Unsealed US court records released this week indicate a federal judge has allowed crypto exchange Bybit to move quickly in its bid to track and recover funds tied to the $1.5 billion North Korea-linked attack that hit the platform in February 2025. The order grants Bybit expedited discovery, a procedural step that can help the exchange identify alleged intermediaries and pursue a limited portion of stolen assets that remain capable of being traced.

According to the docket on CourtListener, Bybit filed its lawsuit under seal on June 18 against North Korea, the Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants. The court granted the request for expedited discovery the following day, June 19—an early authorization that signals the court’s willingness to support time-sensitive efforts to obtain transactional and account information relevant to the case.

Key takeaways

• Bybit secured expedited discovery in a US case targeting parties allegedly involved in the February 2025 North Korea-linked $1.5 billion hack.
• The exchange argues that only a minority of stolen funds remains traceable, with 9.8% identified as linked to identifiable wallets as of the June 18 filing.
• A temporary restraining order was obtained on June 19, renewed on July 16, and partially backed by a preliminary injunction on July 30.
• Bybit’s complaint seeks recovery of approximately $1.5 billion, including compensatory, punitive, and treble damages under US RICO law.
• The share of traceable funds reported by Bybit has fallen significantly versus a prior estimate cited by its CEO over a year earlier.

Expedited discovery aims to narrow the recovery path

Expedited discovery changes the practical timeline for Bybit’s legal strategy. In a standard civil case, parties often wait longer for evidence requests and responses. Here, the court’s decision effectively gives Bybit a faster route to request information that can help determine who may be holding, routing, or facilitating portions of stolen crypto.

The records indicate Bybit’s complaint asserts that some of the assets it claims were stolen were routed to exchanges and other services that operate in, or maintain infrastructure in, the United States. Bybit’s filings sought account-holder identities, balances, and transaction histories from relevant platforms—information the company argued would be available after receiving a court order.

For investors and market participants watching post-incident enforcement, this matters because stolen-fund recoveries in crypto often depend on how quickly claimants can obtain counterparty data before assets shift again. A court-backed discovery window can also clarify whether intermediaries are identifiable enough to support targeted lawsuits or enforcement.

Bybit cites a steep drop in traceable funds

Beyond procedure, the court documents also provide a snapshot of how much of the alleged theft Bybit believes remains linkable. In its June 18 filing, Bybit stated that 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges, and over-the-counter dealers.

That leaves 9.8% traced to identifiable wallets, including 5.3% of the total (about $75.5 million) that Bybit said had been frozen or recovered. The company also appears to be positioning these traceable portions as the realistic starting point for an asset-recovery effort—rather than expecting a full return of the entire sum through a judgment against North Korea alone.

The exchange’s figures also reflect a notable change from earlier in the case. The records reference remarks by Bybit CEO Ben Zhou more than a year earlier, stating that 68.57% of the funds remained traceable at the time. If those earlier estimates are taken at face value, the current accounting suggests a major degradation in traceability over time—consistent with how attackers and intermediaries may move value across services designed to obscure origin.

Restraining order and partial injunction support preservation of assets

Court filings also show that Bybit obtained a temporary restraining order on June 19 aimed at stopping the unidentified defendants from transferring certain traceable assets. The court renewed that order on July 16 and partially granted Bybit’s request for a preliminary injunction on July 30.

While the documents indicate the court is actively managing the case to preserve at least some assets, some exhibits and other materials remain sealed. That confidentiality limits what outside observers can confirm about the precise scope of the relief, but the procedural milestones themselves underscore that Bybit’s claims are progressing through the federal court system rather than remaining purely theoretical.

Background: the 2025 hack and attribution

The alleged theft dates back to Feb. 21, 2025. According to earlier reporting referenced in the court-linked account, attackers compromised Safe Wallet’s infrastructure after obtaining access through compromised credentials tied to a Safe developer, allowing malicious code to be injected into its cloud environment.

For its attribution, the FBI published a public notice on Feb. 26, 2025 stating that the theft was carried out in connection with North Korea. That attribution is important context for the lawsuit because it frames the alleged threat actor behind the event, even as the civil claims focus on specific defendants and mechanisms to recover assets.

In its lawsuit, Bybit is seeking return of stolen assets estimated at approximately $1.5 billion, along with compensatory damages, punitive damages, and treble damages under the US Racketeer Influenced and Corrupt Organizations Act. The inclusion of RICO indicates Bybit is pursuing broader claims beyond a single breach—attempting to fit the alleged behavior into a pattern of racketeering-type conduct recognized under US law.

As court records show, Bybit’s current push is not just about winning a judgment, but about securing the evidence and preservation measures needed to make recovery feasible in practice. With most of the claimed funds allegedly rendered untraceable, the value of expedited discovery and early injunctive relief is likely to be judged by whether Bybit can identify counterparties while the remaining traceable portion is still reachable.

Going forward, readers should watch what information the expedited discovery process yields and whether the preliminary injunction’s partial scope expands as the court reviews more sealed exhibits—especially as Bybit’s own accounting suggests traceability has fallen sharply since earlier estimates.

A Jersey-law custody structure lets xStocks holders instruct real shareholder votes through an on-chain mechanism, closing a governance gap the tokenized equity industry has discussed for years but never shipped.

When Kraken listed xStocks on June 30, 2025, the launch documentation was unusually candid about what the tokens did not do. Traders could not vote in shareholder meetings. Dividends were absent. The tokens were described as instruments for capturing price exposure, best suited to high-growth names like Nvidia and Tesla that paid no dividends anyway. Kraken had brought tokenized equity to retail holders across more than 110 countries. It had not brought the full substance of equity ownership.

That distinction mattered less when xStocks was a new product with $2 billion in cumulative volume and 24,000 holders. It matters considerably more now that the platform has processed more than $30 billion in total transaction volume, settled over $6 billion on-chain, and attracted 125,000 unique holders across more than 110 countries. At that scale, the absence of governance rights is not a footnote in the terms of service. It is a ceiling on what kind of investor the product can reach and what kind of asset the token can legitimately claim to be.

The governance pass-through that Kraken has built into the xStocks framework is a direct response to that ceiling.

What changed and when

The change arrived not as a major product announcement but as an update to the contractual terms governing Backed Assets (JE) Limited’s custody arrangement. Backed Assets is the Jersey-incorporated private limited company that issues xStocks tokens and holds the underlying shares in custody. When those terms were updated to include a binding obligation to follow token holder voting instructions, the governance right was created in the most durable way available to an offshore product: contractual obligation under Jersey law.

The mechanism works as follows. For each company held within the xStocks universe, Backed Assets receives proxy materials ahead of the relevant annual general meeting or extraordinary general meeting. Token holders who hold eligible xStocks on the record date can submit voting instructions through their Kraken account. Those instructions are aggregated and recorded on the Ink blockchain, Kraken’s own Ethereum Layer 2 network. The aggregated result is transmitted to Backed Assets as a contractual instruction. Backed Assets then votes the underlying shares it holds at the relevant meeting according to those instructions.

The on-chain recording of each individual instruction creates a public, immutable audit trail. The timestamp, wallet address, and direction of each vote are verifiable by any party with access to the Ink chain. This transparency is notably stronger than the internal vote aggregation systems used by most traditional brokerages, where the process of collecting and tallying beneficial owner instructions is handled in proprietary databases that regulators have historically found opaque.

The custody chain that makes it work

To understand why this mechanism is legally possible, it is necessary to trace the chain of ownership. Backed Assets purchases the underlying U.S.-listed shares through a regulated brokerage arrangement. Those shares are held at a central securities depository, with Backed Assets or its broker as the beneficial owner. Backed Assets then issues xStocks tokens, each representing a one-to-one claim against the corresponding share held in custody. Those tokens reach end users through Kraken and other members of the xStocks Alliance network.

For voting purposes, the chain runs in the opposite direction. A company like Apple or Nvidia sends its annual meeting notice to the registered holder of record. Under the U.S. street-name system, that registered holder is typically a nominee linked to the Depository Trust and Clearing Corporation, which is obligated to pass voting rights upward to the beneficial owner, which in this case is Backed Assets or its broker. Backed Assets, now contractually bound by its updated custody terms, collects instructions from token holders before casting those votes on their behalf.

The mechanism is coherent within its own architecture because Backed Assets is the actual beneficial owner of the underlying shares. The voting rights that flow to it through the DTCC nominee system are genuine shareholder rights, not synthetic representations of them. What Backed Assets has added is a contractual sub-delegation: the decision about how to exercise those rights now flows downward to the token holders who bear the economic exposure.

Why the legal gap existed in the first place

Tokenized equity in its current form inherits a structural problem that predates blockchain by decades. U.S. corporate law vests voting rights in the shareholder of record. When brokers began holding shares in street name in the 1970s to make settlement more efficient, the SEC introduced Regulation 14A, which requires companies to distribute proxy materials to beneficial owners and requires brokers to pass voting instructions from beneficial owners up the chain.

Offshore tokenized equity disrupts this chain at a new point. The custodian holding the underlying shares is incorporated in Jersey and operates under a Bermuda digital asset license. The tokens it issues are not registered under the U.S. Securities Act of 1933. The token holders are primarily non-U.S. persons in jurisdictions where no domestic equivalent of Regulation 14A compels a pass-through.

In this environment, the path taken by every prior tokenized equity product was to exclude governance rights entirely. The original xStocks launch followed that path. Binance’s BSTOCKS, which launched and was discontinued in 2021, gave holders no voting rights. Robinhood’s EU tokenized stocks, issued under a MiFID II-compliant prospectus, track price returns but exclude all governance attributes. Mirror Protocol’s synthetic equity tokens on Terra never purported to convey any rights against underlying issuers.

That exclusion was a deliberate legal choice, driven by the complexity of building a compliant cross-border governance pass-through, the liability exposure if the mechanism failed, and the absence of any regulatory framework specifically authorizing a blockchain-based voting instruction as a valid proxy submission.

Jersey law and why it matters

The reason xStocks can offer what prior products did not is the specific legal properties of the Backed Assets custody structure under Jersey law. Jersey is a Crown dependency with a body of company and trust law designed to support complex cross-border custodial arrangements.

Under the Companies (Jersey) Law 1991 and the Trusts (Jersey) Law 1984, it is possible to create enforceable beneficiary instruction rights within a custodial arrangement without those rights constituting a separate class of securities under Jersey financial services law. The xStocks token is not, under Jersey law, a security in the sense that would trigger the Jersey Financial Services Commission’s registration requirements. It is a contractual instrument that carries specified economic and governance rights against Backed Assets (JE) Limited.

This legal classification is the key to why the mechanism works. If voting rights were framed as a securities attribute requiring SEC recognition, the structure would need to engage with Regulation 14A and U.S. broker-dealer registration, which Backed Assets and Payward Digital Solutions Ltd. cannot satisfy because xStocks are explicitly not offered to U.S. persons. By classifying the voting right as a contractual beneficiary instruction right under Jersey law, Kraken has built a mechanism that is legally coherent within its own jurisdiction and requires no external regulator to authorize it.

The on-chain aggregation layer adds a transparency element that actually exceeds what most regulated proxy plumbing provides. Every instruction is timestamped, publicly verifiable, and permanent. Traditional brokerages aggregate votes in proprietary internal systems; the xStocks mechanism makes the aggregation auditable by anyone.

What the rest of the industry has done instead

The contrast with competitor approaches shows how narrow the viable design space for this feature is. The main alternatives to the xStocks contractual custody pass-through are economic-only tokens, synthetic equity derivatives, and fully registered security tokens.

Economic-only tokens, which describes Robinhood’s current EU offering, deliver price exposure and in some structures dividend equivalents, but explicitly exclude governance. This is the lowest-complexity option from a legal standpoint, but it is also the design that most directly prevents the product from appealing to institutional allocators with stewardship obligations written into their mandates.

Synthetic equity derivatives, used by venues offering perpetual futures on equity names, have no connection to an underlying share held anywhere. A synthetic position tracking Apple’s price has no relationship to Apple Inc. as a legal entity and cannot convey governance rights because there is nothing to vote. Kraken itself offers xStocks perpetual futures through its xChange execution layer alongside the spot token, but the voting pass-through applies only to the spot token, not to the derivative.

Fully registered security tokens, the model pursued by platforms including Securitize, do attempt to convey the complete bundle of shareholder rights through a digital token. But registration under a major securities regime constrains distribution to accredited or qualified investors and involves ongoing compliance costs that make retail-scale distribution difficult. No fully registered security token product has reached anywhere near xStocks’ holder count or volume trajectory.

Regulatory implications for a U.S. expansion

The mechanism works precisely because xStocks are not offered to U.S. persons. The SEC’s jurisdiction over proxy solicitation under Regulation 14A extends to any solicitation that reaches U.S. shareholders. If the xStocks voting instruction process were offered to U.S. persons, it could be characterized as a proxy solicitation subject to that regulation, requiring specific disclosures, a structured proxy statement, and filing with the SEC.

The SEC’s enforcement posture in the digital asset sector raises a further structural concern. The agency has progressively argued that blockchain-based mechanisms that convey economic returns or governance rights can constitute investment contracts under the Howey test. A token that carries a real vote at a real company’s annual meeting begins to resemble equity in that company. If that token were offered to U.S. persons, the agency could pursue classification as a security requiring registration under Section 12 of the Securities Exchange Act of 1934.

Payward Digital Solutions Ltd., the Bermuda-licensed entity through which xStocks are offered, holds a Digital Asset Business license from the Bermuda Monetary Authority. The BMA’s framework accommodates structured instruments without treating every contractual right as a separately regulated security, which is the environment in which the pass-through can function without regulatory intervention.

U.S. state law adds further complexity for any future expansion. Blue sky statutes in states including California and New York define “security” broadly enough to potentially capture a contractual instrument carrying voting rights even if the federal analysis were resolved favorably. Any U.S. launch would require state-by-state review alongside the federal analysis.

What this means for institutional capital

Governance rights have been cited explicitly by institutional asset managers as a structural barrier to including tokenized equities in professionally managed portfolios. Large managers with fiduciary duties under ERISA or equivalent regimes are generally required to exercise voting rights on behalf of beneficiaries. A product that strips out voting is, for those managers, a compliant substitute for direct share ownership only if the investment mandate specifically permits it.

Passive index-tracking funds face this most acutely. Because they cannot exit positions that fall out of mandate, proxy voting is the primary lever through which passive managers influence corporate behavior. A tokenized equity product that gives those managers no governance capability is structurally incomplete.

The xStocks EU expansion, which opened the product to a major institutional market that had previously been excluded at launch, was one step toward a product that institutional allocators could consider. The governance pass-through is a second, arguably larger, step. Accounting treatment under IFRS and U.S. GAAP, custodial risk, and the absence of SEC regulatory recognition remain open questions for any institutional allocator subject to those frameworks. But governance capability removes what many allocators have described as the most immediately obvious structural gap between xStocks and a traditional equity holding.

The limits of the fix

The Jersey contractual pass-through is functional within its own framework, but it carries limits that any holder or allocator should weigh before treating it as equivalent to direct share ownership.

The voting right is a contractual right against Backed Assets, not a corporate law right against the underlying company. If Backed Assets entered insolvency or failed to fulfill its contractual obligation to follow voting instructions, a token holder’s remedy would be through Jersey courts under Jersey contract law, not through the shareholder remedies available in U.S. courts, which include appraisal rights, derivative suits, and direct actions against directors.

The mechanism also depends on the one-to-one share backing being maintained at all times. If outstanding token supply were ever to exceed the underlying share holding at any moment, not all voting instructions could be transmitted. The one-to-one requirement is designed to prevent this, and Backed Assets publishes proof-of-reserve data to support it, but real-time on-chain verification available to individual token holders is not yet in place.

The practical weight of individual votes also depends on concentration. For a company like Apple or Nvidia, even a substantial xStocks position represents a small fraction of total outstanding shares. The pass-through gives token holders a real vote. Whether that vote is consequential depends on how large the xStocks holder base grows relative to total outstanding share counts for each underlying company.

What to watch

Total xStocks on-chain settled volume crossing $10 billion: This level would signal institutional liquidity depth sufficient to attract allocators with minimum position size requirements, and would make the governance mechanism relevant to funds that currently cannot meet internal liquidity standards for tokenized equity.

SEC comment or formal no-action guidance on offshore tokenized equity voting: Any written SEC position on whether the xStocks mechanism constitutes a Regulation 14A proxy solicitation would clarify the pathway for a U.S. expansion and signal how the agency plans to treat voting-enabled tokenized equity more broadly.

A competing platform announcing a comparable voting pass-through: If Robinhood, eToro, or another major tokenized equity venue announces a governance pass-through mechanism, it would indicate that the contractual custody model is becoming the industry standard rather than a single-platform feature.

Backed Assets publishing real-time proof-of-reserve for voting record dates: On-chain verification that underlying share counts match outstanding token supply at each record date would remove the remaining trust dependency from the governance mechanism, allowing institutional allocators to rely on it without a separate audit engagement.

First AGM where xStocks instructions exceed 0.1 percent of total votes cast: This threshold would mark the first moment xStocks holders have had a measurable effect on a real governance outcome, transforming the pass-through from a legal feature into a market-relevant force.

Disclaimer: This article is published for informational purposes only and does not constitute investment, legal, or financial advice. xStocks tokens are not offered to U.S. persons or persons in restricted jurisdictions. Past performance of tokenized equity products does not predict future results. Published August 6, 2026.

OKX has scheduled the removal of six GODS, PRCL and DUCK spot trading pairs while suspending deposits for the affected tokens from Aug. 7 and setting Nov. 7 as the withdrawal deadline.

According to an OKX announcement, the exchange will remove three margin-settled spot pairs GODS/USD, PRCL/USD, and DUCK/USD, between 16:00 and 18:00 UTC on Aug. 14. Three additional spot pairs quoted in USDT and EUR will follow three days later, with GODS/USDT, PRCL/USDT and DUCK/USDT scheduled for delisting during the same two-hour window on Aug. 17.

The exchange has also introduced a phased timeline for the affected assets. Deposits for GODS, PRCL and DUCK stopped at 16:00 UTC on Aug. 7, while withdrawals for the three tokens will remain available until 16:00 UTC on Nov. 7.

OKX has split the trading pair removals across two dates

Rather than removing all markets at once, the exchange has divided the delisting into two stages.

On Aug. 14, users will lose access to GODS/USD, PRCL/USD and DUCK/USD trading pairs. Three days later, OKX will remove GODS/USDT, PRCL/USDT and PRCL/EUR alongside DUCK/USDT, completing the process for all six spot markets listed in the notice.

At the same time, the exchange has already halted deposits for the related assets, preventing users from transferring additional GODS, PRCL or DUCK tokens onto the platform. Withdrawals remain available for another three months before closing in November, giving holders additional time to move their assets elsewhere.

The announcement did not state the reason for removing the trading pairs.

Deposit suspension starts before withdrawal deadline

The published timetable separates trading, deposits and withdrawals into different stages.

Deposit services for the affected cryptocurrencies ended first on Aug. 7. Trading activity will continue until the scheduled delisting windows in mid-August, after which the listed spot pairs will no longer be available.

Withdrawal support, however, will continue until Nov. 7, providing a longer period for customers who still hold the affected tokens after trading ends.

Crypto exchanges commonly separate delisting from withdrawal deadlines, allowing users to transfer assets after markets have been removed. In this case, OKX has provided nearly three months between the end of deposits and the final withdrawal cutoff.

OKX continues operational changes across multiple markets

The latest asset removals come during a period of operational updates across several regions.

Earlier in July, Digital Asset reported that the OKX Android application had returned to South Korea’s Google Play Store after a four-day suspension, making it the first recently restricted overseas crypto exchange to regain access on the platform. The restoration followed Google’s temporary removal of the app, while exchanges such as Bybit remained unavailable in the Korean Play Store.

Digital Asset had previously found that dozens of overseas exchange applications became inaccessible on Google Play as South Korea tightened oversight of overseas virtual asset service providers operating without local registration. 

Although some exchanges had been identified by the country’s Financial Intelligence Unit as unreported VASPs, the publication reported that Google’s restrictions also affected several platforms that were not included on the FIU’s published enforcement list.

Outside South Korea, OKX has continued expanding regulated services in Europe. In July, the exchange launched a one-way USDT-to-USDC conversion service for eligible customers across 30 European Union and European Economic Area countries operating under its Markets in Crypto-Assets license. 

The service allows users to deposit USDT and voluntarily convert their holdings into MiCA-compliant USDC as European exchanges reduce support for Tether’s stablecoin following the regulation’s implementation.

OKX has also expanded its institutional strategy

Operational changes have coincided with new corporate developments at the exchange.

Last month, OKX appointed former New York Governor Andrew Cuomo to its board of directors after he had advised the company on U.S. regulatory and institutional strategy since 2023. According to the company, the appointment formalized an existing relationship as OKX continued expanding its U.S. operations following the relaunch of its U.S. exchange and self-custody wallet in 2025.

The company has also continued working with Intercontinental Exchange through a planned joint venture focused on blockchain-based financial products. According to OKX, Cuomo will remain co-chair of the initiative, which is intended to combine ICE’s market infrastructure with the exchange’s blockchain technology, subject to regulatory approvals.

Bridge has joined the EU’s MiCA register, increasing the number of authorized electronic money token issuers to 42 after securing regulatory approval in Luxembourg.

According to the latest update published by the European Securities and Markets Authority (ESMA) on Wednesday, Bridge Building, the Luxembourg-based entity behind Stripe-owned stablecoin infrastructure company Bridge, has been added to the European Union’s Markets in Crypto-Assets (MiCA) register as an authorized electronic money token (EMT) issuer.

The addition raises the number of MiCA-authorized EMT issuers in the European Union to 42. ESMA’s latest register update also added three new crypto-asset service providers (CASPs) from Germany, bringing the total number of authorized CASPs across the bloc to 324.

Bridge’s inclusion follows regulatory approvals it announced on July 2 after obtaining both a MiCA crypto-asset service provider authorization and an Electronic Money Institution (EMI) license from Luxembourg’s Commission de Surveillance du Secteur Financier (CSSF). At the time, Bridge Head of Product Mai Leduc Blount said the approvals would allow businesses across the European Union to develop stablecoin and payment products under a regulated framework.

Bridge’s MiCA approval expands regulated stablecoin services

Receiving both the CASP authorization and EMI license allows Bridge to provide regulated services throughout all 27 European Union member states under a single regulatory framework instead of requiring separate approvals in each country.

When announcing the approvals in July, the company said businesses using its infrastructure would be able to issue custom euro-backed stablecoins, create named virtual IBANs, and provide euro accounts that work across the European Union. Bridge also said fintech companies could integrate cross-border euro accounts through a single connection, while enterprises could move funds between subsidiaries using stablecoins instead of correspondent banking networks.

Blount said at the time that businesses operating in the European Union could combine euro stablecoin issuance with named IBANs and euro payouts across all member states through one integration.

The approvals came shortly after the European Union completed the final phase of its MiCA transition on July 1, requiring regulated crypto platforms to support only compliant stablecoins. Following the implementation, exchanges including Coinbase, Kraken and Crypto.com removed USDT trading for European users after Tether decided not to seek MiCA authorization, while Binance introduced service changes for customers affected by the new framework.

ESMA register adds new German CASPs

Alongside Bridge’s registration, ESMA added three German institutions to its MiCA register as authorized crypto-asset service providers.

The newly listed firms are Volksbank Die Gestalterbank, VBU Volksbank im Unterland and VR-Bank Erding. Their inclusion increases the number of authorized CASPs in the European Union from 321 to 324.

ESMA’s latest update did not introduce any new asset-referenced token (ART) authorizations, leaving that section of the register without approved issuers. The regulator also made no changes to its list of non-compliant crypto-asset companies.

Recent weeks have seen ESMA publish register updates more frequently as firms continue securing MiCA authorizations following the regulation’s full implementation across the European Union.

Stripe continues building regulated stablecoin infrastructure

Bridge’s registration comes as Stripe continues expanding the stablecoin infrastructure it acquired through its approximately $1.1 billion purchase of Bridge.

Since completing the acquisition, Stripe has integrated Bridge’s technology into its payments business while extending regulated payment services into additional jurisdictions. The company has positioned the infrastructure around stablecoin payments, cross-border settlement and financial services for businesses and developers.

In March, Visa announced an expansion of its partnership with the Stripe-owned company to introduce stablecoin-backed Visa card programs in more than 100 countries by the end of 2026.

The company has also continued building banking relationships and payment infrastructure around Bridge. Connor Fitzgerald, who recently stepped down as Stripe’s head of stablecoin partnerships after helping establish the company’s stablecoin card program, said the team built sponsor bank relationships, payment network connections and regulatory infrastructure before expanding the program internationally.

According to Fitzgerald, the stablecoin card initiative grew from launch to operations in more than 100 markets, introduced what he described as the first stablecoin settlement flow in the United States and increased annualized payment volume from zero to tens of millions of dollars.

Stablecoins remain central to Stripe’s payments strategy

Bridge’s latest regulatory milestone adds to Stripe’s recent activity in blockchain-based payments as the company continues combining regulated infrastructure with its global payments network.

Alongside expanding stablecoin products, Stripe has supported cross-border settlement, card issuance and payment services built on Bridge’s technology. The company has also remained active in traditional payments. Reuters previously reported that Stripe and private equity firm Advent International submitted a proposal worth about $53 billion to acquire PayPal.

According to Reuters, the offer valued PayPal at $60.50 per share and would give Stripe and Advent equal ownership if completed. Reuters also reported that PayPal’s board viewed the proposal as undervaluing the company while weighing financing certainty, regulatory considerations and execution risks, with discussions remaining active.

If completed, the transaction would combine PayPal’s crypto payment products, including the Paxos-issued PYUSD stablecoin, with Stripe’s expanding stablecoin infrastructure developed through Bridge. Reuters also reported that the bidders explored potential structural remedies in the event antitrust regulators require changes to the proposed transaction.

CleanSpark has reported a $239 million quarterly loss as revenue fell 30.5% year over year, while its latest AI data center lease has added a long-term revenue stream outside Bitcoin mining.

According to CleanSpark’s fiscal third-quarter results published on Thursday, the Nasdaq-listed Bitcoin mining company generated $138 million in revenue for the three months ended June 30, down 30.5% from $198 million in the same quarter last year. The figure also came in below Wall Street expectations, with Yahoo Finance analyst estimates placing the consensus forecast at $142.2 million.

For the quarter, the company posted a net loss of $239 million, or $0.89 per basic share, reversing from net income of $257 million, or $0.90 per share, recorded a year earlier.

The earnings release arrived after the company had already reported another loss-making quarter in May. For the fiscal second quarter ended March 31, CleanSpark reported a net loss of $378.3 million on revenue of $136.4 million, compared with a loss of $138.8 million and revenue of $181.7 million in the prior-year period.

CleanSpark revenue has missed analyst estimates

Alongside the decline in revenue, CleanSpark’s quarterly sales narrowly missed analysts’ expectations compiled by Yahoo Finance.

Investors reacted by sending the stock lower. Shares fell 5.5% during Thursday’s trading session before recovering about 3% in pre-market trading on Friday to trade above $13.10, according to Yahoo Finance market data.

The latest earnings follow a similar market reaction after the previous quarterly report. Following the May results, CleanSpark shares dropped more than 10% in pre-market trading after closing the previous session at $14.30. Google Finance data at the time showed the company carried a market capitalization of about $3.66 billion, with shares trading within a 52-week range of $8.00 to $23.61.

AI infrastructure has become part of CleanSpark’s strategy

Even as its Bitcoin mining business has faced weaker financial results, CleanSpark has continued expanding into artificial intelligence and high-performance computing infrastructure.

On July 14, the company signed a 20-year lease for a 175-megawatt data center at its Sandersville, Georgia, campus with an undisclosed investment-grade global technology company. CleanSpark estimated the agreement would generate about $6.6 billion in contracted revenue over the initial lease term.

Development at the Sandersville campus has been underway for several quarters. Earlier this year, the company said it had doubled its contracted megawatts from a year earlier while securing 585 megawatts of ERCOT-approved capacity in Texas to support additional AI and HPC projects.

During the May earnings release, chief executive Matt Schultz said the company planned to commercialize assets suitable for AI and HPC workloads while continuing to operate its Bitcoin mining business efficiently.

Bitcoin holdings have continued growing despite losses

Although quarterly earnings remained under pressure, CleanSpark continued adding Bitcoin to its balance sheet.

During the fiscal second quarter, the company said its Bitcoin holdings increased 14% from a year earlier while average monthly hashrate climbed 18%. It ended that quarter holding $925.2 million worth of Bitcoin alongside $260.3 million in cash.

The company also disclosed that a $224.1 million fair value loss on its Bitcoin holdings accounted for nearly 60% of its total net loss during the March quarter, following weaker Bitcoin prices during the reporting period.

Bitcoin miners have expanded into AI data centers

CleanSpark is not the only publicly traded Bitcoin miner adding AI infrastructure alongside mining operations.

Several companies across the sector have reported similar changes while dealing with earnings pressure tied to digital asset accounting.

MARA, for example, reported a $1.3 billion first-quarter loss after mark-to-market adjustments affected the value of its Bitcoin treasury.

TeraWulf separately reported that revenue from high-performance computing exceeded Bitcoin mining revenue for the first time during the first quarter, illustrating how AI-related infrastructure has become a larger contributor to its business.

Core Scientific has also increased its exposure to colocation services. As previously reported by crypto.news, the company posted a $347.2 million first-quarter loss while reporting a significant increase in colocation revenue as more capacity was allocated to AI infrastructure.

Ethereum price traded near $1,918 on Friday after reclaiming $1,900, as spot ETF inflows and improving short-term momentum supported another test of overhead resistance.

Ethereum price action today

According to data from crypto.news, Ethereum (ETH) price traded at $1,918.26 at the time of writing, up 0.74% during the daily session. The token reached an intraday high of $1,918.88 after opening near $1,904.

The move extended ETH’s recovery from the $1,850 area and kept its weekly gain above 4%. Buyers have repeatedly defended the $1,840–$1,850 region since the start of August, preventing a deeper correction toward the July lows.

Price has now moved above three closely watched daily averages. ETH is trading over its 20-day moving average at $1,895.45, its 100-day average at $1,911.42, and its 50-day average at $1,796.09.

That alignment improves the short-term outlook, but Ethereum remains below its 200-day moving average at $2,061.80. The gap shows that the latest recovery has not yet reversed the broader downtrend that began after ETH traded above $2,400 in April.

The daily Bull Bear Power reading has returned to positive territory at 32.07. The indicator suggests buyers have regained a modest advantage after bearish pressure briefly returned at the beginning of August.

ETF inflows and US jobs data support ETH

Renewed demand for US-listed spot Ethereum exchange-traded funds has provided one catalyst for the move.

The funds recorded about $92.15 million in net inflows on Aug. 6, equal to roughly 48,327 ETH at the reported market price. The latest intake followed net inflows of $60.86 million on Aug. 5, with BlackRock’s ETHA accounting for $50.34 million of that session’s total.

Cumulative net inflows into US spot Ethereum ETFs have now moved above $11.4 billion. The products give US investors regulated ETH exposure through conventional brokerage accounts, although their flows do not always produce an immediate or proportional price response.

A softer US employment reading also helped the wider risk-asset backdrop. Private employers added 44,000 jobs in July, below forecasts of about 70,000 and down from a revised 95,000 in June, according to ADP.

The weaker hiring figure pointed to some cooling in the labor market. However, annual pay still rose 4.4%, and jobless claims remained historically low, leaving uncertainty around the Federal Reserve’s next rate decision. Any renewed increase in rate-hike expectations could weigh on ETH and other risk assets.

Ethereum liquidation map points to $1,950

Ethereum’s 4-hour chart shows price moving above the Supertrend threshold near $1,907.42. Holding that level would preserve the immediate bullish structure and give buyers another opportunity to attack the recent highs.

The 4-hour Relative Strength Index stood at 61.74, above its signal average of 57.76. Momentum therefore favors buyers, but the reading remains below the overbought threshold of 70.

The 3-day liquidation heatmap shows a concentration of leveraged positions immediately above the market near $1,925. A larger liquidity band sits around $1,945–$1,955.

These pools could act as short-term price magnets. A push through $1,925 may trigger forced buying from short sellers and accelerate a move toward $1,950.

Above that level, the psychological $2,000 mark becomes the next target. Ethereum would still need to overcome the daily 200-day average near $2,062 before the broader technical structure turns decisively bullish.

Liquidity is also building below the current price. The nearest downside zones appear around $1,890, $1,870 and $1,850–$1,860. Losing $1,900 could therefore expose ETH to a sweep of leveraged long positions in those areas.

The 4-hour Supertrend support near $1,850.62 provides the main bullish invalidation level. A sustained break below it would weaken the recovery and could open a move toward $1,800 or the 50-day average near $1,796.

Analysts see $2,000 as the next Ethereum test

Analyst Michaël van de Poppe said Ethereum could outperform Bitcoin if the broader market leader begins another upward move.

“Honestly, if BTC breaks upwards, I’d assume we’re seeing a significantly stronger breakout on ETH rather than Bitcoin.”

His chart placed a broader Ethereum target near $2,400, although ETH would first need to clear resistance around $2,000 and the 200-day moving average.

Analyst Ted Pillows also focused on the reclaimed psychological level and the potential for a short-term continuation.

“ETH is still holding above the $1,900 level. Clarity Act voting has been delayed, but still Ethereum looks good. If ETH manages to hold above this level, a rally to $2,000 could happen next.”

For now, $1,900 separates the bullish and bearish short-term scenarios. A daily close above $1,925 would strengthen the case for $1,950 and $2,000, while a reversal below $1,900 would shift attention back to $1,850.

Chainalysis has warned that cryptocurrency crime has increasingly extended into kidnappings, home invasions and other violent incidents as criminals pursue holders who can transfer digital assets immediately under coercion.

According to the blockchain analytics firm’s latest report shared with crypto.news, cybercrime still accounts for most illicit crypto activity, including an estimated $3.4 billion stolen through hacks, $17 billion lost to scams and about $820 million linked to ransomware in 2025. 

At the same time, physical attacks have become more common because crypto holders often control large amounts of wealth through self-custody wallets without the institutional safeguards associated with traditional financial assets.

The report estimates that violent criminals have extracted more than $30 million from crypto holders during the first half of 2026 through successful kidnappings, hostage situations, and home invasions. If the current pace continues, 2026 would surpass the $58 million stolen during 2025, although the estimate only covers publicly reported incidents and likely understates the full scale of the problem.

Earlier this week, Galaxy Research estimated that confirmed losses from the Coldcard hardware wallet vulnerability had reached 1,596 Bitcoin across three attack waves, with a suspected fourth wave potentially lifting total losses to about 2,055 BTC if verified. 

While the Coldcard incident involved a software flaw rather than physical violence, it underscored the value of cryptocurrency that criminals continue targeting through both digital exploits and real-world attacks.

Chainalysis says on-chain trails still expose violent attackers

Although the number of attacks has increased, the report said criminals are succeeding less often. Only 12 of 46 documented violent theft attempts resulted in victims surrendering funds through late June, producing a 26% success rate compared with 49% in 2025 and 67% in 2024. 

When failed extortion attempts, blocked transfers and recovered assets are included, the value connected to violent incidents rises to roughly $107 million during the first half of 2026.

According to the report, every successful forced transfer also creates a blockchain record that investigators can examine. Analysts grouped attackers into three categories based on how they handled stolen assets after the theft.

The least experienced offenders typically sent funds directly to centralized exchanges, making compliance teams and law enforcement more likely to identify them. More capable operators used decentralized exchanges, bridges and intermediary wallets to complicate tracing before eventually cashing out.

The report identified a third category consisting of attackers who appeared connected to established criminal networks. 

In one investigated case, stolen funds passed through an instant exchange before reaching what analysts described as a suspected over-the-counter laundering service that had previous blockchain links to cartel-related laundering services, wallets associated with alleged cocaine trafficker Ryan Wedding, terrorist financing clusters and Southeast Asian money laundering networks. 

The report presented those links as blockchain exposure rather than proof that every connected entity participated in the original violent crime.

Home invasions have become more common

As investigators documented more incidents, the nature of the attacks also changed. Kidnappings continued to account for most documented wrench attacks, while home invasions climbed from 14% of incidents in 2025 to 37% through mid-2026. According to the report, criminals increasingly use homes because they can pressure victims in familiar surroundings without moving them elsewhere.

Regional patterns also differed. The United States remained an outlier for home invasions, while France experienced a much higher share of kidnapping attempts than other countries tracked in the dataset.

France’s attack surge has coincided with alleged data exposure

France has recorded the highest number of publicly known violent crypto incidents since 2023, with 30 cases reported through mid-2026 after recording 19 during all of 2025, according to the report. Interior Minister Laurent Nuñez has said authorities documented more than 70 crypto-related violent incidents and announced a rapid identification and alert system for people considered at risk.

The report pointed to an alleged 2024 theft and sale of tax records belonging to high-net-worth crypto holders as the most likely explanation for the rise in French cases. According to the report, the dossiers allegedly contained names, addresses, holdings, phone numbers and tax information that could help criminals identify potential victims. 

It also cited Waltio’s January 2026 disclosure that unauthorized access affected data connected to about 50,000 users, while stopping short of establishing a direct causal link between the breach and individual attacks.

French authorities have treated the attacks as organized crime investigations. By mid-2026, the crackdown had resulted in around 200 arrests, 88 indictments, 75 suspects held in pretrial detention and more than a dozen investigations, according to the report.

Family members have increasingly become leverage

Beyond targeting crypto holders themselves, attackers have increasingly turned to relatives and acquaintances to force victims into handing over digital assets. According to the report, family members or close relations accounted for roughly 25% to 30% of documented incidents by early 2026 after being almost absent from recorded cases in 2021. In France, more than 40% of incidents involved someone connected to the holder rather than the holder directly.

The report also found that most victims were local residents instead of visitors. Known residency data showed locals accounted for all documented victims in Sweden, 93% in France, 82% in Brazil and 77% in the United States, a pattern that the firm said points to advance reconnaissance using leaked information, blockchain activity, social media or insider knowledge.