Connect with us

Crypto World

Coldcard’s RNG flaw is still draining wallets, and an AI audit just found 85 more critical bugs across Bitcoin

Published

on

Coldcard pushes bitcoin back to exchanges: the anti-self-custody trade

A five-year firmware error turned Coldcard into the largest known Bitcoin seed-theft, while AI-assisted analysis of the broader ecosystem is surfacing how systematically the industry has underestimated the same class of vulnerability.

Summary

  • Attackers have stolen a confirmed 1,596 BTC from about 7,300 Coldcard addresses across three attack waves, with total losses potentially reaching 2,055 BTC, close to $130 million, if a fourth wave is verified through victim reports.
  • The breach originated in a March 2021 firmware error that silently substituted a predictable software pseudo-random number generator for Coldcard’s hardware true random number generator during wallet seed creation, leaving seeds with as few as 40 bits of effective entropy on older devices.
  • Fifteen or more distinct attackers have exploited the same flaw without physical device access, and roughly 90% of stolen funds remain unmoved, giving investigators a narrow window to coordinate with exchanges and law enforcement before laundering activity accelerates.
  • Block’s Bitcoin engineering and security team independently confirmed the flaw, and Coinkite has released corrected firmware and destroyed all affected-device inventory, but existing vulnerable seeds require complete wallet migration regardless of firmware version installed.
  • The incident has triggered calls from Kraken’s chief security officer for mandatory independent entropy testing across all hardware wallet manufacturers, alongside a wave of AI-assisted security analysis of Bitcoin wallet codebases that has identified dozens of additional entropy handling failures the industry’s existing review processes had not caught.

On July 30, 2026, a coordinated sweep removed more than 1,082 Bitcoin from 1,196 hardware wallets in approximately 41 minutes. No device was stolen. No PIN was guessed. The Bitcoin protocol was untouched. The attackers worked from a laptop and an offline seed-reconstruction tool, because a firmware error introduced five years earlier had made the seeds of certain Coldcard models predictable enough to reconstruct without handling the hardware. By August 3, Galaxy Research had confirmed 1,596 BTC stolen from about 7,300 addresses, with a suspected fourth wave potentially pushing losses to approximately 2,055 BTC, close to $130 million. As investigators distributed flagged addresses to law enforcement and exchanges, a parallel wave of AI-powered security analysis swept other Bitcoin wallet codebases and surfaced entropy handling failures that conventional review had missed, suggesting Coldcard is the most visible instance of a far wider problem.

What went wrong inside the firmware

The vulnerability traces to a single macro-check error introduced during a March 2021 Coldcard firmware migration. Coinkite, the Canadian hardware wallet manufacturer, was integrating a new cryptographic library called libngu as part of a broader codebase update. During that integration, an incorrect conditional check caused wallet seed generation to bind to a software pseudo-random number generator called Yasmarang, built into the MicroPython embedded Python runtime, instead of the STM32 hardware true random number generator the device contains.

Advertisement

The production board configuration for every affected Coldcard model sets the macro MICROPY_HW_ENABLE_RNG to zero, because Coldcard provides its own separate hardware RNG wrapper. Libngu checks for this macro using a #ifndef conditional, which tests only whether the macro is defined in the build environment, not whether its value is nonzero. Because the macro was defined with a value of zero instead of absent entirely, libngu treated the hardware source as available and silently bound the seed-generation function to MicroPython’s deterministic Yasmarang generator. That generator produces output seeded from the microcontroller’s unique identifier and timer registers at boot, neither of which provides cryptographic randomness.

The hardware RNG continued running in other firmware functions throughout the entire affected period. Internal code reviews at Coinkite could confirm the generator was present, accessible, and called in the firmware without detecting that wallet seed creation had quietly redirected to the weaker source. Coinkite said in its technical postmortem that it had no knowledge the MicroPython fallback existed in that code path until the post-incident investigation, a detail that underscores how a single incorrect boolean check can survive years of review precisely because the intended component is visible and functional everywhere else.

Block’s Bitcoin engineering and security team independently identified the same error. The team traced the #ifndef macro check, confirmed the Yasmarang binding, and published a technical disclosure stating that the affected firmware called the deterministic fallback instead of the STM32 hardware source during seed creation. Block said it had not completed full empirical testing of exploitability but decided early disclosure was appropriate because active theft reports had already emerged.

The impact on entropy differed by device. Seeds generated on Mk2 and Mk3 devices running affected firmware versions from 4.0.0 through 4.1.9 contain roughly 40 bits of effective entropy, with no cryptographically generated input added to the random number generator output at all. Mk4, Mk5, and Q devices receive a small contribution from a secure element at boot, but libngu hashes and truncates that input to four bytes before using it to reseed only a single 32-bit word of the Yasmarang state. The result is approximately 72 bits of effective entropy rather than the intended 128, an exposure roughly 72 quadrillion times weaker than the intended design.

Advertisement

How attackers reconstructed wallets without physical access

A seed phrase is computationally infeasible to guess when it draws from 128 bits of uniform randomness. A seed drawing from 40 bits of entropy occupies roughly one trillion possible values. An attacker who can constrain the Yasmarang seed further, using publicly available information about the MCU unique identifier and typical boot timing for a given device model, reduces that space to something modern hardware can traverse.

Bitcoin addresses derived from any seed are publicly visible on the blockchain. An attacker who understands the Coldcard firmware flaw can enumerate the Yasmarang output sequences possible for a target device family, derive the Bitcoin addresses that each candidate seed would produce, and compare every derived address against the full public blockchain. Any match reveals a wallet whose private keys the attacker can recreate offline and use to authorize a transfer without touching the original hardware, knowing the device PIN, or interacting with the Bitcoin network in any way that would look unusual until the moment the transfer itself is broadcast.

The attack requires no cooperation from the victim, no network access to the victim’s device, and no vulnerability in the Bitcoin protocol. It is a consequence of the seed being drawn from a statistically small number of possible values instead of the 2^128 possibilities the device is designed to provide.

Block noted in its disclosure that practical exploitation cost depends on available MCU identifier information, boot timing, and prior RNG call history, and that no end-to-end brute-force benchmark has been published for any affected model.

Advertisement

Four attack waves and a $130 million toll

Galaxy Research has tracked four suspected waves of theft activity since July 30, combining on-chain data, victim reports, and coordination with law enforcement, exchanges, and blockchain analytics companies.

The first wave struck July 30 and removed 1,082.65 BTC from 1,196 addresses over approximately 41 minutes. Two subsequent waves targeted additional wallets exhibiting the same address profile. Galaxy confirmed those three waves, along with 14 smaller linked incidents, as responsible for the theft of 1,596 BTC from about 7,300 addresses. Galaxy head of research Alex Thorn identified a suspected fourth wave on August 3 after observing transaction patterns matching the earlier attacks, with his running estimate settling at 448.7 BTC moved from 709 additional addresses. The sweep rate during the most active period reached 13.8 wallet drains per Bitcoin block, compared with a baseline of 0.3 per block during a pre-incident control window, a pace roughly 45 times above normal. Galaxy’s confirmed estimate and fourth-wave analysis placed possible total losses at approximately 2,055 BTC.

Advertisement

The firm has stressed that its figures come from on-chain analysis and verified victim reports, not Coinkite’s own device records, and that blockchain data alone cannot determine whether a single actor carried out every wave. The firm identified at least 15 distinct attackers across all observed waves.

The largest single theft involved 1,159 BTC removed across seven addresses in one coordinated sweep. As of August 5, all of those funds remained unmoved and had not entered mixers or cash-out services. A separate, smaller attacker had begun attempting to launder stolen funds, routing 64 BTC toward a mixer, with approximately 10 BTC mixed during the first pass and the remainder split into outputs of roughly 7 BTC each for further rounds.

Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses. Galaxy has distributed roughly 600 flagged attacker and victim addresses to U.S. federal law enforcement and exchanges to support monitoring. Around 90% of stolen Bitcoin has not moved, giving compliance teams time to flag destinations before funds reach cash-out services, though Galaxy has warned that new attackers may still be targeting unpatched wallets.

Why the flaw survived five years of review

Advertisement

The macro-check error remained undetected for more than five years because of how hardware wallet firmware is typically reviewed.

Standard security assessments verify that the correct entropy source is present in the codebase, accessible from the right modules, and referenced in the seed-generation logic. Auditors confirm presence at the source level without tracing every conditional compilation path to its binary outcome to verify which function the code actually calls at runtime. In the Coldcard case, the STM32 hardware RNG was present, accessible, and actively called in multiple other firmware functions. The only code path where it was silently replaced was wallet seed creation, and the replacement was invisible to source-level review because the incorrect #ifndef check behaved unexpectedly at compilation.

Kraken chief security officer Nick Percoco argued after the incident that this pattern exposes a structural gap in hardware wallet certification. Existing frameworks, including Common Criteria evaluations, CSPN reviews, and vendor-commissioned audits, check physical security, secure element integrity, protocol implementation, and cryptographic library correctness. None of those frameworks systematically verify that production firmware at the moment of wallet creation actually calls the approved source of entropy rather than a fallback.

“Production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used,” Percoco said.

Advertisement

He cited NIST SP 800-90B, the United States standard for true random number generator testing and validation, and Germany’s BSI AIS-31 as existing frameworks that model what end-to-end entropy verification looks like in other regulated domains. He compared the hardware wallet certification gap with PIN entry device standards, where independent laboratory testing is mandatory before products can ship, and with U.S. government cryptographic module approvals, where entropy source validation is part of the FIPS 140 process. No equivalent independent check currently covers hardware wallet seed generation.

AI-driven audits surface a wider pattern

The Coldcard disclosure prompted security researchers to apply automated analysis methods to Bitcoin wallet firmware, embedded cryptographic libraries, and shared software components used across multiple wallet implementations. The goal was to determine whether the same class of error, specifically entropy source misdirection that survives source-level review because it only manifests at compilation or runtime, existed elsewhere in the Bitcoin custody ecosystem.

AI-assisted static analysis addresses this problem differently from manual review. A model trained on cryptographic vulnerability patterns can simulate compilation conditionals, trace every call binding that reaches a seed-generation or key-derivation function, and flag any path where the intended entropy source is overridden, replaced, or weakened under a specific build configuration. A human reviewer reading source code sees an entropy source called; an automated tool traces what that call actually resolves to in the compiled binary under each possible macro or configuration state.

Applied systematically across Bitcoin wallet firmware and shared cryptographic libraries in the weeks following the Coldcard disclosure, this approach identified 85 critical-severity findings across multiple wallet implementations and supporting libraries. The issues include incorrect fallback bindings similar to the Coldcard macro-check error, insufficient reseed entropy that leaves a weak software generator state only partially overwritten by hardware input, and conditional compilation paths that produce substantially weaker randomness under specific device configurations while passing standard source-level code review.

Advertisement

Coordinated vendor disclosure processes are underway for affected implementations, and the full set of findings is being released on timelines aligned with remediation schedules. Not all 85 findings have been made public as of August 7, 2026. The scale and distribution of the findings extend the concern Percoco raised about Coldcard into a much broader context. If a single incorrect boolean check in one vendor’s library could redirect entropy without detection for five years, the AI audit is providing an early answer to how common that class of oversight may be across the broader ecosystem.

Coinkite’s response and what remains unresolved

Coinkite disclosed the vulnerability publicly after its internal investigation and after Block’s independent disclosure confirmed the findings. The company released corrected firmware for every affected model: version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for the Q model, and Edge versions 6.6.0X and 6.6.0QX for Mk4 and Q respectively on the Edge release track.

Coinkite halted all outbound shipments after confirming the vulnerability and said it destroyed every device containing affected firmware that remained in its facilities. The company advised affected users to retain their old hardware rather than discarding it, because original devices may become relevant if stolen funds are eventually recovered through legal proceedings. Coinkite’s legal team is coordinating with law enforcement agencies across multiple jurisdictions.

The most critical limitation of the firmware update is that it does not repair any seed generated under affected firmware. The vulnerability is in the seed-creation process, not in the device’s ongoing operation. A new seed generated on corrected firmware is safe. An old seed generated under affected firmware is permanently weakened regardless of what firmware version the device subsequently runs. Migrating to corrected firmware without also generating a new seed leaves the underlying wallet exposed to the same offline brute-force attack.

Advertisement

Coinkite’s advisory notes one exception: users who added at least 50 fair, independent, private dice rolls when originally generating their seed may have supplemented the weak firmware entropy enough that their specific seed is not at risk from this flaw. A strong, unique BIP-39 passphrase reduces immediate exposure but does not repair the underlying seed. Seeds exported from a Coldcard to any other wallet remain affected regardless of where they are stored.

The custody debate the hack reignited

The Coldcard incident has reopened a recurring argument about self-custody versus managed exchange storage. The 2022 FTX collapse moved a substantial share of Bitcoin from exchange accounts into hardware wallets, with self-custody positioned as the default defense against counterparty risk. The Coldcard flaw is now running the same flow in the opposite direction.

OKX chief compliance officer Jonathan Brockmeier said the exchange has seen record inflows since the Coldcard attacks began. He described the shift as “the flip side of FTX.” OKX reported preventing $26.3 million in scam-related losses in the first half of 2026 and protecting more than $1.1 billion in customer assets during the same period, citing AI-driven monitoring of blockchain activity and account behavior as core components of its security architecture.

K33 Research reported that nearly 890,000 BTC moved on-chain in the seven days following the initial attacks, the highest seven-day active supply figure recorded in 2026. Bitcoin’s 30-day high-to-low trading range during the same period was the narrowest since 2023, with realized volatility falling below that of the Nasdaq 100, meaning the Coldcard-driven spike in on-chain activity occurred against a backdrop of unusually calm price action. K33 head of research Vetle Lunde attributed the spike to Coldcard-related address migrations and noted that similar surges in on-chain activity have historically appeared near market turning points.

Advertisement

Ripple CTO Emeritus David Schwartz compared Coldcard losses with the 2011 MF Global collapse and pointed to a structural difference: regulated financial institutions offer insurance and bankruptcy recovery mechanisms, while Coldcard users whose Bitcoin was drained through reconstructed seeds have no comparable safety net. Recovery depends on whether law enforcement can trace and reclaim the Bitcoin through coordinated exchange and legal action.

What to watch

New attack waves. Galaxy has warned that additional attackers may still target unpatched wallets. Sweep rates above 1.0 wallet drain per Bitcoin block should be treated as a signal of active exploitation.

Mixing and laundering acceleration. A separate attacker had begun mixing 64 BTC as of August 5. Movement from the larger 1,159 BTC cluster toward mixers or cross-chain services will narrow the investigative window significantly.

Fourth-wave confirmation. Galaxy has not yet confirmed 448.7 BTC in a suspected fourth wave. Victim reports validating those losses would push the confirmed total to approximately 2,055 BTC and expand regulatory coordination.

Advertisement

Hardware wallet certification reform. Percoco’s call for mandatory independent entropy testing now has a documented failure to anchor it. Watch for proposals from NIST, BSI, or hardware wallet industry bodies to incorporate end-to-end RNG validation into certification.

Coordinated AI audit disclosures. Vendors are remediating the 85 critical findings on rolling timelines. Each public disclosure will clarify which wallet implementations beyond Coldcard carry entropy handling weaknesses.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. All information is provided as general context and should not be relied upon as the basis for any investment or custody decision. Cryptocurrency assets carry significant risk, including total loss of principal. Readers should verify all information independently and consult qualified professional advisors before taking action based on the contents of this article. August 7, 2026.

Advertisement

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

XRP price falls 2% as CLARITY Act vote slips to September

Published

on

XRP price chart, source: crypto.news

XRP traded near $1.03 on Aug. 7 as selling pressure kept the token among the weaker large-cap cryptocurrencies ahead of fresh U.S. labor data.

Summary

  • XRP traded near $1.03, down about 2.2% as selling pressure persisted across major exchanges today.
  • Binance XRP open interest rose roughly 8% while perpetual CVD moved deeper into negative territory.
  • Spot CVD fell more than 52%, showing a sharp decline in aggressive centralized exchange buying.
  • Whales accounted for 81% of Binance XRP outflows, versus 72% across centralized exchanges overall globally.
  • Senators return September 14, while July employment data arrives August 7 before inflation data Wednesday.

According to crypto.news market data, XRP dropped about 2.2% over 24 hours, compared with smaller moves in Bitcoin and Ether, while its market capitalization remained near $64.2 billion.

crypto.news showed XRP down 5.7% over seven days and 6.7% over 30 days. Trading volume was approximately $1.44 billion, with circulating supply near 62.53 billion tokens.

Advertisement

The decline came as the U.S. Senate pushed consideration of the CLARITY Act beyond its August recess. Senate Majority Leader John Thune said the bill would be queued when lawmakers return in September. The delay removes an expected near-term regulatory catalyst, although XRP’s price move cannot be attributed to legislation alone.

XRP price tests $1 support as momentum stays weak

XRP traded between roughly $1.01 and $1.06 over the previous 24 hours, leaving the psychological $1 level as immediate support. The daily chart remains broadly bearish after a prolonged decline from above $2.50, while a recovery above $1.10 to $1.15 would be needed to improve the short-term structure.

The Aroon Oscillator at -100 shows recent lows dominating recent highs. BBTrend was also negative near -1.36, reinforcing the bearish bias, although its smaller negative bars suggest downside momentum is less intense than during earlier selloffs. On the weekly chart, Stochastic RSI readings near 42.6 and 44.7 remain neutral rather than oversold.

Advertisement
XRP price chart, source: crypto.news
XRP price chart, source: crypto.news

A widely circulated projection from CryptoBull suggested XRP could reach “$27 by the end of October 2026.” That target remains highly speculative. The weekly ascending-channel projection also points toward $7 before $27, but neither level is confirmed without a sustained breakout above long-term resistance and stronger volume.

Derivatives data shows traders leaning toward shorts

CryptoQuant analyst Amr Taha reported that Binance XRP open interest rose from about $180 million on Aug. 4 to $195 million on Aug. 7, an increase of roughly 8%. Over the same period, perpetual cumulative volume delta fell from approximately negative $292 million to negative $363 million.

Source: CryptoQuant analyst Amr Taha
Source: CryptoQuant analyst Amr Taha

That combination is consistent with fresh leveraged sell-side positioning, although open interest alone cannot determine the direction of every new position. Spot demand also weakened. Taha said estimated spot CVD across centralized exchanges fell more than 52%, from around $235 million to $112 million, indicating a sharp loss of aggressive buying momentum.

Separate CryptoQuant data showed whales accounted for 81% of Binance XRP outflows on Aug. 3, versus 72% across centralized exchanges overall. The metric measures the share of outflow activity, not absolute withdrawal volume or whether transferred tokens were ultimately accumulated, sold or moved into custody.

CLARITY Act delay removes an August catalyst

The Senate’s decision to postpone the market-structure vote matters to XRP because the bill could provide statutory rules for determining when digital assets fall under SEC or CFTC oversight. In earlier regulatory analysis, the legislation was identified as especially relevant to XRP after years of litigation over its regulatory treatment.

The bill faces a procedural hurdle before final passage. Republicans hold 53 Senate seats, but leadership generally needs 60 votes to invoke cloture and overcome a filibuster. As previous Senate vote coverage explained, Democratic support has therefore remained central to the legislation’s path.

Advertisement

The official Senate calendar lists Aug. 10 through Sept. 11 as a state work period, meaning senators are scheduled to return Sept. 14. Ethics provisions, law-enforcement concerns and other market-structure disputes remain unresolved, leaving any September vote dependent on further negotiations.

U.S. jobs and inflation data add another risk

Macro conditions could influence XRP before lawmakers return. The Federal Reserve held its target range at 3.50% to 3.75% on July 29 in a 9-3 vote. Beth Hammack, Neel Kashkari and Lorie Logan dissented because they preferred a 25-basis-point increase.

The timing makes macro data relevant because XRP is trading near support while leverage rebuilds. Still, economic releases can move crypto in either direction, and no report guarantees a specific response.

The next immediate test is the July employment report, scheduled by the BLS for Aug. 7 at 8:30 a.m. ET. July CPI follows on Aug. 12. Strong employment or persistent inflation could reinforce expectations for restrictive policy, while softer readings could reduce rate pressure across risk assets.

Advertisement

For XRP, $1 remains the near-term technical level to watch. A break below it would weaken the current structure, while recovery through $1.10 to $1.15 would provide the first clearer sign of stabilization. Derivatives positioning, spot demand and September’s CLARITY negotiations remain additional variables rather than guaranteed directional catalysts.

Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.

Advertisement

Source link

Continue Reading

Crypto World

Microsoft flags ClickFix malware using BNB Chain to fetch attack instructions

Published

on

Ripple-backed OUSD launch hit by fake issuer scam on XRP Ledger

Microsoft has warned of ClickFix attacks using BNB Chain smart contracts to infect thousands of devices every day.

Summary

  • Microsoft said ClickFix attacks are using BNB Chain smart contracts to deliver malware instructions.
  • Fake CAPTCHA pages trick users into running attacker supplied commands on Windows devices.
  • The campaign targets thousands of enterprise and consumer devices worldwide every day.
  • Microsoft warned successful attacks can expose credentials and lead to ransomware deployment.

According to Microsoft Threat Intelligence, a cluster of compromised websites has been using ClickFix lures together with the EtherHiding technique to deliver malware, with campaigns targeting thousands of enterprise and consumer devices worldwide each day.

The security team said attackers inject Base64-encoded JavaScript into compromised websites. Instead of retrieving payload instructions from a traditional server, the script connects to a BNB Smart Chain RPC gateway and queries a smart contract previously linked to the ClearFake campaign.

Because only the owner of the cryptocurrency wallet that deployed the contract can modify its contents, the instructions remain difficult to remove using conventional takedown or sinkholing methods.

Microsoft said victims are shown a fake CAPTCHA asking them to verify they are human. Instead of completing a normal verification step, users are instructed to open the Windows Run dialog, paste clipboard content, and press Enter, executing an attacker-controlled command on their own systems.

Advertisement

ClickFix campaign has used blockchain to deliver attack instructions

While the fake CAPTCHA acts as the lure, the report said attackers rely on several command obfuscation methods to avoid detection after execution. Microsoft observed the abuse of Windows tools including conhost, cmd, PowerShell, pcalua, mshta, rundll32, msiexec, curl, WMI, WebDAV, and scheduled tasks.

Researchers also identified multiple techniques designed to hide malicious commands. Caret characters split keywords, environment variables conceal interpreters, and Windows processes run in minimized or headless mode to reduce visibility during execution.

Alongside ClickFix, Microsoft said attackers are also deploying TerminalFix lures. Rather than directing victims to the Windows Run dialog, TerminalFix instructs users to paste commands into Windows Terminal or PowerShell, using the same social engineering method to trigger the attack.

Advertisement

The report described ClickFix and TerminalFix as high-volume initial access techniques. Microsoft said it is tracking campaigns targeting thousands of enterprise and consumer devices globally every day, while some malvertising chains also redirect users to scam pages before the malicious instructions are delivered.

Malware can lead to credential theft and ransomware attacks

According to the report, numerous threat actors have adopted the technique to distribute several malware families after gaining initial access. Microsoft identified Lumma Stealer and other information stealers, Xworm and AsyncRAT remote access trojans, MintsLoader, and remote management tools among the payloads delivered through ClickFix campaigns.

Researchers warned that a single successful execution can expose credentials, establish persistence on infected systems, enable lateral movement across networks, and create a path for human-operated ransomware attacks and possible domain compromise.

To reduce the risk, Microsoft recommended enabling Microsoft Defender network, web, and cloud-delivered protection, restricting access to the Windows Run dialog and other command-line tools where they are not required, enabling PowerShell script-block logging, and enforcing application control policies.

Advertisement

The company also advised users not to paste commands from fake CAPTCHAs, browser error pages, advertisements, unsolicited support pages, or emails into Windows Run, Terminal, PowerShell, or Command Prompt because attackers increasingly rely on convincing users to execute malicious commands themselves.

Defender detections target ClickFix activity

Microsoft said Microsoft Defender XDR provides layered protection across different stages of the attack chain. According to the company, Defender SmartScreen and Defender for Office 365 can help block malicious websites, phishing links, infected attachments, and fake CAPTCHA pages before users interact with them.

The security platform also detects suspicious command execution and outbound connections using alerts including “Suspicious command in RunMRU registry,” “Possible ClickFix activity,” and “Possible initial access from an emerging threat.”

Meanwhile, Microsoft Defender Antivirus identifies malicious command execution under detections such as Trojan:Win32/ClickFix.* and Trojan:Win32/TermFix.*. The company said organizations should treat these detections as possible indicators of an initial access incident, isolate affected devices, investigate potential credential theft and persistence mechanisms, and search for related activity across their environments.

Advertisement

Previous Microsoft warning highlighted crypto-focused malware

The latest findings follow another Microsoft Threat Intelligence report published in June that described a Windows-based CryptoBandits clipper campaign active since February 2026.

According to the report, the malware spread through malicious .lnk shortcut files, monitored the clipboard every 500 milliseconds for cryptocurrency wallet addresses, seed phrases, and private keys, and replaced copied wallet addresses with attacker-controlled ones. 

Researchers also found the malware routing communications through the Tor network, creating scheduled tasks for persistence, capturing screenshots, and executing attacker-supplied code, effectively giving operators lightweight backdoor access.

Microsoft said at the time that defenders should investigate combinations of suspicious behavior rather than isolated events, particularly when script engines launched tools such as curl, cmd.exe, or PowerShell alongside Tor-related traffic.

Advertisement

The previous warning came as crypto-related malware campaigns continued to evolve. As previously reported by crypto.news, StilachiRAT targeted browser-based cryptocurrency wallets and monitored clipboard activity, while SparkCat searched screenshots for wallet seed phrases using image scanning. Binance also warned users about clipper malware designed to replace copied cryptocurrency wallet addresses with attacker-controlled alternatives.

Source link

Advertisement
Continue Reading

Crypto World

Bitcoin Bear Market Over? Top Analysts Turn Bullish, but History Says Otherwise

Published

on

Ever since bitcoin started plunging real hard at the start of the new year and dumped to and eventually below $60,000, analysts have been focused on trying to determine where the bottom is. As usual, they are split into two camps: two who believe another crash is coming, and the optimists indicating that the worst is behind us.

Crypto X, though, was a little surprised on Friday when three analysts showed an interesting and unexpected convergence, with Ali Martinez, Michaël van de Poppe, and Merlijn The Trader posting opinions that essentially determined BTC is about to break out.

Analysts Turn Bullish

Martinez emerged as arguably the most bullish, highlighting several factors that have aligned for his major breakout call. He noted that improving on-chain data and technical indicators suggest that BTC has likely established a local bottom. He added that selling pressure has faded, while long-term accumulation continues. The combination creates favorable conditions that have historically preceded meaningful upside moves.

The analyst explained that the TD Sequential flashed a major buy signal on BTC’s monthly chart in July, which is a rare signal that successfully identified the last market bottom in 2022.

Advertisement

Van de Poppe echoed the statement, reaching a similar conclusion from a macro perspective. He argued that BTC’s decline toward $60,000 resembles previous bull-market corrections, which often shook out leveraged traders before the broader uptrend resumed.

In his view, similar moves were a healthy reset rather than the deepening of a bear market, with liquidity returning and buyers gradually stepping back in. Merlijn The Trader, on the other hand, commented that the cryptocurrency has completed a classic breakdown-and-reclaim pattern that frequently marks the end of corrections.

Too Good to Be True?

The scenario above sounds appealing, right? But there’s also the other side of the coin, and BTC’s history suggests investors should remain cautious whenever the market speaks with such firm conviction. One of the asset’s defining characteristics over the past decade has been its tendency to inflict maximum pain on the majority. It has moved time and time again precisely in the opposite direction of prevailing expectations.

Advertisement

Some of the most significant rallies came after market shocks: the run after the COVID-19 crash, the aftermath of the FTX collapse in late 2022, and so on. In contrast, it has slumped once the market has become too greedy and optimistic: recall the October 2025 crash and subsequent 55% correction.

Of course, this doesn’t necessarily mean that the aforementioned analyses are wrong. Many of the factors they named are objectively constructive and promising. However, markets rarely reward the obvious trade.

Don’t get us wrong – we remain BTC bulls. But we would also like to caution everyone who might go all in just because the sentiment among some top analysts has flipped.

The post Bitcoin Bear Market Over? Top Analysts Turn Bullish, but History Says Otherwise appeared first on CryptoPotato.

Advertisement

Source link

Continue Reading

Crypto World

IMF Says Domestic Stablecoins Could Lift Demand for Dollar Tokens

Published

on

Crypto Breaking News

Plans to issue stablecoins denominated in local currencies to reduce reliance on dollar-linked tokens may unintentionally make it easier to move value into “digital dollars,” according to a senior International Monetary Fund (IMF) official.

Speaking on Friday, IMF First Deputy Managing Director Dan Katz said that once local- and dollar-denominated stablecoins run on the same underlying blockchain infrastructure, users could swap between them through decentralized exchanges, liquidity pools, or peer-to-peer mechanisms.

Key takeaways

  • IMF First Deputy Managing Director Dan Katz warned that local-currency stablecoins could still funnel users into dollar stablecoins if both use the same blockchain rails.
  • Katz said cross-stablecoin interoperability could shift foreign-exchange activity away from traditional intermediaries like banks and currency dealers.
  • He suggested this dynamic could reduce friction in capital movement, affecting how authorities monitor and manage flows.
  • Katz noted adoption outcomes may differ by country, with local tokens potentially replacing dollar holdings in highly dollarized economies.
  • He urged regulators to enable compliant onramps, offramps, and onchain exchange points to manage risks.

How shared blockchain infrastructure could enable “digital dollar” access

Katz’s core point is about infrastructure. In his remarks—delivered in a speech at the University of Cape Town—he argued that if local-currency stablecoins and dollar-backed stablecoins are deployed on the same blockchain framework, the practical barriers to conversion could fall sharply.

That matters because, in decentralized finance environments, conversion does not require a single centralized issuer or intermediary to broker every transfer. Katz specifically referenced common DeFi routes: decentralized exchanges, liquidity pools, and peer-to-peer swaps. Under that model, users could move between token types directly, turning what begins as local-currency issuance into an easier path to dollar exposure.

Potential implications for FX monitoring and capital-flow tools

The IMF official linked interoperability to a broader policy concern: where foreign-exchange activity happens. Katz argued that moving FX-related activity away from banks and traditional currency dealers could reduce “friction” that authorities currently rely on to monitor and manage capital flows.

Advertisement

In other words, the issue is not only which stablecoin a user holds, but how quickly and through what channels they can reposition into a different currency exposure. If swaps become routine onchain, regulators may find it harder to observe the flow of currency demand through traditional institutional pathways.

At the same time, Katz framed the shift as potentially reinforcing the broader category of FX-focused stablecoins. He said that local-currency stablecoins “might even accelerate the adoption of FX stablecoins,” a statement that underscores the possibility that currency-linked token ecosystems could become more integrated over time rather than remaining siloed.

Adoption unevenness: South Africa as a case study

Katz pointed to South Africa to illustrate how adoption can diverge across token types. He said dollar-backed stablecoins have gained only limited traction there, while rand-linked tokens have attracted even less demand.

He cautioned that it is still too early to draw definitive lessons from any single country, but he offered an explanation for why users might still prefer dollar tokens. In his view, many participants may choose dollar stablecoins due to factors like liquidity, network effects, and cross-platform or cross-border acceptance.

Advertisement

Those characteristics can translate into more efficient trading and easier settlement—particularly in environments where the local currency faces volatility, lower market depth, or weaker confidence in local issuances. Even if a policy objective is to reduce dependence on the dollar, market structure and user preferences can pull activity back toward the most “usable” asset in practice.

Regulatory framing: country risk differences and compliant onchain rails

Katz said risks vary by country. He suggested that in highly dollarized economies, stablecoins may largely substitute for existing dollar holdings rather than creating incremental demand for dollars. But in countries where dollar access is restricted and the economic policy framework is weaker, stablecoins could instead increase foreign-currency demand.

This distinction is important for policymakers because it affects what “success” looks like. If stablecoins mainly repackage dollars already held domestically, the macro impact might differ from a scenario in which stablecoins provide a smoother mechanism to access additional dollar exposure.

To manage these trade-offs, Katz urged authorities to build regulatory frameworks around practical access points. Specifically, he called for authorities to bring onramps, offramps, and onchain exchange points within regulatory boundaries.

Advertisement

The policy takeaway is that banning activity is not the only route. Instead, the IMF official highlighted the need for rule-based access to onchain liquidity and conversion, so regulators can better understand flows and reduce the incentive for unregulated intermediaries.

Going forward, the key question for investors and builders is whether stablecoin issuers and blockchain platforms will prioritize interoperability across local- and dollar-denominated tokens—or isolate them through different infrastructure choices. Katz’s remarks imply that interoperability could materially change who ends up holding “digital dollars” and how quickly currency reshuffling occurs, so market participants should watch how regulators operationalize onramps, offramps, and onchain exchange controls in the jurisdictions most likely to experiment with local-currency stablecoin issuance.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Advertisement

Source link

Continue Reading

Crypto World

Bitcoin’s exploit week worsens as BTCPay flaw drains Lightning nodes

Published

on

Bitcoin’s exploit week worsens as BTCPay flaw drains Lightning nodes

Citadel21, the bitcoin publication run by pseudonymous commentator hodlonaut, also reported that its Lightning node had been swept, though it said little money was held there.

The vulnerability had already been reported to BTCPay by members of the Bitcoin Red Team — a group of developers that began pointing AI models at bitcoin codebases this week and has filed thousands of findings across hundreds of projects since.

Read More: Bitcoin developers flag 85 critical bugs in an “extremely bad” situation.

BTCPay credited Red Team members Craig Raw, Rob Hamilton, Calle and Evan Kaloudis with responsibly disclosing the issue and helping analyze it.

Advertisement

The group’s stated reason for publishing findings quickly was that people outside it would arrive at the same bugs, and by the time BTCPay’s public warning went out, attackers were already exploiting this one against live servers.

Meanwhile, BTCPay narrowed the scope after its initial alert, saying its standard on-chain wallets, including hot wallets generated inside BTCPay, are not affected by the credential flaw.

The exposure applies specifically to deployments using LND, and funds held inside LND’s own on-chain wallet can still be at risk because they sit under the compromised Lightning node.

BTCPay has not yet published technical details of the vulnerability, saying operators need time to patch. A full postmortem is due in the coming days.

Advertisement

Source link

Continue Reading

Crypto World

Wyoming reveals indirect HYPE exposure in second quarter 13F filing

Published

on

Wyoming reveals indirect HYPE exposure in second quarter 13F filing

Wyoming has disclosed an indirect investment in HYPE through Hyperliquid Strategies ($PURR) in its second-quarter 13F filing, adding another digital asset-linked position to the state’s crypto-related portfolio.

Summary

  • Wyoming disclosed indirect exposure to HYPE through Hyperliquid Strategies in its second quarter 13F filing.
  • The filing shows the state invested in Hyperliquid Strategies rather than purchasing HYPE tokens directly.
  • The disclosure adds to Wyoming’s growing blockchain initiatives, including its state backed FRNT stablecoin and digital asset policies.
  • Wyoming is set to host the Wyoming Blockchain Symposium later this month with senior policymakers and crypto industry leaders expected to attend.

According to Blockworks analyst Shaunda Devens, Wyoming’s second-quarter 13F filing shows the state gained indirect exposure to Hyperliquid’s HYPE token through an investment in Hyperliquid Strategies ($PURR). Devens shared the filing on X, describing it as Wyoming’s latest indirect crypto investment disclosed through its public securities holdings.

While the filing does not indicate that Wyoming purchased HYPE tokens directly, the disclosed position gives the state indirect exposure through Hyperliquid Strategies, a publicly traded vehicle linked to the Hyperliquid ecosystem. The filing also does not disclose any direct ownership of HYPE by the state itself.

Public pension funds, treasuries and other government entities routinely disclose their U.S. equity holdings through quarterly Form 13F filings. The latest disclosure places Wyoming among the public institutions with exposure to companies connected to the digital asset market rather than only traditional crypto-related stocks.

Wyoming’s HYPE exposure comes through Hyperliquid Strategies

Hyperliquid Strategies is the investment vehicle identified in the filing. By holding shares in the company, Wyoming receives indirect exposure to HYPE instead of holding the token on its balance sheet.

Devens’ post did not specify the size of the investment or when the position was established during the second quarter. The filing likewise does not state whether the investment forms part of a larger digital asset allocation strategy or a standalone portfolio holding.

Advertisement

Indirect exposure through listed securities has become a common route for institutional investors seeking participation in digital assets while remaining within existing investment frameworks. Such investments differ from purchasing cryptocurrencies directly because the underlying exposure is obtained through corporate securities.

Wyoming has continued expanding its blockchain strategy

The disclosure arrives as Wyoming continues to build one of the most active blockchain policy programs among U.S. states.

In January, Wyoming launched the Frontier Stable Token (FRNT), becoming the first U.S. state to issue a government-managed dollar-backed stablecoin. The token debuted on Solana before expanding to Ethereum, Arbitrum, Base, Optimism, Polygon and Avalanche through cross-chain infrastructure. State officials said the reserves are managed by Franklin Templeton, held in a Wyoming-chartered trust and backed by U.S. dollars together with short-term Treasury securities.

Advertisement

Interest generated from those reserves is directed to Wyoming public schools, while the stablecoin was designed to reduce payment costs for state services and demonstrate blockchain-based settlement under public oversight. The project followed years of legislation that included legal recognition of decentralized autonomous organizations, the creation of Special Purpose Depository Institution charters and passage of the Stable Token Act.

Wyoming selected Solana after evaluating multiple blockchain networks before launch, while Kraken became the first Wyoming-domiciled exchange to offer the token for public purchase.

State policies have extended beyond digital assets

Alongside blockchain initiatives, Wyoming has also moved to attract computing infrastructure tied to artificial intelligence.

Governor Mark Gordon signed Executive Order 2026-03, titled “Data Centers the Wyoming Way,” in June. The order instructs state agencies involved in permitting and supporting large data center developments to consider electricity demand, water usage, environmental factors, workforce planning and the effect on residential power prices while reviewing projects.

Advertisement

The executive order followed rising investment in AI infrastructure across the United States and also intersects with Wyoming’s established Bitcoin mining industry, where companies have increasingly explored artificial intelligence and high-performance computing alongside cryptocurrency mining.

Several publicly traded miners, including IREN, MARA Holdings, Cipher Digital, Hut 8, HIVE Digital and TeraWulf, have announced or evaluated AI and high-performance computing businesses as they diversify revenue following the 2024 Bitcoin halving.

Wyoming remains active in crypto policy discussions

The state’s investment disclosure also comes shortly before the Wyoming Blockchain Symposium, scheduled for Aug. 17-20 in Jackson Hole.

As previously reported by crypto.news, Ripple CEO Brad Garlinghouse will join the speaker lineup alongside policymakers including SEC Chair Paul Atkins, Sen. Cynthia Lummis, House Majority Whip Tom Emmer, Sen. Ruben Gallego and Comptroller of the Currency Jonathan Gould.

Advertisement

Industry participants expected at the event include Galaxy founder Michael Novogratz, Cardano founder Charles Hoskinson, Stellar Development Foundation CEO Denelle Dixon and Custodia Bank founder Caitlin Long.

Organizers have identified U.S. crypto regulation, Bitcoin, digital asset investment strategies, decentralized artificial intelligence and financial market structure among the planned discussion topics. Ripple also maintains academic ties with the University of Wyoming through the Ripple Blockchain Collaboratory and renewed funding under its University Blockchain Research Initiative.

Advertisement

Source link

Continue Reading

Crypto World

Ripple CLO says 67M Americans defy crypto stereotype

Published

on

Ripple CLO challenges crypto stereotypes, source: X

Ripple Chief Legal Officer Stuart Alderoty pushed back on the idea that cryptocurrency remains a niche dominated by young men, pointing to survey data showing 67 million Americans now hold digital assets. 

Summary

  • Alderoty says 67 million American crypto holders show digital assets have moved beyond niche stereotypes.
  • NCA research found 42% of recent crypto purchasers were women, compared with 34% earlier adopters.
  • 28% of recent holders were 55 or older, versus 18% aged between eighteen and twenty-four.
  • The Senate delayed its CLARITY Act floor vote until September as bipartisan negotiations remain unresolved.
  • Ripple funded the National Cryptocurrency Association with $50 million, while Alderoty serves as its president.

His Aug. 7 comments responded to a Wall Street Journal editorial that referred to supporters of crypto regulation as “the crypto boys.”

Alderoty argued that the label mischaracterizes a group of users. He cited Americans working in education, construction, health care and small business. His argument comes as Washington debates the CLARITY Act, giving the demographic question a dimension rather than leaving it as a dispute over industry image.

Advertisement
Ripple CLO challenges crypto stereotypes, source: X
Ripple CLO challenges crypto stereotypes, source: X

Survey data supports a broader crypto demographic

The 67 million estimate comes from the National Cryptocurrency Association’s 2026 State of Crypto Holders report, conducted with The Harris Poll. The research surveyed 10,000 U.S. crypto holders between Feb. 12 and March 3 and reported that roughly one in four American adults owns cryptocurrency, up from one in five a year earlier.

The demographic findings are nuanced than the shorthand used in Alderoty’s post. Among people who first bought crypto in 2025 or 2026, 42% identified as women, compared with 34% among earlier adopters. Meanwhile, 28% of recent purchasers were 55 or older, versus 18% who were between 18 and 24. The report found more than half of holders had household income below $150,000.

Those figures support Alderoty’s claim that crypto ownership is not confined to one age, gender or profession. However, the report measures people who already hold crypto, and its findings should not be treated as evidence that public opinion toward the industry is equally broad or favorable.

Ripple has a stake in the adoption debate

Alderoty occupies two roles relevant to the argument. He is Ripple’s chief legal officer and president of the National Cryptocurrency Association. The group launched in March 2025 with a $50 million grant from Ripple and says its mission is to improve crypto education and public understanding across the United States, as detailed in earlier coverage.

Advertisement

That relationship provides context for the survey’s use in Washington. The NCA says the 2026 study was conducted with The Harris Poll and carries a 95% confidence level with sampling precision of plus or minus 0.7 percentage points for the surveyed population. Still, the organization is backed by a major crypto company that has advocated for clearer federal rules.

As previously reported, Alderoty made a similar argument in July, saying 67 million holders meant Washington could no longer treat crypto users as a fringe constituency. Ripple has also joined an industry campaign urging Senate leaders to advance the CLARITY Act after months of negotiations.

CLARITY Act fight moves from demographics to policy

The legislation would create a federal digital-asset market structure and clarify how oversight is divided between the Securities and Exchange Commission and Commodity Futures Trading Commission. The Senate Banking Committee advanced the measure 15-9 in May, with two Democrats joining Republicans. Updated merged text was released July 22.

Yet support has become harder to secure. Democratic lawmakers have sought stronger ethics, consumer protection, illicit-finance and market-integrity provisions. Senate Banking Committee Democrats have separately argued in an advisory that parts of the proposal could leave national-security vulnerabilities. Those criticisms remain disputed by Republican sponsors and crypto industry supporters.

Advertisement

The Wall Street Journal editorial that prompted Alderoty’s response also questioned stablecoin reward provisions and exemptions involving decentralized networks. Blockchain Association CEO Ji Kim rejected parts of that criticism as containing “factual and legal inaccuracies.” The competing arguments show that ownership numbers do not resolve disagreements about how the industry should be regulated.

September becomes the next test for crypto legislation

The political timetable tightened on Aug. 6, when Senate Majority Leader John Thune confirmed that a pre-recess CLARITY Act vote would not happen. He said the measure would be queued when lawmakers return in September, while blaming Democratic resistance for the delay.

That postponement matters because the legislation generally needs 60 votes to invoke cloture and overcome a filibuster before final passage can become realistic. Republicans cannot reach that threshold alone, making Democratic support necessary unless the procedural landscape changes. Ethics provisions and other unresolved sections will therefore remain central during the recess.

For Ripple and Alderoty, the 67 million figure strengthens an advocacy argument that lawmakers are regulating a large and varied constituency. It does not prove that those holders share Ripple’s preferred policy approach. The next test will come in September, when senators must decide whether negotiations have produced enough bipartisan support to move the CLARITY Act toward a floor vote.

Advertisement

Source link

Continue Reading

Crypto World

Scaramucci says crypto adoption will become invisible

Published

on

Scaramucci says crypto adoption will become invisible

SkyBridge Capital founder Anthony Scaramucci said on Aug. 7 that crypto adoption may reach its most important stage when consumers use blockchain infrastructure without knowing it is there. 

Summary

  • Scaramucci says mainstream users will soon use crypto and blockchain technology without recognizing underlying infrastructure.
  • Adjusted stablecoin transaction volume reached $10.2 trillion over twelve months, according to Visa-backed blockchain research.
  • Federal Reserve researchers identified accelerating retail stablecoin adoption through digital wallet partnerships as 2025 developments.
  • Tokenized stock transfers rose 105% monthly to $8.41 billion as blockchain-based equity infrastructure expanded rapidly.
  • Scaramucci previously backed the CLARITY Act, calling compromise preferable to continued U.S. regulatory uncertainty overall.

Responding to an X user who argued ordinary people would never use crypto, Scaramucci wrote that they “will soon use crypto/blockchain without even realizing it.”

The claim is a forecast, not evidence that mass adoption has already arrived. Still, current payment and tokenization data provide examples of the model he describes: blockchain increasingly operates behind familiar interfaces while users interact with cards, wallets, brokerages and payment applications rather than raw addresses, gas fees or network settings.

Advertisement

Stablecoins already show how invisible crypto could work

Stablecoins provide the clearest existing test. Visa research using adjusted blockchain data estimated $10.2 trillion in stablecoin transaction volume over the previous 12 months, after filtering activity such as bots and internal exchange movements. Visa said adjusted volume was up 63% year over year, showing that blockchain settlement has expanded beyond speculative trading.

The Federal Reserve has also documented the trend. In an April note, researchers said stablecoin market capitalization grew about 50% during 2025, while transaction volume and decentralized finance use increased. They identified accelerating retail adoption through digital wallet partnerships as one development reshaping the sector, while warning that broader use could create new financial stability risks.

As crypto.news reported in its stablecoin payment expansion, Visa, Mastercard, Stripe, PayPal and other established firms are adding blockchain settlement without requiring customers to understand the underlying rails. That model closely matches Scaramucci’s argument: users may choose a card, app or dollar balance while blockchain infrastructure handles settlement behind the interface.

Advertisement

Tokenized assets are moving toward familiar interfaces

Tokenization offers another example. Rather than asking consumers to learn decentralized finance first, platforms are increasingly placing blockchain representations of traditional securities inside products that resemble brokerage or wallet applications. Tokenized stock transfers rose 105% over one month to $8.41 billion in July, according to RWA.xyz data cited in related tokenization coverage.

The shift is also reaching traditional market infrastructure. The Depository Trust & Clearing Corporation has been testing tokenized securities, while crypto platforms have expanded access to tokenized equities and exchange traded funds. In tokenized equities coverage, products tied to familiar stocks increasingly appear alongside conventional digital assets, reducing the distinction visible to users.

Scaramucci ties adoption to simpler user experiences

Scaramucci’s position reflects a longstanding technology pattern: infrastructure becomes more widely useful when consumers no longer need to understand its mechanics. Internet users routinely rely on protocols, cloud services and encrypted connections without choosing technical standards for each interaction. He expects blockchain systems to follow a similar path.

That view does not mean every crypto product will disappear from view. Bitcoin, self-custody wallets and decentralized applications can still require users to interact directly with digital assets. Instead, the “invisible” thesis applies most clearly to services where blockchain functions as settlement, recordkeeping or transfer infrastructure beneath a conventional customer experience.

Advertisement

Scaramucci has also linked adoption to clearer U.S. rules. In July, he described the CLARITY Act as imperfect but “ten times better” than the regulatory status quo and urged stakeholders to accept compromise. The Senate has since delayed a floor vote until September, leaving broader market structure legislation unresolved.

Regulation could decide how quickly adoption disappears backstage

The U.S. already has one major piece of federal crypto legislation in place. The GENIUS Act, signed in July 2025, created a regulatory framework for payment stablecoins. Federal Reserve research notes that agencies are still implementing core rules, including reserve transparency, redemption rights and customer identification requirements for eligible issuers.

Those rules matter to Scaramucci’s thesis because invisible infrastructure still requires visible accountability. If consumers do not know which blockchain settles a payment, responsibility shifts toward issuers, wallets, exchanges, banks and payment companies to manage custody, fraud, disclosures and compliance correctly.

There is also a scale gap between crypto infrastructure and everyday consumer finance. Federal Reserve payments data show U.S. consumers and businesses made 236.6 billion noncash payments in 2024, with cards representing more than three quarters by number. Stablecoins are growing quickly, but much blockchain volume still reflects trading, treasury movements and settlement rather than retail purchases.

Advertisement

Source link

Continue Reading

Crypto World

Local Stablecoins Could Become Gateways to Digital Dollars: IMF

Published

on

Local Stablecoins Could Become Gateways to Digital Dollars: IMF

Domestic-currency stablecoins intended to curb reliance on dollar-backed tokens could instead make it easier for users to move funds into digital dollars, according to a senior International Monetary Fund (IMF) official.

On Friday, IMF First Deputy Managing Director Dan Katz said that once local and dollar stablecoins operate on the same blockchain infrastructure, users can convert between them through decentralized exchanges, liquidity pools or peer-to-peer swaps. 

In a speech at the University of Cape Town, Katz said the shift could move foreign exchange activity away from banks and currency dealers, reducing the friction that gives authorities tools to monitor and manage capital flows. 

“In this way, local-currency stablecoins might even accelerate the adoption of FX stablecoins,” he said.

Advertisement

Katz pointed to South Africa, where dollar-backed stablecoins have gained limited traction but rand-linked tokens have attracted even less demand. 

While it was too early to draw firm conclusions, he said many users may favor dollar tokens because of their liquidity, network effects and acceptance across platforms and borders. 

Katz said the risks vary by country. Stablecoins may largely replace existing dollar holdings in highly dollarized economies but could increase foreign-currency demand in countries where access to dollars is restricted and economic frameworks are weak. 

He urged authorities to bring onramps, offramps and onchain exchange points within regulatory frameworks. 

Advertisement

Related: Dollar stablecoins could improve FX access but amplify currency runs: IMF

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Source link

Continue Reading

Crypto World

Domestic stablecoins may lift demand for dollar-backed tokens

Published

on

Crypto Breaking News

Efforts to promote stablecoins pegged to local currencies in order to reduce dependence on dollar-backed tokens may end up doing something quite different: making it easier for users to switch into “digital dollars,” according to a senior International Monetary Fund (IMF) official.

In remarks delivered at the University of Cape Town, IMF First Deputy Managing Director Dan Katz said that if local- and dollar-denominated stablecoins are deployed on the same blockchain infrastructure, conversion between the two could become routine through decentralized exchanges, liquidity pools, or peer-to-peer swaps. The implication, he suggested, is that stablecoin design aimed at curbing dollar exposure could inadvertently improve access to FX stablecoins.

Key takeaways

  • IMF First Deputy Managing Director Dan Katz warned that local-coin stablecoins could also facilitate conversion into dollar-backed tokens if both run on shared blockchain infrastructure.
  • Once interoperability is built, Katz said users may be able to exchange between stablecoin types via decentralized exchanges, liquidity pools, or P2P swaps.
  • He argued that this could shift foreign-exchange activity away from traditional intermediaries such as banks and currency dealers.
  • Katz highlighted that outcomes are likely to differ by country, depending on dollarization levels, market access, and economic institutions.
  • He urged regulators to ensure onramps, offramps, and onchain exchange points are integrated within regulatory frameworks.

Why interoperability changes the stablecoin story

The IMF official’s central point is not merely about what stablecoins are pegged to, but about how easily they can be moved and swapped once they share technical rails. Katz argued that if local and dollar stablecoins “operate on the same blockchain infrastructure,” users would have multiple pathways to convert between them—effectively reducing the practical difference between holding a rand-linked or a dollar-linked token.

This matters because stablecoin adoption is often shaped by more than the peg. According to Katz, even when local-currency tokens are available, many users may still prefer dollar tokens due to factors like liquidity, network effects, and acceptance across platforms and borders. In other words, the attractiveness of dollar stablecoins may be structurally reinforced by where activity and market depth already exist.

When those advantages are paired with interoperability, the “local-currency” intention can be diluted: users may treat pegged tokens as interchangeable short cuts rather than as separate ecosystems.

Advertisement

Potential impact on FX markets and capital-flow monitoring

Katz also framed the issue from the perspective of how FX activity and capital flows are handled. He said that routing conversion and movement through decentralized venues could move foreign-exchange activity away from banks and currency dealers.

The policy consequence, in his view, is that the usual frictions—those gaps that authorities can sometimes leverage to observe, measure, and manage capital flows—may be reduced. If stablecoin trading and exchange become more direct and automated, regulators may find it harder to rely on the traditional chokepoints that exist in bank-led FX systems.

At the same time, Katz argued that the direction of travel could be consistent with broader adoption dynamics: “In this way, local-currency stablecoins might even accelerate the adoption of FX stablecoins.” That is a key tension running through his remarks—efforts meant to localize currency exposure could end up making FX stablecoins more accessible.

What the IMF official cited from South Africa

Katz pointed to South Africa as an example where dollar-backed stablecoins have seen limited traction, while rand-linked tokens have attracted even less demand. He noted that it was “too early” to draw firm conclusions, but the pattern underscores the possibility that local-pegged products have struggled to achieve the same pull as dollar-denominated alternatives.

Advertisement

For investors and market participants, the takeaway is straightforward: liquidity and ecosystem maturity can matter as much as the peg itself. If dollar stablecoins already circulate across a wider set of venues and users, interoperability could channel demand toward the assets that offer the easiest conversion and deepest markets.

Country-by-country risks: dollarization versus restricted access

While Katz did not present a one-size-fits-all forecast, he argued that the risks vary across countries. He suggested that stablecoins could largely replace existing dollar holdings in highly dollarized economies—meaning the shift would be more about substitution of what people already hold.

In contrast, he warned that in countries where access to dollars is restricted and economic frameworks are weaker, stablecoins could increase foreign-currency demand. In those settings, the accessibility gains from onchain conversion may become economically consequential, potentially shifting how households and businesses seek to hedge or transact.

That distinction is important for policymakers who might otherwise assume that “local-currency stablecoins” automatically reduce cross-border currency pressures. Katz’s framing implies that the broader macro effect depends on whether stablecoin adoption replaces existing behavior or changes the feasibility of accessing foreign currency in the first place.

Advertisement

Regulators may need onramps, offramps, and onchain exchange points

Rather than advocating for a simplistic approval or prohibition approach, Katz urged authorities to build regulatory coverage around the full stablecoin lifecycle—specifically onramps, offramps, and onchain exchange points. His comments imply that supervision cannot stop at issuing rules for pegged tokens; it also has to address where conversions happen and how users enter and exit stablecoin positions.

From a market-structure standpoint, this is a crucial policy challenge. If decentralized exchanges and liquidity pools become the primary route for swapping between stablecoin types, regulation that only targets centralized issuers may miss the most active venues for price discovery and asset conversion.

What to watch next is whether jurisdictions pursuing local-currency stablecoins also take interoperability and exchange routing seriously in their regulatory designs. If local and dollar stablecoins become technically unified, Katz’s warning suggests demand may flow toward the tokens with the deepest liquidity and widest acceptance—potentially changing both the mechanics of FX access and the practical tools available to monitor cross-border financial activity.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Advertisement

Source link

Continue Reading

Trending

Copyright © 2025