account of Keith Gill, better known as Roaring Kitty, in May, they launched a token on Solana and cleared more than $600,000 in half an hour. When the Pump.fun account was compromised in February 2025, one wallet made over $135,000 in under a minute. A hijacked account belonging to former Malaysian prime minister Mahathir Mohamad produced $1.7 million in losses.

The pattern list is long and its membership is indiscriminate. The United States Securities and Exchange Commission’s own account announced a fake bitcoin ETF approval in January 2024, moving the entire market. Scroll co-founder Ye Chen’s account was taken over in January 2026. Pepe creator Matt Furie’s account pushed a scam token months later. World Liberty Financial co-founder Zach Witkoff, the leader of Myanmar’s junta, and a BBC presenter have all been used as unwitting distribution. What unites them is not an industry, a chain, or a security posture. It is a follower count.

The defense industry has no product for this. There is no audit that certifies a chief executive’s password manager. There is no bug bounty covering a social media platform’s session token handling. The security spend that protects a protocol treasury, multisig thresholds, hardware wallets, timelocks, all of it terminates at the edge of the chain, and the attack originates one layer above, in a consumer product operated by a company with no stake in crypto’s outcomes. The industry has outsourced its most important trust primitive to a social network and has no contractual relationship with it whatsoever.

Why the defenses that exist do not cover this

Crypto has spent years building defenses against a different threat model. Audits check contract code. Bug bounties surface protocol flaws. Formal verification proves that a program does what its specification says. Timelocks and multisigs guard treasuries, a lesson the industry learned expensively when a single vote drained a DAO, which crypto.news examined in its explainer on what a governance attack is. All of that machinery assumes the attack comes through the chain.

The SCATMAN attack came through a social media account. There was no contract to audit, because the contract did exactly what it was written to do. There was no protocol to exploit, because no protocol was exploited. Robinhood Chain worked as designed: it let someone deploy a token permissionlessly, and it let that token trade. Every component behaved correctly, and buyers still lost their money, because the failure happened in the layer nobody in crypto controls and everybody depends on, the layer where reputation is stored.

Consider what a diligent buyer could actually have done in the twenty minute window. Check the contract? It was a standard token; the exploit was the promotion, not the code. Check holder concentration? The attacker held everything, which describes most tokens in their first minutes and is not by itself proof of fraud. Check the liquidity lock? There was liquidity, briefly. Check the source? The source was SpaceX. That was the whole point.

The honest conclusion is that the standard retail checklist offers close to zero protection against this specific attack, because the checklist assumes the promotion is the least trustworthy input and the chain data is the most trustworthy. Here the chain data looked ordinary and the promotion looked impeccable. The only defense that works is a rule rather than an inspection: no verified account’s post, from any brand, is a reason to buy a token minted minutes earlier. That rule costs its holder every genuine celebrity token launch, which is a price most people should be delighted to pay.

The Robinhood Chain problem

The venue is not incidental. SCATMAN landed on a chain in its second week of life, and the chain’s condition shaped the outcome.Robinhood Chain launched on July 1 as a permissionless layer 2 aimed at onchain finance and real world asset tokenization. What arrived instead, at least first, was memecoins: more than 75% of trading volume in the opening week, with the network’s memecoin market capitalization briefly topping $244 million, more than $3 billion in cumulative decentralized exchange volume, and 19,586 new tokens created in a single day by July 13, second only to Solana. Cross chain interoperability provider Relay Protocol publicly warned about honeypot tokens proliferating on the network, coins hardcoded so buyers cannot sell or whose transfers route funds to an attacker, and said it was blocking them as they appeared.

That is the environment SCATMAN exploited: a young chain with real retail attention, minimal mature tooling, and an inflow of tokens far exceeding anyone’s ability to screen them. It is not a Robinhood specific failure. It is what permissionless launch infrastructure looks like at week two, and Solana’s own history through the rise of memecoin launchpads documents the same arc. The difference is the brand on the door. A chain carrying the name of a mainstream retail brokerage, whose users skew toward people who have never evaluated a token contract in their lives, inherits a duty of care that a purely crypto native chain never had, and the network’s design offers no obvious way to discharge it.

Robinhood’s silence on the incident is therefore the most interesting non-event of the week. The company did not deploy the token, did not promote it, and cannot in any technical sense prevent the next one. It also cannot escape the fact that a scam bearing SpaceX’s stolen credibility used its chain to reach its users. The gap between what a chain operator controls and what a chain operator is blamed for is about to become a live commercial question, not a philosophical one.

The tell that was there, and why it did not help

There was one genuine signal available in real time, and almost nobody could use it.The Sam Catman account was new. Its affiliation badge, the marker that ties an account to a parent organization on the platform, was fraudulent, claiming a link to SpaceX’s artificial intelligence work that did not exist. Someone who knew how badge inheritance works, who checked the account’s age, and who understood that a legitimate SpaceX subsidiary would not announce itself through a pun account, could have identified the fraud before buying.

That describes a vanishingly small population, and it describes them under conditions that made the knowledge useless. The window was twenty minutes. The signal required domain expertise in social media platform mechanics, not crypto. And the accounts amplifying the fraud were the exact accounts a user would check to verify it. The verification path led straight back to the attack.

This is what makes brand token crime structurally different from the failure modes retail has been trained on. A rug pull on a random token asks a buyer to evaluate a stranger and get it wrong. A hijacked account asks a buyer to evaluate an institution and get it right, then punishes them for the institution’s operational security failure. The buyer’s diligence was not insufficient. It was aimed at the wrong entity, because the entity that failed was never one they could inspect. The generic advice to check holder distribution and creator history, sound guidance across the meme coins landscape, simply does not reach a case where the creator’s history is a forged badge and the distribution looked normal for sixty seconds.

The case that this does not matter much

There is a serious argument that the industry should be relaxed about all of this, and it deserves a fair hearing.Start with the numbers. The total damage was $135,000, spread across an unknown number of buyers who chose to purchase a token named after a joke about a lawsuit, minted an hour earlier, on a chain eleven days old. Compare that to the $11 billion in crypto related losses the FBI’s Internet Crime Complaint Center reported in 2025, or the industrial scale of romance and investment fraud operations. Account takeover memecoin scams are, in aggregate, a rounding error against the frauds that destroy people’s lives.

Continue with responsibility. Nobody was tricked into revealing a private key. No wallet was drained. Buyers made a voluntary purchase of a speculative asset in an unregulated market on the basis of a social media post, which is a decision the market is entitled to price. The permissionless systems performed exactly as advertised: anyone can create a token, anyone can buy it, nobody is protected. That is the deal, and it is disclosed in every interface.

Add that the response worked. The accounts were recovered within hours. The posts were deleted. The fake account was suspended. Lookonchain published both wallet addresses, meaning the proceeds are now permanently marked and traceable, an outcome that traditional financial fraud rarely delivers. Exchanges can flag those addresses. Investigators have a starting point. Compare the transparency of that aftermath to a wire fraud of equivalent size, where the money simply disappears into correspondent banking. Upbit’s freeze of proceeds after a recent onchain treasury attack shows that marked funds are not merely symbolic, and exchanges do act on published addresses when the trail is clean enough.

Finish with proportion. The attack is self limiting. Its profit is capped by the depth of the pool it dumps into, and thin pools are thin precisely because the market has correctly assessed these tokens as worthless. The scam succeeds only against buyers who ignore every rule the industry has spent a decade writing down.None of that is wrong. It is also, taken together, an argument for doing nothing, which is why the counterargument matters more.

The case that it matters a great deal

The dismissive reading treats $135,000 as the measure of the harm. It is the measure of the attacker’s revenue, which is a different quantity entirely.The harm is the erosion of the only verification mechanism retail actually uses. Ordinary people do not read contracts. They read who is saying it. That heuristic, trust the verified account of a company that builds rockets, is the single most reliable signal available to a non technical person on the internet, and each successful hijacking teaches the market that the signal is unreliable. A world in which no institutional account can be believed is a world in which every genuine announcement, every legitimate product launch, every real partnership arrives pre-discounted. The industry is spending down a shared reputational asset it did not build and cannot replenish, one $135,000 withdrawal at a time.

Then consider the trajectory. This attack costs almost nothing to attempt, carries low apparent consequence, and produces a payday in minutes. The rate of attempts is a function of expected value, and expected value is rising as more mainstream brands acquire crypto surfaces. SpaceX now holds 18,712 bitcoin and trades as a Nasdaq-100 component whose price is discovered partly on crypto rails, a structural reality crypto.news examined when the stock joined the index. Every corporate account with a crypto adjacent story is now a live financial instrument, whether the company knows it or not, and the compromise of such an account is no longer a public relations incident. It is a market event.

Notice too what the attacker actually needed: no capital, no code, no confederates, and roughly one hour. Meanwhile, the defenders needed exactly what they did not have, which is a way to un-say something to millions of people faster than a bot can buy. Deletion is not a remedy when the trade has already cleared. The asymmetry is total: the attack executes at the speed of a repost, and the correction executes at the speed of a corporate security team noticing, escalating, and regaining access. In the interval, an irreversible ledger records everything.

And the regulatory exposure is asymmetric in an ugly way. Attackers face weak enforcement against pseudonymous wallets. The chains, the brokerages, and the exchanges hosting the activity face regulators who are actively deciding, this month, how much responsibility infrastructure operators bear for what runs on top of them. Every SCATMAN is evidence in that proceeding, and it is evidence that arrives conveniently packaged: a household brand, a retail brokerage’s chain, an unsophisticated victim class, and a perpetrator who will probably never be identified. The industry’s argument for permissionless infrastructure gets harder to make each time permissionless infrastructure is the medium through which a stolen brand robs retail buyers, and the regulatory window in which those arguments are being weighed is measured in weeks, not years.

What would actually change the math

Nothing in the current toolkit addresses the root cause, which is that a verified account’s authority transfers instantly and totally to whoever controls the login at a given moment.

The platform side is straightforward and unattempted. Hardware key enforcement for accounts above a follower threshold. Delay windows on posts containing contract addresses from accounts that have never posted one. Loss of affiliation badge inheritance for accounts created within a defined period. None of these is technically hard. All of them are commercially unattractive to a platform that monetizes velocity, and none has been implemented despite three years of nearly identical incidents. The absence is not a technology gap. It is a revealed preference about whose losses count.

The chain side is more interesting because it cuts against the ideology. A permissionless chain cannot vet tokens, but the interfaces on top of it can, and increasingly do: Relay Protocol’s honeypot blocking is exactly that, a voluntary screening layer occupying the gap between what the protocol permits and what users can survive. Expect more of it, and expect the resulting fight over whether interface level screening is prudent stewardship or the reintroduction of the gatekeepers the entire architecture was built to remove.

The user side is the only one available today, and it is a single sentence: the credibility of the messenger tells you nothing about the token, because the messenger’s credibility is exactly what is being stolen. A verified account promoting a token minted minutes ago is not evidence of legitimacy. Under current conditions it is closer to evidence of the opposite.

The ledger nobody wants to read

Here is the uncomfortable arithmetic of July 12. A brand worth over a trillion dollars in public market value was used, without consent, to sell a worthless asset. The theft netted about the price of a modest car. The proceeds are permanently visible on a public ledger. The victims have no recourse. The platform has said nothing. The chain has said nothing. The brand has said nothing. And the mechanism that made it all possible remains completely intact, available to anyone who compromises the next account.

The scam economy has discovered that the most valuable asset in crypto is not any token. It is a moment of unearned belief, and belief is the one thing on this market with no smart contract protecting it, no audit verifying it, and no liquidity lock keeping it in place. Until that changes, $135,000 is not a measure of the damage. It is a receipt for the trial run.

Disclaimer: This article is for informational purposes only and does not constitute investment advice. Figures on wallet activity, token supply, and market capitalization derive from third party onchain analytics reported by Lookonchain, GeckoTerminal, and DEX Screener, not from official company disclosures, and reported peaks vary between sources. No company involved has confirmed the breach mechanism. Details reflect information current as of July 14, 2026, and are subject to change. Always do your own research.

Fast-settling prediction markets can change how traders behave in the underlying market. A new research paper by scholars at Stanford University and Singapore Management University argues that Polymarket’s five-minute Bitcoin prediction contracts created incentives for some participants to manipulate spot prices shortly before settlement—transferring value from less sophisticated traders to those able to exploit the timing.

The study examines short-horizon contracts that settle based on Bitcoin’s price relative to a fixed threshold at the end of each five-minute trading window. Because settlement relies on Chainlink price feeds tied to the end-of-window spot price, the paper concludes that traders have a window of opportunity to influence the reference price immediately before contracts expire.

Key takeaways

• The paper links Polymarket’s five-minute Bitcoin contracts to unusual spot-market order-flow spikes immediately before settlement.
• Researchers observed rapid spot-price reversals consistent with manipulation around the settlement reference point.
• The study estimates roughly $1.28 million shifted from ordinary traders to manipulators over the sample period.
• Extending the contract duration from five minutes to 15 minutes “largely eliminated” the effect, suggesting design choices matter.
• Settlement mechanics—not prediction markets themselves—appear to be the key risk factor, with solutions including longer settlement windows and alternative pricing methods.

Short settlement windows can reward “price chasing”

Polymarket’s five-minute Bitcoin prediction markets allow traders to bet whether BTC will finish above or below a predetermined level after five minutes. The contracts settle using Chainlink price feeds that reference Bitcoin’s price at the end of each trading window.

According to the paper, this settlement approach can distort incentives: when the reference price is determined at a specific moment, sophisticated traders may find it profitable to push the spot market in the minutes—and sometimes seconds—leading up to that timestamp. In other words, the act of trading the prediction contract can become coupled to short-term spot-market execution just before settlement.

What the researchers found in order flow and price behavior

To test the claim, the researchers analyzed trading activity around the period when Polymarket introduced these contracts in July 2024. Their focus was on how spot-market dynamics changed before and after the contracts launched.

The study reports sharp increases in Bitcoin spot-market order flow shortly before settlement, followed by rapid price reversals after the five-minute windows closed. The authors interpret the combination of pre-settlement buying/selling pressure and post-settlement reversal patterns as consistent with settlement-price manipulation rather than normal price discovery.

While manipulation cannot be directly proven from order flow alone, the paper’s reasoning is grounded in the timing: when contracts settle to a price snapshot at the end of a short window, traders can potentially profit by targeting that snapshot rather than forecasting longer-term movement.

How much value may have been transferred—and what reduces the risk

The paper estimates that, during the sample period, the behavior transferred about $1.28 million from “ordinary traders” to “manipulators.” The precise mechanism appears tied to who can influence market prices effectively at the moment of settlement, leaving others exposed to outcomes they did not cause.

Importantly, the authors also report that extending contract durations from five minutes to 15 minutes largely eliminated the effect. That result points to a practical mitigation: the shorter the time between trading and settlement—especially when settlement depends on a single end-of-window price—the more likely it is that incentives align around momentary spot-market tactics.

The study emphasizes that its findings do not mean prediction markets are inherently vulnerable to manipulation. Instead, the risk seems to stem from settlement design. The researchers highlight potential fixes such as longer settlement windows and alternative pricing methods—for example, time-weighted average prices (TWAP)—which reduce how profitable it is to “hit” a single reference timestamp.

Why this matters beyond crypto regulation

The implications are not limited to decentralized or crypto-native venues. The paper notes that traditional exchanges, including Nasdaq and Cboe, have proposed event contracts tied to asset prices. As prediction markets expand into more regulated financial settings, contract engineering could become a central question for regulators and market designers.

From an investor or trader standpoint, the study suggests that the safest products are not simply those with better liquidity or reputations, but those with settlement logic that limits the link between contract settlement and immediate underlying-market price moves. Readers should therefore watch for how venues specify reference prices—whether they use end-of-window snapshots, TWAP-style measures, or other anti-gaming mechanisms—especially for short-dated contracts.

Meanwhile, legal scrutiny around prediction markets continues to intensify in the US. Earlier this year, multiple states challenged platforms including Kalshi and Polymarket. Separately, the Commodity Futures Trading Commission has argued that federally regulated event contracts fall under its “exclusive jurisdiction” rather than state gambling laws. The dispute is now moving through the federal courts, and observers have said conflicting appellate rulings could ultimately require the US Supreme Court to determine whether states or the CFTC have primary authority.

World Cup momentum lifts prediction market volumes

While the new research focuses on settlement mechanics, the wider sector continues to grow in terms of activity. Prediction markets posted record trading volumes in June as the 2026 FIFA World Cup drove interest across platforms.

According to DefiLlama data cited in the article, Kalshi processed about $9.4 billion in trading volume during June, while Polymarket International handled roughly $4.3 billion. The World Cup winner markets generated more than $5.4 billion in combined trading volume, with Polymarket accounting for about $4.25 billion and Kalshi about $1.2 billion, based on platform-reported figures at the time of writing.

This surge underscores why contract design issues are likely to remain prominent: when volumes rise and markets move from niche speculation to mainstream attention, the economic incentives to exploit structural weaknesses can grow alongside participation.

Going forward, the key question for traders, builders, and regulators is whether venues can scale prediction markets without creating exploitable settlement dynamics—especially for very short-dated contracts. The Stanford and Singapore Management University findings suggest that changing the settlement window length and using price-averaging methods could meaningfully reduce manipulation risk, but market participants will want to see how widely these design changes are adopted and how quickly they translate into cleaner spot-market behavior.

South Korea has unveiled plans for a new law that will bring cryptocurrencies and other digital assets into the country’s state asset management framework, expanding rules that have remained largely unchanged for more than seven decades.

South Korea’s Ministry of Economy and Finance said during a July 15 policy briefing at the President’s Blue House that it will introduce the National Asset Basic Act, replacing an approach built around the existing State Property Act enacted in 1950.

The ministry said the current law was designed for an economy where government assets were largely limited to real estate. The proposed framework will instead cover newer categories, including intellectual property and virtual assets, while introducing specialized management and development standards for different types of state-owned assets.

Under the proposal, authorities plan to move away from treating public assets mainly as property to preserve, sell, or develop. Instead, the ministry said the new framework will focus on creating more value from government-owned assets through modern management practices.

Crypto legislation remains part of wider blockchain strategy

The latest proposal follows another digital asset policy update released earlier this week. After Monday’s State Council meeting, the Ministry of Economy and Finance confirmed that blockchain development will remain part of South Korea’s economic growth strategy for the second half of 2026, even as artificial intelligence receives a larger share of government investment.

As part of that roadmap, the ministry said it will continue work on the Digital Asset Basic Act, legislation intended to establish rules for the country’s digital asset industry, including business conduct standards and a legal framework for Korean won-pegged stablecoins. Authorities also said they plan to create legal foundations for cross-border stablecoin transactions and support amendments that would allow spot cryptocurrency exchange-traded funds.

Plans for blockchain infrastructure also continue to expand. The ministry previously announced that a pilot program linking tokenized government bonds with an institutional central bank digital currency project will begin in 2027, while the Bank of Korea will study how its CBDC can interact with other blockchain networks.

At the provincial level, Gyeonggi Province is preparing to launch an eight-month blockchain stablecoin pilot in August. 

According to blockchain media outlet NexBlock, blockchain security company ZKrypto will lead the trial, which will test stablecoin issuance, circulation, settlement, fraud prevention, privacy protections, and public benefit payments through February 2027. The system will use zero-knowledge proofs to prevent double-spending and proof-of-reserves technology to verify backing assets throughout the pilot.