ARP Digital, an institutional digital asset infrastructure provider, has secured a broker-dealer license from Dubai’s Virtual Assets Regulatory Authority, allowing the Bahrain-based firm to offer regulated conversions between digital assets and the UAE dirham.

According to ARP Digital, the license covers United Arab Emirates-based corporates, capital markets participants and qualified investors, including conversions between stablecoins and dirhams. The company said it will also provide institutions with a regulated route to convert digital asset capital for deployment into local UAE assets.

The approval marks ARP Digital’s second regulated Gulf market. The firm is licensed by the Central Bank of Bahrain, where it says it has processed more than $3.5 billion in volume for over 450 institutional and corporate counterparties, with fourfold year-over-year growth in 2025.

ARP Digital offers institutional services including over-the-counter liquidity, cross-border settlement, fiat on- and off-ramps and wealth management.

The approval comes as Dubai continues to expand its regulated digital asset sector. In July, VARA issued its 50th virtual asset service provider license. The regulator, established in 2022, oversees the provision, use and exchange of virtual assets in and from Dubai.

Flowdesk, a crypto market maker backed by Coinbase Ventures and BlackRock, also received a full VARA broker-dealer license on Tuesday, allowing it to serve qualified and institutional investors in and from the emirate.

Magazine: Thailand’s 0% crypto tax. Bitcoin Red Team forced to use Chinese AI: Asia Express

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Closing the GRAS loophole

Although mainstream media covered insiders’ massive unlock of 911.5 million SpaceX shares worth $101 billion on August 6, very few people realize that an additional unlock on that date failed because SpaceX’s stock price had crashed so badly.

That second, bonus tranche of 455.8 million shares required SpaceX to close at or above $175.50 per share, i.e. 30% above the formal $135 IPO price, for at least five of 10 trading days leading into its August 4 earnings report.

SpaceX held nowhere close to that threshold in Nasdaq trading. The condition failed.

The market capitalization of SpaceX was only able to reach its momentary, $3 trillion peak because Elon Musk floated only a tiny quantity of shares in the IPO.

Artificially limiting supply far below demand for his popular company created a three-day surge from $150 to $225.64 per share. 

That was the peak. A swift retracement followed once investors started to prepare for insiders to unlock and sell their allocations.

SpaceX insiders fail to unlock 455.8 million shares

By the first unlock on August 6, SpaceX had declined 38% from its peak.

On that day, 911.5 million more shares came out of lockup. The supply increased by $101 billion of newly tradable stock, yet almost nobody asked why an additional tranche of 455.8 million shares stayed locked.

The answer, per SpaceX’s own prospectus, is that Musk’s stock crashed so badly.

Because the company failed to maintain a trading range at least 30% above the $135 IPO price within the 10 trading days prior to its inaugural earnings report, the bonus stayed locked.

It was nowhere close. Of all 10 closing prices within the trading window, zero cleared $175.50. The best of them, $125.33 on earnings day itself, missed the bar by an embarrassing 29%.

The earnings report wasn’t the problem. Revenue nearly doubled, and finance chief Bret Johnsen said “2026 has been a momentous year so far, and the second quarter demonstrated the true power of SpaceX.”

Read more: Some SpaceX bonds have already sunk to junk-like territory

Advertisement

Elon Musk blames short-sellers

Protos has chronicled the slide in SpaceX shares since last month, including analyst research coverage by its IPO-underwriting banks that invariably rated it “Buy.”

Despite their glowing, self-interested forecasts, the stock fell 53% from its June 16 peak to an all-time low of $104.83 by August 3.

Skeptical short-sellers had amassed a roughly $25 billion position by late July, about a third of the float. Enraged, Musk posted, “The survival probability of firms who maintain a significant short position in SpaceX over time is very low.” 

The stock printed its all-time low less than three weeks after Musk posted.

Advertisement

The survival probability of firms who maintain a significant short position in SpaceX over time is very low

— Elon Musk (@elonmusk) July 17, 2026

Musk had no stake in these particular deadline either way. His 6.4 billion shares remain locked until June 2027, and no performance trigger can release them early.

The market, for its part, shrugged off the unlock that did happen. SPCX climbed 3% by late morning on unlock day and ended the session up 6%. The next day, it added another 16%.

By Monday, it had closed back above its $135 IPO price for the first time since mid-July.

Advertisement

The rebound arrived four trading days after it could no longer help unlock insiders’ 455.8 million restricted shares. 

At $175.50 per share, this bonus tranche that never unlocked was worth about $80 billion — and now cannot be sold. Quite the missed payday.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

A crypto user has lost approximately 100,000 USDT after transferring the funds to a lookalike wallet address planted in the victim’s transaction history 66 days earlier.

Cyvers Alerts reported on Aug. 11 that its monitoring system detected the loss after the victim sent funds to an address controlled by an attacker.

🚨ALERT🚨Our system has detected an address poisoning attack resulting in a $100k solana:Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB

The scammer initially poisoned the victim’s wallet around 66 days ago, and today, the victim unknowingly sent funds to the scammer’s address.
To… pic.twitter.com/8CtOeJLfIn

Advertisement

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) August 11, 2026

How the $100K address poisoning attack unfolded

About 66 days before the theft, the attacker sent transactions involving the victim’s wallet, according to Cyvers. The activity placed a malicious address in the wallet’s transaction history, where it appeared similar to an address the victim had used for a normal transfer.

When the victim later prepared the 100,000 USDT payment, Cyvers said the user relied on the historical record without comparing the complete destination address. The funds consequently went to the lookalike address rather than the intended recipient.

Address poisoning does not require an attacker to obtain a private key, compromise a smart contract, or take control of the victim’s wallet. Instead, the method depends on the length and format of blockchain addresses, which many wallets and block explorers shorten by displaying only their first and last characters.

Attackers generate addresses that match the visible parts of a recipient’s genuine address and then use small or zero-value transfers to place the imitation in a target’s transaction record. A user who checks only the opening and closing characters can therefore select the attacker’s wallet even though the complete strings are different.

In the latest case, Cyvers attributed the loss to the victim’s failure to check the full address. The security company advised users not to treat transaction history as a trusted address book and recommended verifying every character before approving an on-chain payment.

Attacker converts stolen USDT into 52.8 ETH

Following the transfer, the attacker exchanged the stolen USDT for Ethereum, Cyvers reported. The receiving wallet held approximately 52.8 ETH when the security company published its alert.

Cyvers said the conversion appeared designed to reduce the risk that the stolen stablecoins could be frozen. USDT is issued by Tether through smart contracts that allow specific addresses to be blocked, while native ETH does not have an issuer with an equivalent freezing function.

The conversion also means the value of the attacker’s holdings can change with the ETH market price. Cyvers did not report any recovery, return agreement, or exchange intervention in its initial alert, nor did the company identify the victim publicly.

No evidence cited in the alert suggested that a flaw in Tether, Ethereum, or the victim’s wallet software caused the transfer. Cyvers instead described the incident as a social-engineering attack that used a forged address record to exploit the victim’s payment habits.

Address poisoning losses have reached millions

The $100,000 incident follows several larger cases involving the same method. In February, crypto.news previously reported that two users had lost a combined $62 million after copying fraudulent addresses from their transaction histories.

Scam Sniffer attributed about $50 million of that total to a December 2025 incident, while another victim lost approximately $12.25 million, or around 4,556 ETH at the time, in January 2026. The security company said attackers had quietly inserted lookalike addresses into both victims’ recent activity records.

During the December case, a stablecoin holder first sent a 50 USDT test payment to the correct destination. An attacker then inserted a fraudulent address into the history with a 0.005 USDT dust transaction, after which the victim mistakenly sent 49,999,950 USDT to the poisoned address.

The stolen assets were converted into ETH and spread across several wallets, according to an earlier report on the theft. The victim later offered the attacker a $1 million bounty for the return of the remaining funds and threatened to involve international law enforcement.

Low transaction costs have also made automated poisoning campaigns cheaper to operate. Scam Sniffer said in February that millions of dust transactions were being sent each day, with many created to prepare for possible future thefts rather than move funds between genuine users.

In March, a stablecoin user reported receiving 89 poisoning alerts within 30 minutes after completing only two legitimate transfers. Former Binance CEO Changpeng Zhao subsequently criticized transaction explorers that continued to display the malicious entries.

US lawmakers have proposed a crypto fraud task force

For U.S. users, address poisoning falls within a growing category of digital-asset fraud that lawmakers have sought to address through interagency coordination. Senators Elissa Slotkin and Jerry Moran introduced the bipartisan Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act, known as the SAFE Crypto Act, in 2025.

According to the bill’s sponsors, the proposed legislation would establish a federal task force focused on identifying, monitoring, and preventing cryptocurrency scams. Its members would include representatives from government agencies, law enforcement, digital-asset companies, stablecoin issuers, blockchain intelligence firms, and consumer-protection organizations.

The proposal covers several forms of crypto crime, including investment fraud, money laundering, Ponzi schemes, rug pulls, and fraudulent token sales. Sponsors said the task force would examine scam patterns and improve coordination between federal authorities and private-sector specialists.

The bill does not create a reimbursement program for users who mistakenly authorize irreversible transfers. As earlier coverage explained, its proposed task force would focus on detection, disruption and cooperation among agencies and industry participants.

Full address checks can expose poisoned records

Cyvers advised users to compare complete wallet addresses rather than relying on shortened records in transaction histories. For large transfers, security specialists also recommend confirming the destination through a separate communication channel and sending a small test amount before moving the remaining balance.

A test payment alone may not prevent a poisoning attack, as the December 2025 theft demonstrated. Because an attacker can insert a lookalike address immediately after the test, the sender must verify that the address used for the main transfer is identical to the one used for the test transaction.

Address whitelists can add another check by limiting withdrawals to destinations approved in advance. Hardware wallets can also display transaction details before signing, though users must still read and compare the destination shown on the device.

Wallet interfaces and blockchain explorers have started filtering suspicious entries, but the protections vary by platform. A March report found that Etherscan hid zero-value transfers by default, while BscScan and Basescan required users to activate a “hide 0 amount tx” option to remove such records from view.

Strategy CEO Phong Le said the company plans to resume accumulating Bitcoin later this year, even after shifting business priorities prompted it to sell portions of its holdings in moves that drew scrutiny from the market.

In a Monday interview with FOX Business, Le said Strategy had purchased around 175,000 Bitcoin since the beginning of the year while selling roughly 7,000 BTC, making the company a significant net buyer.

That’s “about 25 times more” buying than selling, Le said. He added that Strategy has gone from the world’s second-largest institutional Bitcoin holder to the largest.

“We’ll get back to buying more Bitcoin throughout the course of the year,” Le said.

Strategy CEO Phong Le appears on FOX Business. Source: FOX

While Strategy has accumulated more than 840,000 BTC, it has sold Bitcoin on four occasions since May, with the most recent sale totaling 1,690 BTC. The company has used proceeds from its recent sales to support preferred stock dividends, share repurchases and its US dollar reserve.

Despite the relatively small size of the sales compared with its overall holdings, Strategy has faced scrutiny for departing from its long-standing “never sell” approach to Bitcoin. The shift highlights the competing demands facing Strategy as a public company, including obligations to common and preferred shareholders alongside its Bitcoin accumulation strategy.

Related: Strategy unveils capital framework to preserve Bitcoin exposure, pay dividends

BTC treasury model faces pressure amid bear market

The corporate Bitcoin treasury model has come under pressure as weaker market conditions challenge the economics that helped fuel its rapid expansion. Public companies hold more than 1.26 million BTC, trailing exchange-traded funds and other funds, which hold more than 1.6 million BTC, according to BitcoinTreasuries.NET.

The model has historically benefited from a financing cycle in which Bitcoin treasury companies traded at premiums to the value of their BTC holdings, allowing them to raise capital through equity or debt and use the proceeds to buy more Bitcoin, according to Novaque Research.

However, that cycle becomes more difficult to sustain when companies trade below the net asset value of their Bitcoin holdings because raising new capital becomes increasingly dilutive to shareholders.

Magazine: Sorry everyone, Bitcoin is headed down to $43,500: Michael Terpin