The UK’s National Crime Agency (NCA) and the Metropolitan Police’s City of London Police have announced prison sentences for two men tied to the “Scattered Spider” cybercrime group. Both defendants entered guilty pleas at their first court appearance and were later sentenced at Woolwich Crown Court.

According to an NCA press release, the men pleaded guilty on June 22 and were sentenced on Thursday to a combined term of five years and six months in prison. Authorities said the case underscores how ransomware operators increasingly use cryptocurrency to monetize intrusions and extort victims.

Key takeaways

• The NCA and City of London Police say two Scattered Spider affiliates received five years and six months for hacking-related offenses.
• UK investigators linked the group to ransomware and cryptocurrency extortion activity affecting companies in both the UK and the US.
• US prosecutors previously associated Scattered Spider with large-scale crypto ransom collection, including at least $115 million from US companies.
• The group has also been tied to major incidents such as a public transport intrusion in London and separate claims involving Caesars Entertainment.

UK sentencing in the Scattered Spider case

The NCA said the two men were convicted in connection with cybercriminal activity associated with Scattered Spider, a group investigators have linked to ransomware and extortion schemes that use cryptocurrency payments.

In the court process described in the NCA update, both defendants pleaded guilty at their first appearance on June 22. The sentencing then took place on Thursday at Woolwich Crown Court, as reported in the NCA’s release.

For crypto-focused observers, the significance is less about the jail terms alone and more about how law enforcement continues to connect real-world extortion campaigns to digital asset flows—an area where blockchain analytics and custody investigations often determine whether perpetrators can be financially disrupted.

London transport network intrusion and reported losses

British authorities said the Scattered Spider group was involved in the infiltration of London’s public transport network in September 2024. The incident was reported to have resulted in losses and recovery costs of about £29 million (roughly $38.9 million).

While the sentencing announcement is specific to the two defendants, the underlying allegations tie back to a broader campaign pattern: gaining access to high-value targets, disrupting operations, and demanding payments—often in cryptocurrency—under time-sensitive pressure.

Investors and builders watching these cases generally look for a clear signal on enforcement priorities: when high-profile systems are targeted, governments typically respond with both criminal prosecution and efforts to trace and seize assets connected to extortion.

US DOJ links: crypto extortion at large scale

In a separate Department of Justice statement from September, US prosecutors said Scattered Spider was tied to collecting $115 million in cryptocurrency ransom payments from at least 47 US companies. That same DOJ release also described broader disruptions attributed to the group, including attacks impacting critical infrastructure and the federal court system.

The scale described by the DOJ matters because it suggests Scattered Spider is not a one-off operation. Instead, prosecutors portrayed it as a campaign capable of repeatedly compromising organizations and converting the resulting leverage into crypto-linked revenue.

The DOJ statement also described a broader investigation into the group’s activities, including repeated network intrusions. In such cases, sentencing outcomes in one jurisdiction can be interpreted as pieces of a larger enforcement strategy, where cases in the UK and US collectively strengthen the evidentiary record around the same actors and methods.

FBI seizure and earlier crypto ransom allegations

According to the DOJ’s September release, the FBI seized approximately $36 million worth of cryptocurrency from wallets linked to Scattered Spider in July 2024. Prosecutors said investigators traced and seized digital assets allegedly controlled by members of the group as part of the wider case.

US prosecutors further said Scattered Spider was accused of breaching Caesars Entertainment and stealing a large customer database in September 2023. Prosecutors said Caesars ultimately paid a $15 million ransom in Bitcoin (BTC). That earlier allegation fits the same overall pattern of using crypto as the payments mechanism for extortion demands.

The combination of wallet-linked seizures and later courtroom sentences highlights the practical leverage of crypto intelligence for law enforcement: tracking transfers and correlating wallet activity with criminal conduct can support both asset recovery and prosecution.

In the DOJ’s account, investigators said the group was responsible for at least 120 computer network intrusions. The NCA sentencing announcement does not enumerate those numbers, but it aligns with the DOJ’s broader framing of an expanding threat. For victims and compliance teams, the message is consistent: crypto-enabled ransomware operations continue to attract coordinated international responses, even when the extortion attempts cross borders.

“These malicious attacks caused widespread disruption to US businesses and organizations, including critical infrastructure and the federal court system, highlighting the significant and growing threat posed by brazen cybercriminals,” said Matthew Galeotti, then acting assistant attorney general of the Justice Department’s Criminal Division.

What to watch next

With Scattered Spider affiliates now facing prison time in the UK and prosecutors having described large crypto-related seizures and ransom totals in the US, the next key question is whether additional defendants—along with more wallet-linked assets—will be identified and targeted across jurisdictions. For companies and crypto traders alike, continued enforcement can meaningfully shape how ransomware groups attempt to move funds and how quickly investigators can disrupt those flows.

Tokenized real-world assets (RWAs) account for just $12.66 million in active market capitalization despite the recent spike in trading activity.

Much of that larger activity, instead, came from memecoin traders piling into a new token, CASHCAT, named after Robinhood’s former company mascot. The token rallied by more than 2,100% in its first week, briefly reaching a $156 million market cap, which is 12 times larger than the chain’s entire tokenized real-world asset market.

It’s worth noting, though, that memecoins are volatile and hype-driven by nature, often lacking durable growth. That lack of sustainability was evident on Wednesday, when Noxa, the token launcher that spawned CashCat, announced it had stopped operating while directing all revenue to creators. The shutdown does not determine the fate of Robinhood Chain, but it underscores how quickly activity built around memecoin launches can disappear.

Ironically, Robinhood CEO Vlad Tenev told CNBC on July 2 that memecoins were a dead end – assets with no utility that serve no purpose. Six days later, he posted that Robinhood Chain “works great for memes too,” presumably after seeing CASHCAT’s success.

Asked about the apparent contradiction, the company did not directly address it. “The early activity on Robinhood Chain is exciting: developers are building, users are engaging, and the chain is performing as designed,” Lee said.

Bitcoin slipped below $62,500 at the Wall Street open on Friday, extending a fresh dose of volatility as risk sentiment deteriorated. The move came as US markets reacted to renewed tensions tied to the US–Iran war, pulling down equities and—by extension—crypto.

Traders described BTC’s behavior as “very choppy,” with buyers and sellers repeatedly failing to establish direction after earlier strength. On the technical side, analysts flagged that Bitcoin’s long-running downtrend may be nearing an important phase, after the asset flipped a key long-term moving average into resistance.

Key takeaways

• BTC fell under $62,500 during the US open as US stocks turned lower amid escalated US–Iran headlines.
• Trading data referenced from TradingView indicated up to about 2% downside on the day for BTC/USD.
• Market participants say BTC is repeating prior patterns: local highs are being rejected, and price remains rangebound.
• Analysts including Rekt Capital pointed to Bitcoin flipping its 50-month EMA to resistance, which historically has preceded a move toward a long-term floor.

BTC weakens as equities take another hit

According to TradingView data cited in the report, BTC/USD extended losses into the session, with the move described as reaching as much as roughly 2% downside on the day. The timing aligned with a broad risk-off turn in US markets.

At the time of writing, US stocks had opened in the red, and the Nasdaq Composite was down nearly 2%. Fresh military strikes on Iran were highlighted as a catalyst behind the retreat in risk assets, with tech shares continuing to face selling pressure.

Additional pressure came from company-specific news. The Kobeissi Letter flagged weakness tied to earnings disappointments, noting that Netflix was down more than 10% at the start of the US session and citing a longer-view performance mark: the stock is down about 50% over the last 12 months and trading at its lowest level since August 2024, as stated in the outlet’s X post.

After three-week highs, traders face a familiar rhythm

Bitcoin’s decline followed a rebound period in which the asset had tapped three-week highs. After that push, traders reportedly saw “copycat” selling as the market returned to the same range conditions.

One market commentator, Exitpump, suggested on X that the pattern was repeating: a “dump into passive demand,” increased open interest with shorts building while spot buying begins to reappear—an imbalance that often produces sharp bounces rather than smooth trending.

Another trader, Daan Crypto Trades, characterized the broader tape as seasonal and directionless, describing recent weeks as “very choppy,” with alternating runs up and down and limited follow-through. That view fits with the overall picture of rangebound trading: peaks get sold, support gets tested, and the market appears to oscillate rather than commit to a new trend.

Bear-market “milestones” and the 50-month EMA flip

Beyond short-term price action, attention in the crypto market has also remained focused on the longer-term shape of Bitcoin’s bear-market cycle. Analyst Rekt Capital argued that Bitcoin has moved closer to a key technical milestone by flipping the 50-month exponential moving average (EMA) to resistance.

Rekt Capital said that BTC/USD’s interaction with the 50-month EMA is repeating bear-market history and that this change sets up the next phase of the decline toward a long-term floor. In his X update, he wrote that “the necessary technical milestone has been achieved,” adding that the milestone “technically indicates that the majority of the anticipated move has already happened.”

While such signals are often discussed as evidence that the market is maturing through the bear phase, they also leave plenty of uncertainty for traders. Even if the downtrend is in a late stage, timing can still be volatile—especially when external drivers such as macro headlines and geopolitical developments repeatedly shift risk appetite.

What to watch next for traders and investors

With BTC currently trading in a highly reactive environment—tied to equity sentiment while also reflecting recurring technical behavior—readers should watch how quickly support near recent range lows holds or breaks, and whether BTC’s resistance reactions around major longer-term levels persist. The next swing will likely be shaped as much by risk sentiment as by BTC-specific technical conditions.

SBI Holdings has acquired a majority stake in Coinhako after securing regulatory approval for the Singapore crypto exchange deal on July 16.

According to SBI Holdings, the transaction involved a capital injection through SBI Ventures Asset Pte. Ltd. and the purchase of shares from Coinhako’s existing investors. Coinhako will now operate as a consolidated subsidiary of the Japanese financial group.

Approval from the Monetary Authority of Singapore allowed the deal to close on July 16. SBI did not disclose the size of the investment, the percentage of shares acquired, or Coinhako’s valuation under the transaction.

Established in 2014, Coinhako is operated by Hako Technology Pte. Ltd. and holds a Major Payment Institution licence from MAS. Its affiliate, Alpha Hako Ltd., is registered as a virtual asset service provider with the British Virgin Islands Financial Services Commission.

Coinhako gives SBI a regulated Singapore base

Through the acquisition, SBI plans to combine Coinhako’s customers, regional network and crypto operations with the Japanese group’s financial products and international reach. The company identified Singapore as a key market because of its established digital asset regulations and position within Southeast Asia.

SBI Chairman and President Yoshitaka Kitao described the purchase as part of the group’s plan to connect exchanges across multiple countries. According to Kitao, such a network could let investors trade without being limited by national borders or currency differences.

Coinhako’s local presence and regulatory status were central to the decision, Kitao added. SBI expects the exchange to support new services involving stablecoins, tokenized assets, cross-border trading and on-chain finance between Japan and Southeast Asia.

For Coinhako, joining SBI provides access to a financial group with operations across banking, securities and digital assets. Commenting on the acquisition, Coinhako co-founder and CEO Yusho Liu described the deal as the company’s next stage after a decade of operating in Singapore.

“Joining the SBI Group is a natural step for Coinhako to move to the next stage of growth.”

Tokenized assets deepen SBI’s regional strategy

Alongside the Coinhako purchase, SBI has been developing a yen-backed stablecoin called JPYSC with blockchain company Startale. SBI plans to explore its use within the combined group, including possible links to Coinhako’s services and regional customer network.

As previously reported by crypto.news, SBI has also partnered with Ondo Finance to bring tokenized financial products into its ecosystem. Under the agreement, the companies plan to use JPYSC for settlement and collateral while connecting Japanese securities with overseas tokenized markets.

Ondo’s products are expected to reach investors through SBI’s customer network, according to the companies. The partnership also gives SBI another route for using its stablecoin beyond conventional transfers, including transactions involving tokenized securities.

One day before the Coinhako deal closed, SBI Global Asset Management launched the SBI Japan High Dividend Equity Strategy Token, or JX token, with regulated real-world asset exchange DigiFT. Issued on Solana, the product gives accredited and institutional investors blockchain-based exposure to a Japanese high-dividend equity strategy managed by SBI Asset Management Co.

Taken together, SBI’s announcements show how the group is assembling regulated exchanges, tokenized investment products and stablecoin infrastructure across Asia. Coinhako adds a licensed Singapore distribution point to that network, while the Ondo and DigiFT agreements provide financial products that SBI could connect to it.

Morgan Stanley has completed the rollout of Bitcoin, Ethereum, and Solana trading on E*TRADE, charging eligible clients a 0.50% fee on each transaction.

E*TRADE announced in a press release that supported customers can now buy, sell and hold the three digital assets directly through its brokerage platform. Zerohash provides the underlying crypto infrastructure and holds the assets in linked customer accounts.

Each transaction carries a 50-basis-point fee, according to E*TRADE. While the current service covers trading and custody, the brokerage expects to introduce crypto transfers later this year, allowing clients to move supported assets into and out of their accounts.

Following a pilot launched in May, the completed rollout makes the service available to all eligible E*TRADE customers. Morgan Stanley had first disclosed plans to add direct spot crypto trading in 2025.

Morgan Stanley is expanding several crypto services at once

E*TRADE’s launch comes as Morgan Stanley prepares to add two exchange-traded funds tied to Ethereum and Solana. As previously reported by crypto.news, amended S-1 filings for both products indicated that their launches were approaching, although the filings did not provide a confirmed trading date.

Earlier this year, Morgan Stanley also launched a spot Bitcoin ETF, becoming the first bank to offer such a product, according to the original report. SoSoValue data showed that the fund had accumulated $384 million in net assets at the time of reporting.

Direct trading gives E*TRADE customers another route to crypto exposure alongside Morgan Stanley’s investment funds. Unlike ETF shares, the new service allows eligible users to hold the underlying Bitcoin, Ether and Solana through Zerohash, while the planned transfer feature would give customers more control over moving those assets.

Morgan Stanley had also increased its tracked Bitcoin balance by nearly 1,000 BTC over the two weeks preceding July 11, according to a crypto.news report published that day. The purchases lifted its reported holdings above 5,700 BTC at the time.

Digital Trust is set to take over the crypto service

Later this year, E*TRADE expects to move the crypto offering from Zerohash to Morgan Stanley Digital Trust, the group’s planned national trust bank. The brokerage linked that transition to the introduction of transfer services but did not provide a specific launch date.

Morgan Stanley applied to the Office of the Comptroller of the Currency earlier this year for a crypto-focused national trust bank charter. Its application placed the firm alongside Coinbase, Crypto.com and Ripple, while the OCC has already granted Ripple conditional approval.

Circle has also received OCC approval to establish a national trust bank focused on digital assets. The USDC issuer had secured conditional approval in 2025 alongside BitGo, Fidelity and Paxos.

Morgan Stanley Wealth Management added another crypto route in June through a referral agreement with Galaxy Digital. Under the arrangement, eligible high-net-worth clients can lend Bitcoin, Ether and Solana to Galaxy and receive shares in spot crypto investment products, including the Morgan Stanley Bitcoin Trust.

Taken together, the ETRADE rollout, pending ETF launches and Digital Trust application place trading, investment products, lending referrals and custody infrastructure within Morgan Stanley’s disclosed crypto plans. Each service remains subject to separate eligibility rules, fees and regulatory arrangements set by the companies involved.

Bitcoin (BTC) dipped below $62,500 at Friday’s Wall Street open as stocks took a fresh hit from the US-Iran war.

Key points:

• Bitcoin gives traders a sense of deja-vu as local highs spark rejection and rangebound moves continue.
• The US-Iran war pushes stocks and crypto lower.
• A bear-market trend line is now in place as resistance, copying historical patterns.

BTC price action stays “very choppy”

Data from TradingView showed BTC/USD extending losses with up to 2% daily downside.

BTC/USD one-hour chart. Source: Cointelegraph/TradingView

US stocks opened in the red, with the Nasdaq Composite Index also down nearly 2% at the time of writing. Fresh military strikes on Iran fueled the risk-asset retreat, while tech stocks continued to see selling pressure.

Trading resource The Kobeissi Letter also flagged weakness arising from earnings disappointments, with Netflix shedding over 10% to start the US session.

“The stock is now down -50% over the last 12 months and trading at its lowest level since August 2024,” it noted in a post on X.

Netflix stock one-day chart. Source: Cointelegraph/TradingView

After hitting three-week highs, BTC price action fell back into its established range as traders saw copycat moves.

“Market just keeps repeating same things,” commentator Exitpump wrote on X. 

“Dump into passive demand, OI increases with shorts piling up while spot starts buying which leads to bounce.”

BTC/USDT five-minute chart with order-book data. Source: Exitpump/X

Trader Daan Crypto Trades argued that current behavior was “typical” of summer.

“Very choppy few days up, few days down kind of price action the last few weeks. No real action anywhere really,” he summarized.

BTC/USD four-hour chart. Source: Daan Crypto Trades/X

Bitcoin seals key bear-market repeat

Trader Jelle, meanwhile, remained optimistic, seeing range lows holding.

Related: Bitcoin bottom countdown nears 50 days after BTC supply in loss passed 50%

“Still think this looks good for a relief rally in the next weeks – which would give the market room to drop into October without nuking much deeper,” he told X followers.

BTC/USD one-day chart. Source: Jelle/X

In updates on the bear market’s progress, trader and analyst Rekt Capital suggested that Bitcoin’s long-term downtrend was now in its final stages.

BTC/USD, he wrote, had flipped its 50-month exponential moving average (EMA) to resistance, repeating bear-market history to set up its drop to a long-term floor.

“The necessary technical milestone has been achieved,” he confirmed. 

“Which technically indicates that the majority of the anticipated move has already happened.”

BTC/USD one-month chart with 21, 50EMA. Source: Rekt Capital/X

As Cointelegraph reported, Rekt Capital saw the July relief bounce ending with the onset of next month.