The Senate will not vote on crypto market structure before August 7. Prediction markets price passage at 16 percent. The math for September is worse than it looks.

The most bipartisan digital asset bill ever to clear a chamber of Congress is now four days from a procedural death that prediction markets already priced in weeks ago. On August 6, 2026, Senate Majority Leader John Thune told reporters the chamber will not hold a floor vote on the Digital Asset Market CLARITY Act before lawmakers leave Washington for the August recess. The Senate holds its last scheduled votes on Friday morning, August 7. It does not return until September 14.

The announcement converted what lobbyists had called a “tight but possible” window into a confirmed miss. On Polymarket, the contract asking whether H.R. 3633 will be signed into law before 2027 trades at 16 cents on the dollar, down from 82 cents in February. The collapse is not a prediction of permanent failure. It is a repricing of the calendar, and the calendar is brutal.

What the CLARITY Act actually does

The Digital Asset Market CLARITY Act is a 309 page bill that divides oversight of digital assets between two federal regulators. Tokens whose value derives primarily from an open, decentralized network would fall under the Commodity Futures Trading Commission. Tokens still tied to the commercial efforts of a founding team or company would be classified as securities under the Securities and Exchange Commission.

The classification matters because it determines which rulebook applies. A digital commodity under CFTC oversight would face disclosure and market integrity requirements modeled on existing futures regulation. A digital asset security under the SEC would face the full weight of securities law, including registration, reporting, and the antifraud provisions that have driven most of the agency’s crypto enforcement actions since 2023. The bill creates a process for tokens to transition from security to commodity status as their networks decentralize, a mechanism the industry has wanted since the SEC first applied the Howey test to token sales.

Beyond classification, the bill sets rules for exchanges, stablecoin yield, DeFi protocols, developer protections, and customer property treatment in bankruptcy. It also grants the CFTC new statutory authority over spot digital commodity markets, a power the agency currently lacks and has requested repeatedly since 2022.

The House passed it on July 17, 2025 with a vote of 294 to 134. More than 70 Democrats crossed the aisle, making it the most bipartisan crypto vote in congressional history. The Senate Banking Committee advanced it on May 14, 2026 by a vote of 15 to 9, with two Democrats joining the Republican majority. At that point, the industry expected a floor vote by the July 4 recess. That deadline came and went.

The stablecoin yield compromise nobody noticed

Buried in the bill’s 309 pages is a provision that could reshape the competitive landscape between banks and crypto firms. The Senate Banking Committee version prohibits interest or yield on idle stablecoin balances, protecting the bank deposit franchise from a product that could siphon savings accounts. But it permits activity based rewards, meaning stablecoin issuers can compensate users for lending, staking, or other on chain actions that generate real economic return.

The distinction is narrow but consequential. A stablecoin that pays 4 percent for sitting in a wallet would compete directly with savings accounts and money market funds. A stablecoin that pays 4 percent for providing liquidity to a DeFi protocol occupies a different regulatory category. The first looks like a deposit. The second looks like a return on productive capital.

Banking industry lobbyists fought for this distinction throughout the markup process. Crypto firms initially opposed it, arguing that any yield restriction would handicap stablecoin adoption. The compromise language reflects months of negotiation between the American Bankers Association and the Blockchain Association, brokered in part by the White House. Both sides have publicly accepted the current text, making stablecoin yield one of the few resolved issues in the bill.

The resolution matters for passage because it removed the banking industry as an active opponent. Banks will not lobby against a bill that protects their deposit base. That leaves the ethics provision as the primary obstacle, which is a political problem rather than an industry one.

A five-year firmware error turned Coldcard into the largest known Bitcoin seed-theft, while AI-assisted analysis of the broader ecosystem is surfacing how systematically the industry has underestimated the same class of vulnerability.

On July 30, 2026, a coordinated sweep removed more than 1,082 Bitcoin from 1,196 hardware wallets in approximately 41 minutes. No device was stolen. No PIN was guessed. The Bitcoin protocol was untouched. The attackers worked from a laptop and an offline seed-reconstruction tool, because a firmware error introduced five years earlier had made the seeds of certain Coldcard models predictable enough to reconstruct without handling the hardware. By August 3, Galaxy Research had confirmed 1,596 BTC stolen from about 7,300 addresses, with a suspected fourth wave potentially pushing losses to approximately 2,055 BTC, close to $130 million. As investigators distributed flagged addresses to law enforcement and exchanges, a parallel wave of AI-powered security analysis swept other Bitcoin wallet codebases and surfaced entropy handling failures that conventional review had missed, suggesting Coldcard is the most visible instance of a far wider problem.

What went wrong inside the firmware

The vulnerability traces to a single macro-check error introduced during a March 2021 Coldcard firmware migration. Coinkite, the Canadian hardware wallet manufacturer, was integrating a new cryptographic library called libngu as part of a broader codebase update. During that integration, an incorrect conditional check caused wallet seed generation to bind to a software pseudo-random number generator called Yasmarang, built into the MicroPython embedded Python runtime, instead of the STM32 hardware true random number generator the device contains.

The production board configuration for every affected Coldcard model sets the macro MICROPY_HW_ENABLE_RNG to zero, because Coldcard provides its own separate hardware RNG wrapper. Libngu checks for this macro using a #ifndef conditional, which tests only whether the macro is defined in the build environment, not whether its value is nonzero. Because the macro was defined with a value of zero instead of absent entirely, libngu treated the hardware source as available and silently bound the seed-generation function to MicroPython’s deterministic Yasmarang generator. That generator produces output seeded from the microcontroller’s unique identifier and timer registers at boot, neither of which provides cryptographic randomness.

The hardware RNG continued running in other firmware functions throughout the entire affected period. Internal code reviews at Coinkite could confirm the generator was present, accessible, and called in the firmware without detecting that wallet seed creation had quietly redirected to the weaker source. Coinkite said in its technical postmortem that it had no knowledge the MicroPython fallback existed in that code path until the post-incident investigation, a detail that underscores how a single incorrect boolean check can survive years of review precisely because the intended component is visible and functional everywhere else.

Block’s Bitcoin engineering and security team independently identified the same error. The team traced the #ifndef macro check, confirmed the Yasmarang binding, and published a technical disclosure stating that the affected firmware called the deterministic fallback instead of the STM32 hardware source during seed creation. Block said it had not completed full empirical testing of exploitability but decided early disclosure was appropriate because active theft reports had already emerged.

The impact on entropy differed by device. Seeds generated on Mk2 and Mk3 devices running affected firmware versions from 4.0.0 through 4.1.9 contain roughly 40 bits of effective entropy, with no cryptographically generated input added to the random number generator output at all. Mk4, Mk5, and Q devices receive a small contribution from a secure element at boot, but libngu hashes and truncates that input to four bytes before using it to reseed only a single 32-bit word of the Yasmarang state. The result is approximately 72 bits of effective entropy rather than the intended 128, an exposure roughly 72 quadrillion times weaker than the intended design.

How attackers reconstructed wallets without physical access

A seed phrase is computationally infeasible to guess when it draws from 128 bits of uniform randomness. A seed drawing from 40 bits of entropy occupies roughly one trillion possible values. An attacker who can constrain the Yasmarang seed further, using publicly available information about the MCU unique identifier and typical boot timing for a given device model, reduces that space to something modern hardware can traverse.

Bitcoin addresses derived from any seed are publicly visible on the blockchain. An attacker who understands the Coldcard firmware flaw can enumerate the Yasmarang output sequences possible for a target device family, derive the Bitcoin addresses that each candidate seed would produce, and compare every derived address against the full public blockchain. Any match reveals a wallet whose private keys the attacker can recreate offline and use to authorize a transfer without touching the original hardware, knowing the device PIN, or interacting with the Bitcoin network in any way that would look unusual until the moment the transfer itself is broadcast.

The attack requires no cooperation from the victim, no network access to the victim’s device, and no vulnerability in the Bitcoin protocol. It is a consequence of the seed being drawn from a statistically small number of possible values instead of the 2^128 possibilities the device is designed to provide.

Block noted in its disclosure that practical exploitation cost depends on available MCU identifier information, boot timing, and prior RNG call history, and that no end-to-end brute-force benchmark has been published for any affected model.

Four attack waves and a $130 million toll

Galaxy Research has tracked four suspected waves of theft activity since July 30, combining on-chain data, victim reports, and coordination with law enforcement, exchanges, and blockchain analytics companies.

The first wave struck July 30 and removed 1,082.65 BTC from 1,196 addresses over approximately 41 minutes. Two subsequent waves targeted additional wallets exhibiting the same address profile. Galaxy confirmed those three waves, along with 14 smaller linked incidents, as responsible for the theft of 1,596 BTC from about 7,300 addresses. Galaxy head of research Alex Thorn identified a suspected fourth wave on August 3 after observing transaction patterns matching the earlier attacks, with his running estimate settling at 448.7 BTC moved from 709 additional addresses. The sweep rate during the most active period reached 13.8 wallet drains per Bitcoin block, compared with a baseline of 0.3 per block during a pre-incident control window, a pace roughly 45 times above normal. Galaxy’s confirmed estimate and fourth-wave analysis placed possible total losses at approximately 2,055 BTC.

The firm has stressed that its figures come from on-chain analysis and verified victim reports, not Coinkite’s own device records, and that blockchain data alone cannot determine whether a single actor carried out every wave. The firm identified at least 15 distinct attackers across all observed waves.

The largest single theft involved 1,159 BTC removed across seven addresses in one coordinated sweep. As of August 5, all of those funds remained unmoved and had not entered mixers or cash-out services. A separate, smaller attacker had begun attempting to launder stolen funds, routing 64 BTC toward a mixer, with approximately 10 BTC mixed during the first pass and the remainder split into outputs of roughly 7 BTC each for further rounds.

Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses. Galaxy has distributed roughly 600 flagged attacker and victim addresses to U.S. federal law enforcement and exchanges to support monitoring. Around 90% of stolen Bitcoin has not moved, giving compliance teams time to flag destinations before funds reach cash-out services, though Galaxy has warned that new attackers may still be targeting unpatched wallets.

Why the flaw survived five years of review

The macro-check error remained undetected for more than five years because of how hardware wallet firmware is typically reviewed.

Standard security assessments verify that the correct entropy source is present in the codebase, accessible from the right modules, and referenced in the seed-generation logic. Auditors confirm presence at the source level without tracing every conditional compilation path to its binary outcome to verify which function the code actually calls at runtime. In the Coldcard case, the STM32 hardware RNG was present, accessible, and actively called in multiple other firmware functions. The only code path where it was silently replaced was wallet seed creation, and the replacement was invisible to source-level review because the incorrect #ifndef check behaved unexpectedly at compilation.

Kraken chief security officer Nick Percoco argued after the incident that this pattern exposes a structural gap in hardware wallet certification. Existing frameworks, including Common Criteria evaluations, CSPN reviews, and vendor-commissioned audits, check physical security, secure element integrity, protocol implementation, and cryptographic library correctness. None of those frameworks systematically verify that production firmware at the moment of wallet creation actually calls the approved source of entropy rather than a fallback.

“Production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used,” Percoco said.

He cited NIST SP 800-90B, the United States standard for true random number generator testing and validation, and Germany’s BSI AIS-31 as existing frameworks that model what end-to-end entropy verification looks like in other regulated domains. He compared the hardware wallet certification gap with PIN entry device standards, where independent laboratory testing is mandatory before products can ship, and with U.S. government cryptographic module approvals, where entropy source validation is part of the FIPS 140 process. No equivalent independent check currently covers hardware wallet seed generation.

Mastercard Crypto Credential does not move money; it vouches for the people moving it, and that distinction is now worth more than the rails beneath every stablecoin transaction.

At a glance, the Mastercard Crypto Credential announcement from August 5, 2026, reads like any other payments headline: a large incumbent partners with a fintech, a pilot begins, press releases follow. The language is careful, the commitments are limited, and the timeline is left open. Look past the surface, however, and something structural becomes visible. Mastercard is not trying to move stablecoins faster. It is trying to control who is allowed to move them at all.

That is not a payment product. It is a compliance passport.

The framing matters because the stablecoin market has spent years solving the wrong problem. Settlement infrastructure, liquidity sourcing, and wallet user experience have absorbed most of the capital and headlines. Meanwhile, the operational constraint that actually limits network growth, the compliance cost of adding a new counterparty to a cross-border flow, has gone largely unaddressed. Mastercard is betting that whoever solves that constraint first will own a more durable competitive position than whoever processes the most transactions.

What happened on August 5

Mastercard and Borderless.xyz announced a pilot program to test Mastercard Crypto Credential inside working cross-border stablecoin payment flows. Three payment operators joined as the initial participants: Infinia, Walapay, and Koywe. All three companies came into Mastercard’s orbit through its Start Path accelerator program.

Borderless.xyz is the network through which the pilot runs. The platform connects wallet infrastructure with more than 15 licensed stablecoin providers across more than 100 countries, covering 260 payment corridors across 59 currencies. Its Q2 2026 benchmark report showed stablecoin pricing had fallen below interbank foreign exchange rates in February 2026, a milestone indicating that on-chain cross-border payments are no longer only a theoretical alternative to legacy wire transfers.

Kevin Lehtiniitty, chief executive and co-founder of Borderless.xyz, named the core problem directly: “Every new provider means starting the verification process over.” That sentence captures the structural inefficiency the pilot is designed to address. The payments work. The compliance does not scale.

The pilot aims to show that a standardized assurance signal from Mastercard can travel across the Borderless.xyz network in place of repeated bilateral counterparty checks. Downstream providers accept the credential on the strength of the originating verification alone, compressing weeks of due diligence into a signal they integrate into existing approval workflows. The pilot changes no individual operator’s obligations, but reduces how much work each one must do to satisfy them.

What the credential actually is, and what it is not

Mastercard Crypto Credential does not route transactions. It does not custody assets. It does not settle transfers between wallets. The framework does exactly one thing: it attaches identity and eligibility information to the parties on either side of a stablecoin transfer, in the form of standardized assurance signals.

Those signals contain verification and governance metadata. Payment providers integrate the signals into their internal compliance and risk processes. When a counterparty presents a Crypto Credential signal, the receiving provider can treat the originating KYC and AML check as sufficient, rather than running its own independent review from scratch. The framework also replaces raw wallet addresses with human-readable aliases, which satisfies Travel Rule requirements by making identity information transmissible without exposing long hexadecimal addresses to every party in the chain.

This distinction from a payment product is important for two reasons. First, it means the credential does not compete with stablecoin issuers. Circle’s USDC, Paxos’s USDG, PayPal’s PYUSD, Fiserv’s FIUSD, and Ripple’s RLUSD all run on top of the credential framework, not beside it. Crypto Credential is not a stablecoin and does not aspire to be one. Second, it means the revenue model for Mastercard is not transaction volume. It is access to a trusted network. The card network charges for the right to present a recognized compliance signal, which is a fundamentally different monetization logic from interchange fees or settlement spreads.

That structure scales without proportional capital cost. Mastercard does not need to build settlement infrastructure in every new corridor. It needs to convince enough institutions that its assurance signal is worth accepting. That is a business Mastercard has been running for decades, under different names and across different asset classes.

The correspondent banking analogy

The single-audit compliance model at the center of the Borderless.xyz pilot is not a new concept. It is the operational foundation of wholesale banking, adapted to a new asset class.

Correspondent banking solved the same counterparty problem decades ago. When a bank in Brazil sends funds to a bank in Japan, neither institution re-audits the other’s customers from scratch on every transaction. The originating bank performs its own KYC and AML checks and passes that information through the correspondent chain. Downstream banks trust the originating work because the relationships between institutions are governed by standing bilateral agreements, shared regulatory frameworks, and in many cases explicit guidance from central banks about what constitutes acceptable correspondent due diligence.

The trust is portable. The verification does not repeat at every hop.

Stablecoins lack that infrastructure. Today, when a stablecoin payment operator adds a new provider, the counterparty verification process restarts. Every new partner triggers a new compliance conversation. The payment network expands, but the compliance workload expands in parallel rather than flattening out. At the scale Borderless.xyz operates, across 260 corridors and more than 100 countries, that friction is a structural ceiling on how fast the network can add participants.

Mastercard already moved toward addressing this before the Borderless.xyz pilot. In March 2026, it launched its Crypto Partner Program, enrolling more than 85 digital asset companies, payment providers, and financial institutions into a shared framework for cross-border stablecoin payment flows. Circle, Binance, and Gemini were among the named participants at launch. The Crypto Credential network that underlies the Borderless.xyz pilot is the next layer of that program: moving from enrollment to an operational trust signal that travels with each transaction.

The correspondent banking model proved as effective for fiat as any alternative. Whether the same logic transfers cleanly to stablecoins depends on a question the pilot has yet to answer: whether downstream compliance teams will accept another firm’s verification as adequate for their own supervisors. That question is regulatory, not technical.

Why the GENIUS Act created the demand

The timing of the pilot is not accidental. President Trump signed the Guiding and Establishing National Innovation for US Stablecoins Act, known as the GENIUS Act, into law on July 18, 2025, giving the United States its first federal framework for fiat-backed stablecoins. The law imposed licensing requirements, reserve standards, and mandatory AML and KYC controls on stablecoin issuers operating in the US market.

One year later, on July 18, 2026, federal stablecoin regulators missed the key deadline for issuing implementing rules under the Act. The Office of the Comptroller of the Currency published draft regulations earlier in 2026, but final rules were not in place when the statutory deadline passed. The resulting gap left stablecoin operators navigating an environment where the compliance obligations were clear in principle but the acceptable mechanisms for satisfying them remained unspecified in detail.

That gap is exactly where the credential fits. If a stablecoin issuer must verify the identity of every party in a transfer chain, and if regulators have not specified how that verification must work at the network level, a portable assurance signal from a recognized global payments network is a commercially reasonable answer to an open compliance question. Mastercard is building one and positioning it as the default industry approach before the rules are finalized.

Globally, the same logic applies. The EU’s Markets in Crypto-Assets regulation is in effect for European stablecoin operators. Similar frameworks in Hong Kong, Singapore, and the UAE have introduced AML and identity requirements that apply to cross-border flows. The FATF Travel Rule, which requires sharing sender and recipient identity data on transfers above a minimum threshold, operates across most major jurisdictions and has been one of the most operationally challenging requirements for cross-border payment networks to satisfy.

Crypto Credential addresses Travel Rule compliance by design, exchanging the required metadata automatically while using aliases to avoid exposing raw wallet addresses across the counterparty chain.

USDC already began functioning as a compliance-ready stablecoin for institutional counterparties in the period after the GENIUS Act passed, because its reserve structure and governance already matched the law’s core requirements. Crypto Credential extends that logic from the stablecoin level to the counterparty level, making the identity of the sender and recipient as verifiable as the backing of the coin itself.

Unsealed US court records released this week indicate a federal judge has allowed crypto exchange Bybit to move quickly in its bid to track and recover funds tied to the $1.5 billion North Korea-linked attack that hit the platform in February 2025. The order grants Bybit expedited discovery, a procedural step that can help the exchange identify alleged intermediaries and pursue a limited portion of stolen assets that remain capable of being traced.

According to the docket on CourtListener, Bybit filed its lawsuit under seal on June 18 against North Korea, the Reconnaissance General Bureau, the Lazarus Group, and 20 unidentified defendants. The court granted the request for expedited discovery the following day, June 19—an early authorization that signals the court’s willingness to support time-sensitive efforts to obtain transactional and account information relevant to the case.

Key takeaways

• Bybit secured expedited discovery in a US case targeting parties allegedly involved in the February 2025 North Korea-linked $1.5 billion hack.
• The exchange argues that only a minority of stolen funds remains traceable, with 9.8% identified as linked to identifiable wallets as of the June 18 filing.
• A temporary restraining order was obtained on June 19, renewed on July 16, and partially backed by a preliminary injunction on July 30.
• Bybit’s complaint seeks recovery of approximately $1.5 billion, including compensatory, punitive, and treble damages under US RICO law.
• The share of traceable funds reported by Bybit has fallen significantly versus a prior estimate cited by its CEO over a year earlier.

Expedited discovery aims to narrow the recovery path

Expedited discovery changes the practical timeline for Bybit’s legal strategy. In a standard civil case, parties often wait longer for evidence requests and responses. Here, the court’s decision effectively gives Bybit a faster route to request information that can help determine who may be holding, routing, or facilitating portions of stolen crypto.

The records indicate Bybit’s complaint asserts that some of the assets it claims were stolen were routed to exchanges and other services that operate in, or maintain infrastructure in, the United States. Bybit’s filings sought account-holder identities, balances, and transaction histories from relevant platforms—information the company argued would be available after receiving a court order.

For investors and market participants watching post-incident enforcement, this matters because stolen-fund recoveries in crypto often depend on how quickly claimants can obtain counterparty data before assets shift again. A court-backed discovery window can also clarify whether intermediaries are identifiable enough to support targeted lawsuits or enforcement.

Bybit cites a steep drop in traceable funds

Beyond procedure, the court documents also provide a snapshot of how much of the alleged theft Bybit believes remains linkable. In its June 18 filing, Bybit stated that 90.2% of the stolen assets had become untraceable after passing through mixers, cross-chain bridges, and over-the-counter dealers.

That leaves 9.8% traced to identifiable wallets, including 5.3% of the total (about $75.5 million) that Bybit said had been frozen or recovered. The company also appears to be positioning these traceable portions as the realistic starting point for an asset-recovery effort—rather than expecting a full return of the entire sum through a judgment against North Korea alone.

The exchange’s figures also reflect a notable change from earlier in the case. The records reference remarks by Bybit CEO Ben Zhou more than a year earlier, stating that 68.57% of the funds remained traceable at the time. If those earlier estimates are taken at face value, the current accounting suggests a major degradation in traceability over time—consistent with how attackers and intermediaries may move value across services designed to obscure origin.

Restraining order and partial injunction support preservation of assets

Court filings also show that Bybit obtained a temporary restraining order on June 19 aimed at stopping the unidentified defendants from transferring certain traceable assets. The court renewed that order on July 16 and partially granted Bybit’s request for a preliminary injunction on July 30.

While the documents indicate the court is actively managing the case to preserve at least some assets, some exhibits and other materials remain sealed. That confidentiality limits what outside observers can confirm about the precise scope of the relief, but the procedural milestones themselves underscore that Bybit’s claims are progressing through the federal court system rather than remaining purely theoretical.

Background: the 2025 hack and attribution

The alleged theft dates back to Feb. 21, 2025. According to earlier reporting referenced in the court-linked account, attackers compromised Safe Wallet’s infrastructure after obtaining access through compromised credentials tied to a Safe developer, allowing malicious code to be injected into its cloud environment.

For its attribution, the FBI published a public notice on Feb. 26, 2025 stating that the theft was carried out in connection with North Korea. That attribution is important context for the lawsuit because it frames the alleged threat actor behind the event, even as the civil claims focus on specific defendants and mechanisms to recover assets.

In its lawsuit, Bybit is seeking return of stolen assets estimated at approximately $1.5 billion, along with compensatory damages, punitive damages, and treble damages under the US Racketeer Influenced and Corrupt Organizations Act. The inclusion of RICO indicates Bybit is pursuing broader claims beyond a single breach—attempting to fit the alleged behavior into a pattern of racketeering-type conduct recognized under US law.

As court records show, Bybit’s current push is not just about winning a judgment, but about securing the evidence and preservation measures needed to make recovery feasible in practice. With most of the claimed funds allegedly rendered untraceable, the value of expedited discovery and early injunctive relief is likely to be judged by whether Bybit can identify counterparties while the remaining traceable portion is still reachable.

Going forward, readers should watch what information the expedited discovery process yields and whether the preliminary injunction’s partial scope expands as the court reviews more sealed exhibits—especially as Bybit’s own accounting suggests traceability has fallen sharply since earlier estimates.

A Jersey-law custody structure lets xStocks holders instruct real shareholder votes through an on-chain mechanism, closing a governance gap the tokenized equity industry has discussed for years but never shipped.

When Kraken listed xStocks on June 30, 2025, the launch documentation was unusually candid about what the tokens did not do. Traders could not vote in shareholder meetings. Dividends were absent. The tokens were described as instruments for capturing price exposure, best suited to high-growth names like Nvidia and Tesla that paid no dividends anyway. Kraken had brought tokenized equity to retail holders across more than 110 countries. It had not brought the full substance of equity ownership.

That distinction mattered less when xStocks was a new product with $2 billion in cumulative volume and 24,000 holders. It matters considerably more now that the platform has processed more than $30 billion in total transaction volume, settled over $6 billion on-chain, and attracted 125,000 unique holders across more than 110 countries. At that scale, the absence of governance rights is not a footnote in the terms of service. It is a ceiling on what kind of investor the product can reach and what kind of asset the token can legitimately claim to be.

The governance pass-through that Kraken has built into the xStocks framework is a direct response to that ceiling.

What changed and when

The change arrived not as a major product announcement but as an update to the contractual terms governing Backed Assets (JE) Limited’s custody arrangement. Backed Assets is the Jersey-incorporated private limited company that issues xStocks tokens and holds the underlying shares in custody. When those terms were updated to include a binding obligation to follow token holder voting instructions, the governance right was created in the most durable way available to an offshore product: contractual obligation under Jersey law.

The mechanism works as follows. For each company held within the xStocks universe, Backed Assets receives proxy materials ahead of the relevant annual general meeting or extraordinary general meeting. Token holders who hold eligible xStocks on the record date can submit voting instructions through their Kraken account. Those instructions are aggregated and recorded on the Ink blockchain, Kraken’s own Ethereum Layer 2 network. The aggregated result is transmitted to Backed Assets as a contractual instruction. Backed Assets then votes the underlying shares it holds at the relevant meeting according to those instructions.

The on-chain recording of each individual instruction creates a public, immutable audit trail. The timestamp, wallet address, and direction of each vote are verifiable by any party with access to the Ink chain. This transparency is notably stronger than the internal vote aggregation systems used by most traditional brokerages, where the process of collecting and tallying beneficial owner instructions is handled in proprietary databases that regulators have historically found opaque.

The custody chain that makes it work

To understand why this mechanism is legally possible, it is necessary to trace the chain of ownership. Backed Assets purchases the underlying U.S.-listed shares through a regulated brokerage arrangement. Those shares are held at a central securities depository, with Backed Assets or its broker as the beneficial owner. Backed Assets then issues xStocks tokens, each representing a one-to-one claim against the corresponding share held in custody. Those tokens reach end users through Kraken and other members of the xStocks Alliance network.

For voting purposes, the chain runs in the opposite direction. A company like Apple or Nvidia sends its annual meeting notice to the registered holder of record. Under the U.S. street-name system, that registered holder is typically a nominee linked to the Depository Trust and Clearing Corporation, which is obligated to pass voting rights upward to the beneficial owner, which in this case is Backed Assets or its broker. Backed Assets, now contractually bound by its updated custody terms, collects instructions from token holders before casting those votes on their behalf.

The mechanism is coherent within its own architecture because Backed Assets is the actual beneficial owner of the underlying shares. The voting rights that flow to it through the DTCC nominee system are genuine shareholder rights, not synthetic representations of them. What Backed Assets has added is a contractual sub-delegation: the decision about how to exercise those rights now flows downward to the token holders who bear the economic exposure.

Why the legal gap existed in the first place

Tokenized equity in its current form inherits a structural problem that predates blockchain by decades. U.S. corporate law vests voting rights in the shareholder of record. When brokers began holding shares in street name in the 1970s to make settlement more efficient, the SEC introduced Regulation 14A, which requires companies to distribute proxy materials to beneficial owners and requires brokers to pass voting instructions from beneficial owners up the chain.

Offshore tokenized equity disrupts this chain at a new point. The custodian holding the underlying shares is incorporated in Jersey and operates under a Bermuda digital asset license. The tokens it issues are not registered under the U.S. Securities Act of 1933. The token holders are primarily non-U.S. persons in jurisdictions where no domestic equivalent of Regulation 14A compels a pass-through.

In this environment, the path taken by every prior tokenized equity product was to exclude governance rights entirely. The original xStocks launch followed that path. Binance’s BSTOCKS, which launched and was discontinued in 2021, gave holders no voting rights. Robinhood’s EU tokenized stocks, issued under a MiFID II-compliant prospectus, track price returns but exclude all governance attributes. Mirror Protocol’s synthetic equity tokens on Terra never purported to convey any rights against underlying issuers.

That exclusion was a deliberate legal choice, driven by the complexity of building a compliant cross-border governance pass-through, the liability exposure if the mechanism failed, and the absence of any regulatory framework specifically authorizing a blockchain-based voting instruction as a valid proxy submission.

Jersey law and why it matters

The reason xStocks can offer what prior products did not is the specific legal properties of the Backed Assets custody structure under Jersey law. Jersey is a Crown dependency with a body of company and trust law designed to support complex cross-border custodial arrangements.

Under the Companies (Jersey) Law 1991 and the Trusts (Jersey) Law 1984, it is possible to create enforceable beneficiary instruction rights within a custodial arrangement without those rights constituting a separate class of securities under Jersey financial services law. The xStocks token is not, under Jersey law, a security in the sense that would trigger the Jersey Financial Services Commission’s registration requirements. It is a contractual instrument that carries specified economic and governance rights against Backed Assets (JE) Limited.

This legal classification is the key to why the mechanism works. If voting rights were framed as a securities attribute requiring SEC recognition, the structure would need to engage with Regulation 14A and U.S. broker-dealer registration, which Backed Assets and Payward Digital Solutions Ltd. cannot satisfy because xStocks are explicitly not offered to U.S. persons. By classifying the voting right as a contractual beneficiary instruction right under Jersey law, Kraken has built a mechanism that is legally coherent within its own jurisdiction and requires no external regulator to authorize it.

The on-chain aggregation layer adds a transparency element that actually exceeds what most regulated proxy plumbing provides. Every instruction is timestamped, publicly verifiable, and permanent. Traditional brokerages aggregate votes in proprietary internal systems; the xStocks mechanism makes the aggregation auditable by anyone.

What the rest of the industry has done instead

The contrast with competitor approaches shows how narrow the viable design space for this feature is. The main alternatives to the xStocks contractual custody pass-through are economic-only tokens, synthetic equity derivatives, and fully registered security tokens.

Economic-only tokens, which describes Robinhood’s current EU offering, deliver price exposure and in some structures dividend equivalents, but explicitly exclude governance. This is the lowest-complexity option from a legal standpoint, but it is also the design that most directly prevents the product from appealing to institutional allocators with stewardship obligations written into their mandates.

Synthetic equity derivatives, used by venues offering perpetual futures on equity names, have no connection to an underlying share held anywhere. A synthetic position tracking Apple’s price has no relationship to Apple Inc. as a legal entity and cannot convey governance rights because there is nothing to vote. Kraken itself offers xStocks perpetual futures through its xChange execution layer alongside the spot token, but the voting pass-through applies only to the spot token, not to the derivative.

Fully registered security tokens, the model pursued by platforms including Securitize, do attempt to convey the complete bundle of shareholder rights through a digital token. But registration under a major securities regime constrains distribution to accredited or qualified investors and involves ongoing compliance costs that make retail-scale distribution difficult. No fully registered security token product has reached anywhere near xStocks’ holder count or volume trajectory.

Regulatory implications for a U.S. expansion

The mechanism works precisely because xStocks are not offered to U.S. persons. The SEC’s jurisdiction over proxy solicitation under Regulation 14A extends to any solicitation that reaches U.S. shareholders. If the xStocks voting instruction process were offered to U.S. persons, it could be characterized as a proxy solicitation subject to that regulation, requiring specific disclosures, a structured proxy statement, and filing with the SEC.

The SEC’s enforcement posture in the digital asset sector raises a further structural concern. The agency has progressively argued that blockchain-based mechanisms that convey economic returns or governance rights can constitute investment contracts under the Howey test. A token that carries a real vote at a real company’s annual meeting begins to resemble equity in that company. If that token were offered to U.S. persons, the agency could pursue classification as a security requiring registration under Section 12 of the Securities Exchange Act of 1934.

Payward Digital Solutions Ltd., the Bermuda-licensed entity through which xStocks are offered, holds a Digital Asset Business license from the Bermuda Monetary Authority. The BMA’s framework accommodates structured instruments without treating every contractual right as a separately regulated security, which is the environment in which the pass-through can function without regulatory intervention.

U.S. state law adds further complexity for any future expansion. Blue sky statutes in states including California and New York define “security” broadly enough to potentially capture a contractual instrument carrying voting rights even if the federal analysis were resolved favorably. Any U.S. launch would require state-by-state review alongside the federal analysis.

What this means for institutional capital

Governance rights have been cited explicitly by institutional asset managers as a structural barrier to including tokenized equities in professionally managed portfolios. Large managers with fiduciary duties under ERISA or equivalent regimes are generally required to exercise voting rights on behalf of beneficiaries. A product that strips out voting is, for those managers, a compliant substitute for direct share ownership only if the investment mandate specifically permits it.

Passive index-tracking funds face this most acutely. Because they cannot exit positions that fall out of mandate, proxy voting is the primary lever through which passive managers influence corporate behavior. A tokenized equity product that gives those managers no governance capability is structurally incomplete.

The xStocks EU expansion, which opened the product to a major institutional market that had previously been excluded at launch, was one step toward a product that institutional allocators could consider. The governance pass-through is a second, arguably larger, step. Accounting treatment under IFRS and U.S. GAAP, custodial risk, and the absence of SEC regulatory recognition remain open questions for any institutional allocator subject to those frameworks. But governance capability removes what many allocators have described as the most immediately obvious structural gap between xStocks and a traditional equity holding.

The limits of the fix

The Jersey contractual pass-through is functional within its own framework, but it carries limits that any holder or allocator should weigh before treating it as equivalent to direct share ownership.

The voting right is a contractual right against Backed Assets, not a corporate law right against the underlying company. If Backed Assets entered insolvency or failed to fulfill its contractual obligation to follow voting instructions, a token holder’s remedy would be through Jersey courts under Jersey contract law, not through the shareholder remedies available in U.S. courts, which include appraisal rights, derivative suits, and direct actions against directors.

The mechanism also depends on the one-to-one share backing being maintained at all times. If outstanding token supply were ever to exceed the underlying share holding at any moment, not all voting instructions could be transmitted. The one-to-one requirement is designed to prevent this, and Backed Assets publishes proof-of-reserve data to support it, but real-time on-chain verification available to individual token holders is not yet in place.

The practical weight of individual votes also depends on concentration. For a company like Apple or Nvidia, even a substantial xStocks position represents a small fraction of total outstanding shares. The pass-through gives token holders a real vote. Whether that vote is consequential depends on how large the xStocks holder base grows relative to total outstanding share counts for each underlying company.

What to watch

Total xStocks on-chain settled volume crossing $10 billion: This level would signal institutional liquidity depth sufficient to attract allocators with minimum position size requirements, and would make the governance mechanism relevant to funds that currently cannot meet internal liquidity standards for tokenized equity.

SEC comment or formal no-action guidance on offshore tokenized equity voting: Any written SEC position on whether the xStocks mechanism constitutes a Regulation 14A proxy solicitation would clarify the pathway for a U.S. expansion and signal how the agency plans to treat voting-enabled tokenized equity more broadly.

A competing platform announcing a comparable voting pass-through: If Robinhood, eToro, or another major tokenized equity venue announces a governance pass-through mechanism, it would indicate that the contractual custody model is becoming the industry standard rather than a single-platform feature.

Backed Assets publishing real-time proof-of-reserve for voting record dates: On-chain verification that underlying share counts match outstanding token supply at each record date would remove the remaining trust dependency from the governance mechanism, allowing institutional allocators to rely on it without a separate audit engagement.

First AGM where xStocks instructions exceed 0.1 percent of total votes cast: This threshold would mark the first moment xStocks holders have had a measurable effect on a real governance outcome, transforming the pass-through from a legal feature into a market-relevant force.

Disclaimer: This article is published for informational purposes only and does not constitute investment, legal, or financial advice. xStocks tokens are not offered to U.S. persons or persons in restricted jurisdictions. Past performance of tokenized equity products does not predict future results. Published August 6, 2026.

OKX has scheduled the removal of six GODS, PRCL and DUCK spot trading pairs while suspending deposits for the affected tokens from Aug. 7 and setting Nov. 7 as the withdrawal deadline.

According to an OKX announcement, the exchange will remove three margin-settled spot pairs GODS/USD, PRCL/USD, and DUCK/USD, between 16:00 and 18:00 UTC on Aug. 14. Three additional spot pairs quoted in USDT and EUR will follow three days later, with GODS/USDT, PRCL/USDT and DUCK/USDT scheduled for delisting during the same two-hour window on Aug. 17.

The exchange has also introduced a phased timeline for the affected assets. Deposits for GODS, PRCL and DUCK stopped at 16:00 UTC on Aug. 7, while withdrawals for the three tokens will remain available until 16:00 UTC on Nov. 7.

OKX has split the trading pair removals across two dates

Rather than removing all markets at once, the exchange has divided the delisting into two stages.

On Aug. 14, users will lose access to GODS/USD, PRCL/USD and DUCK/USD trading pairs. Three days later, OKX will remove GODS/USDT, PRCL/USDT and PRCL/EUR alongside DUCK/USDT, completing the process for all six spot markets listed in the notice.

At the same time, the exchange has already halted deposits for the related assets, preventing users from transferring additional GODS, PRCL or DUCK tokens onto the platform. Withdrawals remain available for another three months before closing in November, giving holders additional time to move their assets elsewhere.

The announcement did not state the reason for removing the trading pairs.

Deposit suspension starts before withdrawal deadline

The published timetable separates trading, deposits and withdrawals into different stages.

Deposit services for the affected cryptocurrencies ended first on Aug. 7. Trading activity will continue until the scheduled delisting windows in mid-August, after which the listed spot pairs will no longer be available.

Withdrawal support, however, will continue until Nov. 7, providing a longer period for customers who still hold the affected tokens after trading ends.

Crypto exchanges commonly separate delisting from withdrawal deadlines, allowing users to transfer assets after markets have been removed. In this case, OKX has provided nearly three months between the end of deposits and the final withdrawal cutoff.

OKX continues operational changes across multiple markets

The latest asset removals come during a period of operational updates across several regions.

Earlier in July, Digital Asset reported that the OKX Android application had returned to South Korea’s Google Play Store after a four-day suspension, making it the first recently restricted overseas crypto exchange to regain access on the platform. The restoration followed Google’s temporary removal of the app, while exchanges such as Bybit remained unavailable in the Korean Play Store.

Digital Asset had previously found that dozens of overseas exchange applications became inaccessible on Google Play as South Korea tightened oversight of overseas virtual asset service providers operating without local registration. 

Although some exchanges had been identified by the country’s Financial Intelligence Unit as unreported VASPs, the publication reported that Google’s restrictions also affected several platforms that were not included on the FIU’s published enforcement list.

Outside South Korea, OKX has continued expanding regulated services in Europe. In July, the exchange launched a one-way USDT-to-USDC conversion service for eligible customers across 30 European Union and European Economic Area countries operating under its Markets in Crypto-Assets license. 

The service allows users to deposit USDT and voluntarily convert their holdings into MiCA-compliant USDC as European exchanges reduce support for Tether’s stablecoin following the regulation’s implementation.

OKX has also expanded its institutional strategy

Operational changes have coincided with new corporate developments at the exchange.

Last month, OKX appointed former New York Governor Andrew Cuomo to its board of directors after he had advised the company on U.S. regulatory and institutional strategy since 2023. According to the company, the appointment formalized an existing relationship as OKX continued expanding its U.S. operations following the relaunch of its U.S. exchange and self-custody wallet in 2025.

The company has also continued working with Intercontinental Exchange through a planned joint venture focused on blockchain-based financial products. According to OKX, Cuomo will remain co-chair of the initiative, which is intended to combine ICE’s market infrastructure with the exchange’s blockchain technology, subject to regulatory approvals.

Bridge has joined the EU’s MiCA register, increasing the number of authorized electronic money token issuers to 42 after securing regulatory approval in Luxembourg.

According to the latest update published by the European Securities and Markets Authority (ESMA) on Wednesday, Bridge Building, the Luxembourg-based entity behind Stripe-owned stablecoin infrastructure company Bridge, has been added to the European Union’s Markets in Crypto-Assets (MiCA) register as an authorized electronic money token (EMT) issuer.

The addition raises the number of MiCA-authorized EMT issuers in the European Union to 42. ESMA’s latest register update also added three new crypto-asset service providers (CASPs) from Germany, bringing the total number of authorized CASPs across the bloc to 324.

Bridge’s inclusion follows regulatory approvals it announced on July 2 after obtaining both a MiCA crypto-asset service provider authorization and an Electronic Money Institution (EMI) license from Luxembourg’s Commission de Surveillance du Secteur Financier (CSSF). At the time, Bridge Head of Product Mai Leduc Blount said the approvals would allow businesses across the European Union to develop stablecoin and payment products under a regulated framework.

Bridge’s MiCA approval expands regulated stablecoin services

Receiving both the CASP authorization and EMI license allows Bridge to provide regulated services throughout all 27 European Union member states under a single regulatory framework instead of requiring separate approvals in each country.

When announcing the approvals in July, the company said businesses using its infrastructure would be able to issue custom euro-backed stablecoins, create named virtual IBANs, and provide euro accounts that work across the European Union. Bridge also said fintech companies could integrate cross-border euro accounts through a single connection, while enterprises could move funds between subsidiaries using stablecoins instead of correspondent banking networks.

Blount said at the time that businesses operating in the European Union could combine euro stablecoin issuance with named IBANs and euro payouts across all member states through one integration.

The approvals came shortly after the European Union completed the final phase of its MiCA transition on July 1, requiring regulated crypto platforms to support only compliant stablecoins. Following the implementation, exchanges including Coinbase, Kraken and Crypto.com removed USDT trading for European users after Tether decided not to seek MiCA authorization, while Binance introduced service changes for customers affected by the new framework.

ESMA register adds new German CASPs

Alongside Bridge’s registration, ESMA added three German institutions to its MiCA register as authorized crypto-asset service providers.

The newly listed firms are Volksbank Die Gestalterbank, VBU Volksbank im Unterland and VR-Bank Erding. Their inclusion increases the number of authorized CASPs in the European Union from 321 to 324.

ESMA’s latest update did not introduce any new asset-referenced token (ART) authorizations, leaving that section of the register without approved issuers. The regulator also made no changes to its list of non-compliant crypto-asset companies.

Recent weeks have seen ESMA publish register updates more frequently as firms continue securing MiCA authorizations following the regulation’s full implementation across the European Union.

Stripe continues building regulated stablecoin infrastructure

Bridge’s registration comes as Stripe continues expanding the stablecoin infrastructure it acquired through its approximately $1.1 billion purchase of Bridge.

Since completing the acquisition, Stripe has integrated Bridge’s technology into its payments business while extending regulated payment services into additional jurisdictions. The company has positioned the infrastructure around stablecoin payments, cross-border settlement and financial services for businesses and developers.

In March, Visa announced an expansion of its partnership with the Stripe-owned company to introduce stablecoin-backed Visa card programs in more than 100 countries by the end of 2026.

The company has also continued building banking relationships and payment infrastructure around Bridge. Connor Fitzgerald, who recently stepped down as Stripe’s head of stablecoin partnerships after helping establish the company’s stablecoin card program, said the team built sponsor bank relationships, payment network connections and regulatory infrastructure before expanding the program internationally.

According to Fitzgerald, the stablecoin card initiative grew from launch to operations in more than 100 markets, introduced what he described as the first stablecoin settlement flow in the United States and increased annualized payment volume from zero to tens of millions of dollars.

Stablecoins remain central to Stripe’s payments strategy

Bridge’s latest regulatory milestone adds to Stripe’s recent activity in blockchain-based payments as the company continues combining regulated infrastructure with its global payments network.

Alongside expanding stablecoin products, Stripe has supported cross-border settlement, card issuance and payment services built on Bridge’s technology. The company has also remained active in traditional payments. Reuters previously reported that Stripe and private equity firm Advent International submitted a proposal worth about $53 billion to acquire PayPal.

According to Reuters, the offer valued PayPal at $60.50 per share and would give Stripe and Advent equal ownership if completed. Reuters also reported that PayPal’s board viewed the proposal as undervaluing the company while weighing financing certainty, regulatory considerations and execution risks, with discussions remaining active.

If completed, the transaction would combine PayPal’s crypto payment products, including the Paxos-issued PYUSD stablecoin, with Stripe’s expanding stablecoin infrastructure developed through Bridge. Reuters also reported that the bidders explored potential structural remedies in the event antitrust regulators require changes to the proposed transaction.