A Hyperliquid user appears to have lost about $550,000 in USDC on Aug. 13 after interacting with a phishing website promoted through a Google search advertisement, according to FlashRescue co-founder Darcy.

His post identified three addresses allegedly controlled by the attacker.

On-chain data associated with the reported transaction shows roughly 550,019 USDC was split among the three addresses. The transfers provide evidence that the funds moved, but blockchain records alone cannot establish how the victim was deceived. Darcy attributed the theft to a paid Google advertisement impersonating Hyperliquid. GoPlus Security subsequently identified two of the same addresses in its own warning.

Hyperliquid phishing transfers totaled about 550,019 USDC

The reported transaction split the funds into about 440,015 USDC, 82,503 USDC and 27,501 USDC. The three recipient addresses were 0x98b276…13C55, 0x93b6B2…d6D1 and 0x6fE314…B566.

Those movements are consistent with Darcy’s approximately $550,000 estimate. However, the causal link to the Google advertisement currently rests on the researcher’s attribution and reported victim evidence rather than the blockchain itself. Security Alliance, or SEAL, similarly warns that reliable attribution of losses to individual advertisements requires direct victim evidence and additional indicators of compromise.

Google told The Block that it suspended the advertiser connected to the reported campaign. A spokesperson said the company has “zero tolerance for scams” and said its systems stopped more than 99% of policy violating ads before they ran during 2025. Hyperliquid did not immediately respond to the publication’s request for comment.

Google’s own 2025 Ads Safety report says it blocked or removed more than 8.3 billion ads and suspended 24.9 million advertiser accounts last year. That included 602 million advertisements and four million accounts associated with scams. Those figures cover Google’s global enforcement rather than this Hyperliquid case specifically.

SEAL tracked Hyperliquid impersonations months earlier

SEAL documented the wider campaign in April and said it had blocked more than 356 malicious advertising URLs within several weeks. Its dataset contained 17 Hyperliquid impersonation sites, accounting for about 5% of the 352 entries included in its brand breakdown.

The security group said attackers use hacked or illicitly purchased verified advertiser accounts alongside cloaking and fingerprinting to evade automated checks. Some campaigns place benign looking Google hosted pages in front of malicious content delivered through secondary frames. SEAL advised crypto users to avoid accessing cryptocurrency applications through Google Search and instead use verified bookmarks.

The pattern has already produced other reported losses. As crypto.news previously reported, fake Uniswap advertisements were linked to at least $400,000 in thefts in May. SEAL separately calculated $1.27 million in confirmed and unattributed losses tied to suspected malicious Google advertisements between March 13 and March 30.

In related coverage, a Trezor user reported losing funds after clicking a sponsored phishing result earlier this month. Trezor later warned customers that sponsored search results can imitate its official website and should not automatically be trusted.

No Hyperliquid protocol breach has been identified

Nothing in the available evidence indicates that Hyperliquid’s blockchain or trading protocol itself was breached. The reported attack instead appears to have targeted the user before interaction with the legitimate platform by directing the victim to an impersonating website. This is an inference from the available security reports rather than a Hyperliquid finding.

Hyperliquid’s official support documentation already warns users to check complete website URLs because scammers use similar looking domains. Its support guidance also says unauthorized transactions, missing funds or unknown multisig changes can indicate that a wallet has been compromised.

What happens next

Google has suspended the advertiser identified in the report, while the three recipient addresses remain publicly traceable on-chain. No law enforcement investigation or asset recovery connected to this specific loss had been publicly announced in the sources reviewed as of Aug. 14.

The next verifiable development would be movement from the recipient wallets or identification of an exchange, bridge or other service through which investigators could seek additional information. For now, the approximately $550,000 loss is supported by the reported on-chain transfers, while the claim that a Google advertisement caused the theft remains attributed to FlashRescue’s Darcy.

Morgan Stanley’s latest US SEC 13F filing shows the bank increased its crypto-linked exposure in the second quarter, with the biggest lift coming from additional shares of BlackRock’s Bitcoin exchange-traded fund (ETF) iShares Bitcoin Trust (IBIT). The update comes as the value of those holdings shifted with underlying market moves during the quarter.

According to Morgan Stanley’s Q2 13F filing, its reported IBIT share count rose to around 16.5 million shares from 13.4 million—an increase of roughly 23%. At the same time, the dollar value of the position fell, reflecting declines in Bitcoin over the period covered by the filing.

Key takeaways

• Morgan Stanley increased its IBIT holdings by more than 3 million shares, but the reported value of the position dropped about 18% to $549 million.
• The bank also reported new exposure to its own spot Bitcoin product, the Morgan Stanley Bitcoin Trust (MSBT), which began trading in April.
• Ether-related ETF exposure expanded as well, including a roughly 202% increase in iShares Ethereum Trust (ETHA) shares to 4.6 million.
• Not all crypto positions rose: Morgan Stanley reduced several holdings tied to exchanges, mining, and infrastructure.
• Stablecoin issuer Circle also gained from the bank’s broader Q2 reallocation, with USDC-related holdings jumping significantly.

IBIT share growth, but lower reported value

Morgan Stanley’s filing points to a clear volume increase in BlackRock’s Bitcoin ETF. The bank reported IBIT holdings rising by about 3.04 million shares to approximately 16.5 million. However, the reported value declined to about $549 million from roughly $667 million, a drop of around 18%—consistent with the broader move in Bitcoin prices during the second quarter.

The filing described increases across several other Bitcoin ETF positions as well. Morgan Stanley added to smaller spot Bitcoin ETF exposures including the Grayscale Bitcoin Mini Trust ETF (BTC) and Bitwise Bitcoin ETF (BITB), while its Fidelity Wise Origin Bitcoin Fund (FBTC) holding rose nearly 38%.

Ether exposure expands alongside Bitcoin

Beyond Bitcoin, Morgan Stanley also increased its Ether-related ETF positions. The bank reported expanding its iShares Ethereum Trust (ETHA) stake by about 202% to 4.6 million shares. It also raised its Grayscale Ethereum Staking Mini ETF (ETH) position by roughly 26% to about 5.1 million shares.

In addition, Morgan Stanley initiated exposure to Solana-related products. The filing showed new positions in the Grayscale Solana Staking ETF (GSOL) and Fidelity Solana Fund (FSOL), reported at about $4.25 million and $2.26 million, respectively. That combination of more traditional large-cap exposures and smaller add-ons suggests a continued effort to broaden multi-asset crypto exposure rather than concentrating exclusively on Bitcoin.

New MSBT position and Circle’s USDC-linked holdings

Morgan Stanley’s own crypto product also entered the picture more clearly in the second quarter. The filing reported about 2.57 million shares of Morgan Stanley Bitcoin Trust (MSBT), a fund that began trading in April. While the filing’s share increase reflects new participation, it also underscores how quickly large financial institutions are building internal product lines around spot crypto access.

Separately, Morgan Stanley increased its reported stake in Circle Internet Group (CRCL)—the company behind the USDC stablecoin. According to the filing, Circle holdings rose from approximately 1.46 million shares to about 8.32 million shares. That is a substantial shift and stands out because it targets the stablecoin ecosystem rather than only spot-crypto ETF wrappers.

Mining and infrastructure gains—while some equity exposure falls

While Morgan Stanley grew several crypto-adjacent positions, the filing also showed reductions in some prominent holdings. The bank reported additions to multiple Bitcoin mining and infrastructure companies, including Cipher Digital (CIFR), Core Scientific (CORZ), Hut 8 (HUT), and Bitdeer Technologies (BTDR). These increases suggest the institution was willing to add risk to parts of the sector that often move with both network economics and equity sentiment.

At the same time, not every position improved. Morgan Stanley reported cutting its Coinbase (COIN) shares by roughly 550,000. It also reduced its CleanSpark (CLSK) position by more than 3.1 million shares and fully exited a roughly 8 million-share position in Bitfarms (BITF). In other words, the second quarter did not follow a single-direction strategy across the crypto equity complex—adjustments appear to have been more selective.

Overall, the mix of increases in major ETF exposure, expanded Ether allocations, a new MSBT position, and a large rise in Circle shares—paired with declines in specific exchange and mining names—indicates Morgan Stanley used the quarter to rebalance across the crypto value chain rather than simply adding net exposure everywhere.

Investors watching this data should focus on whether the pattern continues in subsequent 13F updates: specifically, whether Morgan Stanley sustains its share accumulation in spot Bitcoin and Ether ETFs while keeping selective pressure on certain crypto equities, or whether new reallocations emerge as Bitcoin and Ether prices move and as the ETF and stablecoin ecosystem evolves.

The Core Team calls Protocol 27 the “final planned upgrade,” but the phrase raises more questions than it answers. Between a passed node deadline, an EU white paper registration, and a token still trading 97% below its peak, the real story is what comes after the code freezes.

The phrase “final planned upgrade” carries a peculiar weight in crypto. It can mean the protocol is mature, that the team is stepping back, or that a new chapter is about to begin. When the Pi Core Team used those exact words to describe Protocol 27 in late July 2026, the community split along predictable lines. Bulls called it proof that mainnet maturity is imminent. Skeptics called it proof that development is winding down with no clear plan for what follows. Neither reading is complete, and the gap between the two is where Pi Network’s actual future will be decided.

What Protocol 26 actually changed

Protocol 26 landed with an August 11 hard deadline for every mainnet node operator. Miss it, get disconnected. The upgrade itself was the ninth mandatory protocol change in recent months, and it focused on four areas: contract safety, state management, interoperability, and cryptographic capabilities. In practical terms, this means the network’s smart contract layer became more resilient, cross-chain communication primitives improved, and the cryptographic toolkit available to developers expanded.

The scope matters because it reveals what the Core Team considers unfinished. State management upgrades suggest that the ledger’s internal bookkeeping still needed hardening. Interoperability improvements signal that Pi’s blockchain, which runs an adapted version of the Stellar Consensus Protocol, was not yet ready to interact cleanly with external chains. Cryptographic enhancements point toward preparing the network for more sophisticated applications, including privacy-preserving smart contracts that the v25 upgrade had already begun introducing.

None of this is cosmetic. These are foundational changes to how the network processes transactions, stores data, and communicates with the outside world. The fact that they arrived at Protocol 26 instead of Protocol 5 or Protocol 10 tells you something about how long Pi’s core infrastructure has remained a work in progress.

The upgrade process itself revealed the network’s operational reality. Node operators had less than two weeks to comply, and the Core Team was blunt about consequences: update or get cut off. For a network that claims 421,000 active nodes, that kind of forced compliance is logistically impressive and philosophically uncomfortable. It works when the Core Team is competent and well-intentioned. It is also the exact opposite of how most decentralized networks handle protocol changes, where upgrades are proposed, debated, and adopted through rough consensus instead of executive mandate.

Protocol 27: what “final” means and what it does not

The Core Team’s official language is precise: Protocol 26 is “a major milestone ahead of the final planned upgrade, Protocol v27.” Together, Protocols 26 and 27 will “bring the Mainnet up to date with the network’s latest protocol features and functionality.”

That framing deserves close reading. “Final planned upgrade” does not mean no more software changes ever. Every live blockchain ships patches, security fixes, and governance updates indefinitely. What it appears to mean is that Protocol 27 will complete the current development roadmap, the sequence of breaking changes that began when Pi launched its open mainnet in February 2025. After Protocol 27, the network’s core protocol would be considered stable, and future changes would presumably go through a different governance process rather than arriving as mandatory upgrades imposed by the Core Team.

This distinction matters for two audiences. For node operators, it means the cycle of frequent mandatory upgrades, nine in recent months alone, should end. For exchanges and institutional partners, it signals that the protocol will stop changing underneath them, a prerequisite for any serious integration work.

The Core Team has not published a detailed feature list for Protocol 27. That silence is itself informative. Either the scope is still being finalized, or the team is deliberately holding back details to manage expectations. Given Pi’s history of vague timelines and missed community expectations, the absence of specifics is worth noting, not filling with speculation.

The ESMA registration: what the EU filing actually confers

On August 10, 2026, a date that landed one day before the Protocol 26 deadline, ESMA’s public register showed Pi Network’s white paper as entry number 549. The filing entity was PiBit Ltd, the legal arm that Pi Network uses for European regulatory engagement. PiBit had submitted the MiCA-compliant white paper back in November 2025, and ESMA completed the registration in January 2026, though broader public attention arrived only in August.

The timing created a narrative collision. Protocol 26 deadline on August 11, ESMA registration visible on August 10, and social media predictably conflated the two into a single “bullish catalyst” story. But the ESMA registration and the protocol upgrade are entirely separate processes with different implications.

Under MiCA, registering a white paper is a disclosure obligation, not an endorsement. ESMA logs the document on its public register, confirming that the issuer provided the required information. It does not mean ESMA reviewed the token’s economic model, audited the code, or approved Pi for trading. For non-stablecoin tokens like PI, MiCA does not require prior authorization from a regulator; it requires notification and publication of a compliant white paper. Pi has cleared that bar.

What the registration does provide is legal standing. After July 1, 2026, any crypto asset offered to EU residents without a registered white paper is in breach of MiCA. Pi’s registration means it can legally be offered within the European Union and European Economic Area. For exchanges considering a PI listing in Europe, this removes one specific blocker: the regulatory disclosure requirement.

What it does not provide is competitive differentiation on its own. Dozens of tokens have registered MiCA white papers. The ones that have not are the ones facing legal risk, not the other way around. Pi is now compliant with a baseline requirement, not ahead of the curve.

The stronger reading of the ESMA filing is strategic, not purely regulatory. By registering through PiBit Ltd, the Core Team has created a legal entity with a formal relationship to a major regulator. That entity can now pursue partnerships, exchange integrations, and commercial relationships within the EU’s 27 member states without the legal ambiguity that plagued Pi’s earlier years. For a project whose critics have long questioned whether there is a real company behind the app, the existence of a MiCA-registered entity with a named filing is a concrete, if incremental, answer.

The exchange listing question that will not go away

Pi Network’s path to tier-1 exchanges remains the single most debated topic in its community. Kraken listed PI for spot trading in March 2026, making it the first major U.S.-regulated exchange to do so. OKX followed by opening PI access to U.S. users in May. Both listings represented genuine milestones for a project that spent years trading only on smaller platforms.

But the two exchanges that matter most to retail traders, Binance and Coinbase, remain absent. Binance held a community vote in February 2025 where 86.8% of roughly 226,000 voters supported a PI listing. The exchange never acted on the result and has made no public commitment since. Coinbase has been even quieter, with no vote, no public discussion, and no visible movement toward listing.

The reasons are consistent across reporting: concerns over code transparency, insufficient independent security audits, questions about decentralization, token concentration risk, and the overhang of upcoming unlocks. These are not trivial objections. They reflect the same due diligence standards that kept other controversial tokens off major platforms for extended periods.

Protocol 27’s completion could address some of these concerns. A stable, “final” protocol is easier to audit than one undergoing frequent breaking changes. The ESMA white paper registration removes the EU regulatory question mark. But the core issues around code transparency and independent audits remain the Core Team’s to solve, and neither Protocol 27 nor MiCA compliance automatically resolves them.

The supply overhang: 1.21 billion tokens and no cost basis

Pi’s token unlock schedule for 2026 represents one of the most aggressive dilution profiles in the top 100 tokens by market capitalization. Roughly 1.21 billion PI tokens are scheduled to enter circulation across the year, releasing at a pace of approximately 6.5 million coins per day. Some estimates from PiScan data suggest around 775.8 million additional tokens will unlock as three-year lockup periods expire.

The economic logic is straightforward and unfavorable. These tokens were mined for free on mobile phones. Their holders have no cost basis, meaning any price above zero represents profit. The rational behavior for a significant portion of these holders is to sell, and the data supports that thesis: PI trades near $0.088, down more than 97% from its $3.00 all-time high reached in February 2025. The market capitalization hovers around $976 million with a circulating supply exceeding 11 billion tokens.

For context, Pi’s first year on open mainnet saw the token lose the vast majority of its value as unlocks flooded the market faster than demand could absorb them. Protocol 27 and ESMA registration do not change the supply schedule. They might change demand, but only if they catalyze real utility or major exchange listings that bring fresh buyers.

The counterargument is that not all unlocked tokens are sold. More than 58 billion PI remain held off-market by Pioneers, and the ecosystem’s 13 million active wallet addresses suggest a core user base that is holding rather than dumping. Whether that base can absorb the incoming supply is an open question with no definitive answer.

There is also the question of what the token’s price floor actually represents. At $0.088 and a $976 million market cap, Pi is valued roughly in line with mid-tier layer-1 blockchains that have functioning DeFi ecosystems, NFT marketplaces, and institutional integrations. Pi has none of those things at comparable scale. Either the market is pricing in a future that has not arrived yet, or the sheer size of the Pioneer community creates a floor of believers who will hold regardless of fundamentals. Both explanations can be true simultaneously, and both carry risk.

421,000 nodes and the decentralization question

Pi Network’s 421,000 active nodes make it one of the largest validator networks in crypto by raw count. The network runs an adapted Stellar Consensus Protocol, a Federated Byzantine Agreement model where nodes reach consensus through overlapping trust networks instead of proof-of-work computation. This design is energy-efficient and well-suited to Pi’s mobile-first user base.

But raw node count is not the same as meaningful decentralization. The Core Team retains significant control over the protocol upgrade process, as evidenced by the mandatory nature of every protocol change through version 26. Node operators do not vote on upgrades; they comply or get disconnected. This is a governance model closer to a managed network than a decentralized protocol, and it is one of the concerns that exchanges like Binance have cited.

Protocol 27 is supposed to mark the end of this mandatory upgrade cycle. If the Core Team follows through, future protocol changes would presumably require some form of community governance. That transition, from centralized mandates to decentralized decision-making, would be a more significant milestone than any single protocol upgrade. Whether it actually happens remains to be seen.

The comparison to Stellar is instructive here. Pi’s blockchain is built on an adapted version of Stellar’s consensus mechanism, but Stellar itself operates with a far more transparent governance process. Stellar Development Foundation proposals are public, debated openly, and adopted through voluntary network consensus. Pi has borrowed Stellar’s technology without borrowing its governance culture. Protocol 27 is the moment where that gap either closes or becomes permanent.

The ecosystem gap between users and utility

Pi Network claims over 60 million engaged Pioneers, 18.1 million KYC-verified users, and 16.7 million successful mainnet migrations. The Pi App Studio has produced over 51,800 individual Pioneer-created applications, including 13,400 chatbot apps and 24,400 custom apps. Partnerships with Banxa and Onramper provide fiat on-ramps, and the v23 upgrade introduced Rust-based smart contracts running on WebAssembly.

These numbers are impressive in isolation and underwhelming in context. Despite 60 million Pioneers, daily trading volume for PI sits around $6.6 million, a figure that suggests the vast majority of the user base is not actively transacting on exchanges. The price action reflects a market where supply consistently overwhelms demand, regardless of how many users the app claims.

The ecosystem’s real test comes after Protocol 27. If the protocol is stable, developers have a fixed target to build against. Smart contract capabilities are in place. The question is whether Pi’s massive user base will translate into actual on-chain activity, decentralized applications with real users doing real things, or whether the numbers represent a mobile mining game whose participants never transition to blockchain utility.

This is the core tension that Protocol 27 does not resolve. A stable protocol is necessary for ecosystem growth but not sufficient. Ethereum did not become valuable because it stopped upgrading; it became valuable because people built things on it that other people wanted to use. Pi has the user base. It does not yet have the applications.

The recent introduction of tools like SoloHost, Pi Sign-in, and PiVerify at Pi2Day 2026 suggests the Core Team is aware of this gap. These tools push Pi toward compute, identity, and authentication use cases that could generate real on-chain demand. But tools announced are not tools adopted. The gap between launch and traction is where most blockchain ecosystem plays fail, and Pi’s track record of converting announcements into sustained usage remains thin. If Protocol 27 stabilizes the foundation, the next 12 months will show whether anyone builds a house on it.

What to watch

Three developments will determine whether Protocol 27 marks the beginning of Pi’s maturation or the end of its momentum.

First, watch the governance transition. If the Core Team retains the same top-down control after Protocol 27 that it exercised through Protocols 1 through 26, the “final upgrade” label is meaningless. Real maturity requires real decentralization of protocol governance.

Second, watch exchange listings. The ESMA registration and protocol stability together remove two of the stated objections from tier-1 exchanges. If Binance or Coinbase still decline to list PI after Protocol 27, the remaining objections, likely around code audits and token concentration, will be harder for the community to dismiss.

Third, watch on-chain activity. Token unlocks will continue regardless of protocol changes. The only force that can absorb that supply is genuine demand from users engaging with applications built on Pi. Monthly active addresses, transaction volumes, and dApp usage metrics will tell the real story.

The thesis that Protocol 27 catalyzes a new chapter for Pi is invalidated if any of the following occur: the Core Team continues mandatory protocol changes under a new label, no major exchange lists PI within six months of Protocol 27’s deployment, or on-chain transaction volumes remain flat despite the stable protocol.

Conversely, the bear case is invalidated if Protocol 27 leads to a published, independent security audit; if the Core Team releases a governance framework that gives node operators real voting power; or if a major exchange announces a listing citing protocol stability as the deciding factor. The strongest version of the bull case is not that Protocol 27 itself changes Pi’s trajectory, but that it removes the last technical excuse for the market to ignore the project.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency markets are volatile and carry significant risk. The information presented reflects conditions as of August 14, 2026, and may change rapidly. Always conduct your own research before making investment decisions.

HTX and the UK Financial Conduct Authority have entered settlement talks over allegations that the crypto exchange illegally promoted its services to British consumers, with High Court proceedings paused until late August while negotiations continue.

Reuters reported on Aug. 13, citing court documents, that the FCA and HTX have been given another two months to seek a settlement after the two sides began exchanging emails in March and initially held three months of negotiations.

The discussions concern a lawsuit filed by the FCA in October against Panama-incorporated Huobi Global and unidentified people alleged to operate and control HTX. In February, the regulator accused the exchange of breaching financial promotion rules that have applied to cryptoassets in the UK since October 2023.

HTX, formerly known as Huobi, is one of the world’s largest crypto trading platforms and has been linked to Tron founder Justin Sun, who acquired a controlling interest in the exchange in 2022. The company is also dealing with separate sanctions imposed by the UK and European Union while maintaining that its services are not intended for British customers.

HTX and FCA have extended settlement talks

Court orders reviewed by Reuters show that discussions between HTX and the FCA began after months of unsuccessful attempts by the regulator to engage with the exchange.

The FCA had alleged that HTX ignored repeated requests to communicate and operated through what the regulator described as an “opaque operational structure.” Following email exchanges in March, however, the two sides entered settlement discussions that initially ran for three months.

On June 25, the High Court granted another two-month extension, putting the current negotiation period on course to expire in late August. Proceedings have been halted during that period to allow the parties to continue talks.

Neither side has disclosed what a possible settlement could involve. The FCA and HTX declined to comment to Reuters on the status of the negotiations, while lawyers representing HTX did not respond to requests for comment.

Asked separately about the regulatory discussions, legal proceedings and their timetable, HTX also declined to provide details.

“HTX remains dedicated to upholding high standards of compliance, transparency, and user protection,” a spokesperson told Reuters, adding that the company would continue working collaboratively with regulators.

An undated notice published on HTX’s website states that its products and services are not intended for users in the UK.

FCA case targets HTX crypto promotions in the UK

The lawsuit is the FCA’s first court case against a crypto company over the marketing of services to British consumers, according to Reuters.

UK financial promotion rules for cryptoassets took effect in October 2023 and restrict how companies can market crypto products to consumers in the country. The requirements apply to promotions made through websites, apps and other online channels capable of reaching British customers.

Crypto companies seeking UK customers must also register with the FCA where required and undergo anti-money laundering and financial crime checks. HTX and Huobi were added to the FCA’s warning list of unauthorized firms in 2023 and 2024, respectively.

The regulator uses the list to alert consumers about companies that may be providing financial services or targeting UK customers without the required authorization.

The FCA has also tried to restrict HTX’s access to British users through third-party platforms. According to Reuters, the regulator has urged social media companies to block HTX accounts for UK-based users and pushed for its products to be removed from UK app stores.

Enforcement against unauthorized crypto services has extended to other platforms. In June, the FCA warned about Hyperliquid after saying the decentralized perpetual futures platform and related entities may be providing or promoting financial products and services in the UK without authorization.

The regulator has also pursued suspected unauthorized crypto activity offline. A June crypto.news report detailed how the watchdog raided eight London sites as part of an investigation into suspected illegal peer-to-peer crypto trading.

The operation involved the FCA, HM Revenue and Customs and the Metropolitan Police, with authorities issuing stop notices while investigating potential anti-money laundering and counter-terrorist financing breaches.

UK and EU sanctions have added pressure on HTX

HTX’s regulatory position in Britain became more complicated in May when the UK government sanctioned Huobi Global S.A. as part of measures targeting financial networks accused of supporting Russia.

As previously reported by crypto.news, the UK designated Panama-registered Huobi Global S.A. on May 26 in a sanctions package targeting the Russia-connected A7 network.

The UK notice listed HTX and HTX Exchange among names associated with the sanctioned entity. Measures included an asset freeze, payment-processing restrictions, internet service sanctions, and trust services restrictions.

A day later, HTX disputed the sanctions scope, arguing that Huobi Global S.A. was a separate legal entity and that the designation did not apply to its operating exchange or affect customer assets.

The UK Foreign Office had accused the sanctioned company of providing financial services connected to A7 Limited Liability Company and Garantex Europe OU. British authorities said they had reasonable grounds to suspect that the services supported Russia.

Compliance effects spread to crypto users and service providers following the designation. In June, blockchain researchers reported that some platforms were flagging wallets with previous connections to Huobi or HTX, creating additional checks for funds that had passed through the exchange.

A Global Ledger analysis cited at the time found that HTX processed about $21.06 billion in high-risk crypto flows between 2021 and May 2026, including $7.64 billion linked to Russian high-risk entities and darknet markets. Blockchain investigator ZachXBT criticized the impact of address screening, arguing that ordinary users could face restrictions because of historical exposure to HTX-linked wallets.

The sanctions pressure expanded in July when the European Union placed HTX on a list of crypto companies accused of helping Russian users evade financial restrictions. The EU sanctions action covered 18 crypto companies and formed part of the bloc’s latest measures against Russia.

UK crypto firms face a new authorization regime

The FCA’s action against HTX is being pursued under rules already applicable to crypto promotions and financial crime controls while Britain prepares a more extensive regulatory system for the sector.

In April, the regulator opened its final consultation covering stablecoin issuance, crypto trading platforms, custody and staking.

Under the timetable published with the consultation, crypto companies will be able to apply for full FCA authorization from Sept. 30, 2026, before the new regulatory framework takes effect in October 2027.

Some companies have already obtained registration under the existing anti-money laundering regime. Robinhood’s UK subsidiary, for example, was registered by the FCA on July 31, allowing it to provide crypto services in Britain under the current framework.

For HTX, the existing High Court proceedings remain paused under the June 25 court orders while settlement discussions with the FCA continue through late August.

A fake cryptocurrency job offer that infected a company-issued device has led to US$11.8 million in losses after attackers gained access to corporate systems and bypassed transaction controls, Singapore authorities have said.

The Singapore Police Force and Cyber Security Agency of Singapore said on Aug. 14 that the victim was first contacted on LinkedIn by a scammer posing as a recruiter from a cryptocurrency-related company, beginning an interview process that eventually gave the attackers access to the victim’s employer.

Communication moved from LinkedIn to email, where the supposed recruiter used a spoofed domain that closely resembled the legitimate company’s address. The victim also attended several interviews through Google Meet, although the person conducting the interviews kept their camera switched off during the calls.

As the recruitment process advanced, the victim was sent to a spoofed website and asked to complete a technical coding assessment on a company-issued device. Malicious software was downloaded during the assessment without the victim realizing the device had been compromised.

Fake crypto job assessment opened access to corporate systems

Once installed, the malware harvested the victim’s session token, SPF and CSA said. Attackers then used the stolen token to bypass multi-factor authentication and gain access to the victim’s Bitbucket account, which was connected to the employer’s code repository.

Bitbucket is a code repository hosting service used by software development teams to store, manage, and collaborate on source code. Access to an employee account can therefore expose more than the individual device when the account has permissions linked to company repositories or other development systems.

After entering the Bitbucket account, the attackers modified the company’s automated software deployment instructions, according to the two agencies. The intrusion then moved into the company’s internal infrastructure as the attackers remotely accessed its servers.

Credentials collected during the compromise allowed the attackers to bypass transaction limits and approval checks used to control cryptocurrency transfers. SPF and CSA said the attackers subsequently carried out crypto transactions that resulted in losses totaling US$11.8 million.

The use of a coding assessment as the malware delivery method resembles attacks previously documented across the cryptocurrency sector, where developers and other technical staff are approached with job offers before being asked to run code or install software.

In May, crypto.news reported on TrapDoor malware, which targeted cryptocurrency and artificial intelligence developers through malicious software packages. Developer security platform Socket found at least 34 malicious packages and 384 connected versions across npm, PyPI and Rust ecosystems.

According to Socket, the packages were designed to steal cryptocurrency wallet information alongside GitHub tokens, API keys, cloud credentials and SSH access. The campaign placed developer environments at the point of compromise, allowing attackers to target credentials that could provide access to systems outside a victim’s personal cryptocurrency accounts.

Crypto workers have faced repeated recruiter-based malware attacks

Recruitment-themed attacks have also relied on legitimate communication platforms to make initial contact appear credible before moving victims toward malicious software.

An April Obsidian malware campaign used LinkedIn and Telegram to approach cryptocurrency and finance professionals. Elastic Security Labs found that attackers relied on social engineering to convince targets to install malicious community plugins for the legitimate Obsidian note-taking application.

The malware, identified as PHANTOMPULSE, used three blockchain networks to receive commands and maintain persistence, according to Elastic Security Labs. Researchers recommended strict application-level plugin policies at financial companies to reduce the risk of legitimate productivity software being turned into an entry point for attackers.

During the same month, wallet provider Zerion confirmed a $100,000 breach tied to a long-running social engineering operation linked to North Korean attackers. The Zerion security breach involved attackers using artificial intelligence to impersonate trusted contacts before compromising hot-wallet credentials.

Security Alliance researchers connected that campaign to 164 malicious domains used in attempts to infiltrate cryptocurrency companies through services including Slack and LinkedIn. Zerion said the attackers had targeted the human side of its operations instead of directly breaking its underlying wallet technology.

SPF and CSA have not attributed the latest US$11.8 million loss to North Korea or any other hacking group.

Recruitment-based social engineering, however, has previously been used by North Korean threat actors against cryptocurrency businesses. Google Cloud and Wiz reported in 2025 that UNC4899, also known as TraderTraitor, had approached employees at crypto companies through LinkedIn and Telegram while posing as recruiters.

In incidents involving remote job approaches, employees were persuaded to execute malicious Docker containers on their workstations. The containers deployed downloaders and backdoors connected to attacker-controlled infrastructure, after which the group moved through internal networks, collected credentials, and searched for systems used to process cryptocurrency transactions.

Google said one incident allowed UNC4899 to disable multi-factor authentication on a privileged Google Cloud account and access wallet-related services. The group has been active since at least 2020 and has focused heavily on cryptocurrency and blockchain companies, according to the firm’s threat research.

Singapore authorities call for tighter repository and credential controls

Following the latest incident, SPF and CSA advised businesses and individuals, particularly those operating in technology and cryptocurrency, to verify the identities of recruiters and the companies they claim to represent before interacting with job-related files, websites or software.

Companies were also advised to protect application programming interface keys and internal credentials while strengthening multi-factor authentication. Securing code repositories and software deployment pipelines was specifically recommended because access to those systems can allow a compromise that starts on one employee device to reach company infrastructure.

The agencies also urged businesses to review how sensitive credentials are stored and accessed. In the latest case, credentials collected after the initial compromise were used to bypass transaction limits and approval checks, allowing the attackers to execute cryptocurrency transfers.

Developer access has remained a recurring target because software repositories and related tools can contain credentials or provide routes into cloud and production systems. The TrapDoor campaign discovered in May, for example, targeted GitHub tokens, SSH keys, and cloud credentials alongside cryptocurrency wallet data, giving attackers several types of access from a single infected developer environment.

Earlier recruiter scams have used similar steps with different malware delivery methods. A December 2024 fake interview campaign approached Web3 professionals through LinkedIn, Telegram, and freelance platforms with lucrative employment offers.

Targets were directed to a video interviewing service and asked ordinary industry questions before reaching a final video task. When victims encountered a supposed microphone or camera problem, they were shown troubleshooting instructions that required them to execute commands on their computers.

On-chain investigator Taylor Monahan said at the time that executing the commands could give attackers general access to the device, creating opportunities to steal sensitive information, monitor activity, or compromise cryptocurrency wallets.

Compromised devices should be isolated immediately

For businesses that suspect an employee device or internal system has already been breached, SPF and CSA advised isolating affected equipment or systems immediately.

Active sessions should be revoked, and credentials reset, while access logs should be examined for signs that attackers entered other accounts or company infrastructure. Authorities also advised businesses to check whether code repositories, internal servers, accounts or approval workflows had been changed during the compromise.

Internal cybersecurity teams or external security providers should be contacted without delay, according to the agencies. Investigators should determine which accounts and credentials were exposed and establish whether unauthorized changes were made after the initial intrusion.

For individuals, the agencies recommended treating unsolicited recruitment approaches with caution and independently verifying both the recruiter and the company involved. Extra scrutiny was advised when an interview process requires candidates to download files, run unfamiliar code, or use websites supplied by people they have not independently verified.

Companies were separately advised to review access to API keys and other internal credentials, strengthen multi-factor authentication controls, and secure development infrastructure, including repositories and automated deployment pipelines.

Console Wallet integrates the LetsExchange API, enabling Canton Coin holders to swap CC directly into stablecoins and EVM assets while funding wallets from external networks.

Console Wallet, a leading non-custodial wallet built for the Canton Network and EVM networks, has integrated the LetsExchange API to expand its native crypto swap functionality. The integration enables Canton Coin (CC) holders to swap it directly into stablecoins and EVM-based assets, and to fund their Console Wallet with assets from external networks. 

These two flows previously required leaving the wallet and now can be performed in a single interface. This also simplifies onboarding for new users by making it easier to fund their wallet with assets needed for network fees without relying on external services. Additionally, users can access a broader range of digital assets and blockchain networks directly within the wallet.

The collaboration also brings LetsExchange into one of the fastest-growing institutional blockchain ecosystems. Developed by Digital Asset, the Canton Network is an institutional-grade Layer 1 blockchain designed for regulated financial markets that combines privacy, compliance, and interoperability. The network has attracted significant institutional backing, with Digital Asset recently announcing a $355 million funding round led by a16z crypto and joined by organizations including HSBC, BNP Paribas, Citadel Securities, Coinbase Ventures, S&P Global, and others. The Depository Trust & Clearing Corporation (DTCC) is also using the Canton Network as part of its tokenization initiatives for U.S. government securities.

Through the integration, Console Wallet gains access to LetsExchange’s swap service, which supports 6,000+ digital assets across more than 300 blockchain networks. The API gives partners flexibility over which cryptocurrencies and blockchain networks they choose to support, allowing products to expand their capabilities as their ecosystems evolve.

Tokenized real-world assets are currently the most actively discussed topic within the Canton community, and the integration is positioned with that trajectory in mind: alongside crypto-to-crypto swaps, LetsExchange supports RWA-related assets, giving Console Wallet users a single interface for moving between tokenized instruments and liquid crypto assets as the Canton RWA market matures. 

Crypto swaps inside Console Wallet are powered by the LetsExchange routing engine, which evaluates offers from more than 20 external providers and automatically identifies the most suitable provider, and the competitive exchange rate for each swap request. In addition to crypto-to-crypto swaps, the integration supports cross-chain operations with transparent swap terms, automated AML screening, and 24/7 customer support.

Alex J., Chief Product Officer (CPO) at LetsExchange, commented: “Integrating with Console Wallet is an important milestone for LetsExchange because it connects our platform to one of the most promising institutional blockchain ecosystems in the industry. As the Canton Network continues to gain momentum, we’re excited to help bring seamless access to the broader crypto economy. For Console Wallet users, this means they can securely swap across hundreds of blockchain networks and access a much wider range of digital assets without leaving the wallet.”

Alexei Dulub, CEO at Console Wallet, said: “This integration enhances Console Wallet’s core features by bringing transparent, multi-network swap capabilities to the Canton Network. It allows our users to interact smoothly with multiple blockchain ecosystems from a single, secure application. This integration is highly valuable as it accelerates our strategic cross-chain expansion.”

The integration reflects growing demand for wallet infrastructure that combines self-custody with access to multi-chain swaps. As institutional blockchain ecosystems continue to expand, partnerships between crypto exchange platforms and wallet developers are helping bridge regulated networks with the broader digital asset landscape.

About Console Wallet

Console Wallet is a self-custodial wallet by PixelPlex purpose-built for the Canton Network. Available as a Chrome browser extension, a mobile app for iOS and Android, and a macOS application, it enables users to securely store, send, receive, swap, and bridge digital assets while interacting with Canton applications via passkey-secured approvals and clear signing. The wallet also supports Ethereum and other EVM-compatible networks, includes built-in phishing protection, automatically detects Canton tokens, and keeps private keys stored locally on users’ devices.  Console Wallet also builds white-label wallet solutions for institutional participants in the Canton ecosystem. 

About LetsExchange

LetsExchange is a crypto exchange platform supporting more than 6,000 digital assets across 300+ blockchain networks, including Canton, TRON, Bitcoin, Sui, and many others. The platform enables crypto-to-crypto and cross-chain swaps, along with on-ramp and off-ramp functionality, and offers advanced B2B solutions, including APIs, customizable widgets, RWA support, and affiliate tools. LetsExchange focuses on simplifying crypto exchange and providing scalable solutions for businesses and users.

HashKey Exchange has completed a live transaction using Hong Kong’s first regulated Hong Kong dollar-backed stablecoin, HKDAP, with YF Life, testing a payment route that the companies say could cut premium settlement from two to three business days to near real time.

HashKey Holdings said in a press release sent to crypto.news that its licensed trading platform used real funds to complete HKDAP subscription and redemption processes with YF Life Insurance International Limited, as the insurer prepares to explore stablecoin-based premium payments for customers.

The transaction puts HKDAP into an insurance-related use case only days after the stablecoin entered its controlled rollout. HashKey is an authorised distributor for HKDAP, which is issued by Anchorpoint Financial under a stablecoin issuer licence from the Hong Kong Monetary Authority.

YF Life plans to introduce HKDAP as a premium payment option subject to regulatory requirements and its implementation schedule, according to the release. The insurer said it expects to work with HashKey on the payment model and wants to become one of the first insurance companies in Hong Kong to accept the regulated stablecoin for premiums.

HKDAP test uses real funds for insurance payment setup

For the latest transaction, HashKey and YF Life tested the parts of the payment route needed before customers could use HKDAP for insurance premiums.

Real funds were used for both subscription and redemption, meaning the test covered the process of acquiring HKDAP and converting it back as part of the transaction cycle. HashKey said the work provides the basis for YF Life to introduce a regulated stablecoin payment option at a later stage.

Under the proposed customer process, policyholders could subscribe to HKDAP with Hong Kong dollars through HashKey Exchange. Customers who already hold the stablecoin could also withdraw HKDAP to a personal wallet and use it for premium payments.

Settlement time is one of the main areas being tested. According to HashKey, traditional premium payments can require two to three business days before settlement is confirmed, while an HKDAP transaction can provide what the company described as “near to real-time crediting.”

YF Life has not provided a launch date for customer premium payments using HKDAP. Its plans remain subject to relevant regulatory requirements, while the current transaction serves as a live test of the payment setup.

The insurance use case follows HashKey’s entry into HKDAP distribution this week. As crypto.news reported on Aug. 12, Anchorpoint appointed the licensed exchange as an authorised distributor during the token’s beta stage, giving eligible institutions and professional investors access to minting, redemption and fiat conversion services.

HashKey had already completed an HKDAP minting and redemption transaction with eligible clients before working with YF Life. That earlier transaction covered conversions from fiat into HKDAP and back into fiat, testing how customers could enter and exit the stablecoin through the licensed platform.

HKDAP moves from controlled rollout into payment testing

Anchorpoint began the phased HKDAP rollout on Aug. 12, initially opening access through institutional distributors and to professional investors.

During the first stage, the issuer identified cross-border payments, fiat conversion, and settlement involving tokenized real-world assets as initial uses for the stablecoin. Authorised distributors provide the link between Anchorpoint and eligible customers that need to acquire or redeem HKDAP.

HKDAP stands for HKD At Par and is designed to maintain a one-to-one value with the Hong Kong dollar. Anchorpoint has said eligible, high-quality Hong Kong dollar assets will back the stablecoin in line with the requirements applied under the city’s regulated stablecoin framework.

Access has initially been limited as Anchorpoint introduces the token through distributors and other use-case partners. Institutional and professional users can obtain HKDAP through participating channels, while the initial rollout has focused on testing transactions before access expands to additional users and applications.

The YF Life transaction adds insurance payments to the commercial applications now being tested. Under the structure described by HashKey, the exchange provides the regulated route through which customers can obtain HKDAP, while an insurer can receive the stablecoin as payment once the service is introduced.

HashKey said connecting the issuer, a licensed trading platform and an insurance institution allowed the parties to test how a regulated stablecoin could operate inside an existing financial service instead of limiting the exercise to token issuance and redemption.

Hong Kong stablecoin rules govern HKDAP issuance

Anchorpoint secured one of Hong Kong’s first stablecoin issuer licences from the HKMA in April, alongside HSBC, clearing it to issue HKDAP under the Stablecoins Ordinance.

The April licensing approval followed the Stablecoins Ordinance taking effect on Aug. 1, 2025. Under the framework, regulated fiat-referenced stablecoins are subject to requirements covering reserve assets, redemption, asset segregation, governance and anti-money laundering controls.

Anchorpoint is backed by Standard Chartered Bank (Hong Kong), HKT and Animoca Brands. The issuer said after receiving its licence that HKDAP would be introduced in phases, with payments and settlement among the uses planned for the token.

Each HKDAP token is intended to be backed one-to-one by eligible Hong Kong dollar reserves held under the regulated structure. Anchorpoint has used a distribution model in which approved partners handle access to HKDAP instead of the issuer serving every potential customer directly.

HashKey’s role under that setup covers distribution, trading, and related services. During the beta period, eligible institutions and professional investors can acquire the stablecoin through HashKey and supported channels, while Anchorpoint continues testing how HKDAP can be used across different transaction types.

HashKey plans more HKDAP payment use cases

Beyond insurance, HashKey said it plans to work with financial institutions and other industry partners on HKDAP applications involving corporate payments and cross-border trade.

The company identified those areas alongside insurance as potential uses where a regulated Hong Kong dollar stablecoin could be added to existing payment processes.

For YF Life, the next step described in the announcement is the planned introduction of an HKDAP premium payment solution once applicable regulatory requirements and its own roadmap allow it.

Customers would then be able to obtain HKDAP with Hong Kong dollars through HashKey Exchange or use an existing balance transferred to a personal wallet before making a premium payment, according to the companies.

XRP’s potential drop below $1 amid weak sentiment and leverage is shifting attention toward alternative strategies such as UE Crypto’s cloud mining platform.

Due to the renewed delay of the Digital Asset Market Clarity Act, market uncertainty has intensified, and XRP continues to underperform, while UE Crypto’s cloud mining platform and stable yield mechanism have attracted considerable attention.

XRP has underperformed the broader cryptocurrency market, while investors’ interest in UE Crypto’s cloud mining and yield mechanisms has been reignited.

Faced with XRP price volatility and the market uncertainty surrounding the Digital Asset Market Clarity Act, an increasing number of XRP investors are turning their attention to UE Crypto in an effort to hedge against market risks.

UE Crypto positions its cloud mining platform as a new option for XRP holders, aiming to provide them with additional digital asset returns rather than relying solely on price appreciation.

Spot trading volume remains light, while a narrowing intraday trading range indicates that buyers have yet to demonstrate sufficient confidence. Daily trading volume stands at $885 million, down from $905 million yesterday, indicating that trader interest is weakening.

Last week, XRP fell 3.9%, while Bitcoin rose 1% and Ethereum rose 0.5%, making XRP the worst performer among major cryptocurrencies. Therefore, this sell-off is specific to XRP rather than a broader correction across the cryptocurrency market.

XRP’s only anticipated catalyst remains stalled. The CLARITY Act, which is intended to classify XRP as a federal commodity, missed the voting window before the Senate’s August recess and is now scheduled for a procedural vote on September 15. As a result, XRP’s price currently has no upward momentum for the next month.

The reason may be the current lack of market transparency — or, more specifically, the delay of the long-awaited Digital Asset Market Clarity Act.

As investors explore cloud mining and yield mechanisms, XRP’s price weakness has driven increased interest in UE Crypto.

Amid continued market volatility, XRP holders seeking cloud mining and yield strategies continue to show interest in UE Crypto.

As of August 14, 2026, the current price of XRP (XRP) is $1.00. Over the past 24 hours, the price has fallen by 0.9%, including a 0.3% decline over the past hour. From a longer-term perspective, the price fluctuation over the past 7 days was -2.8%, while the price fluctuation over the past month was -9.4%. Among the top ten cryptocurrencies by market capitalization, XRP recorded the largest seven-day decline, falling by -9.4%, while the overall market remained largely flat. The token’s price action appears to indicate that the Clarity trade is gradually being unwound.

Affected by market sentiment, XRP fell to a recent low, causing its market capitalization to shrink and temporarily losing its position as the world’s fourth-largest digital asset. The increase in short-term volatility has prompted some investors to reassess their future XRP investment strategies.

Meanwhile, traders are quietly watching the period from September to October, believing that this period could bring a definitive outcome for the CLARITY Act. This regulatory catalyst could have a polarized impact on market sentiment.

Before the legislative window arrives, the broader cryptocurrency market remains range-bound, and XRP’s price action also reflects this consolidation pattern, with trading volume remaining light. To hedge against market risks, the UE Crypto cloud mining platform has attracted increasing attention from investors who hope to hedge against market volatility and improve returns through cloud mining and yield aggregation mechanisms.

As XRP volatility increases, UE Crypto has become a new option for investors.

Given the recent increase in XRP price volatility, more and more XRP holders are turning their attention to UE Crypto. Unlike highly volatile leveraged trading or strategies that rely solely on price appreciation, UE Crypto’s cloud mining platform provides a more convenient way to participate in digital assets. Users do not need to deploy mining machines or maintain hardware; they only need to select a computing power contract to participate in mining services. This allows them to focus on the long-term prospects of XRP while maximizing the benefits of their digital assets.

About UE Crypto

UE Crypto is headquartered in the United Kingdom and operates within European regulatory frameworks such as MiCA and MiFID II, continuously improving its transparency, operational standards, and user protection mechanisms.

The platform adopts a multi-layer security architecture, including:

• Annual financial and security compliance audits conducted by PwC.
• Digital asset custody insurance provided by Lloyd’s of London.
• Enterprise-grade network protection from Cloudflare and McAfee® security systems.
• Bank-grade data encryption and professional security infrastructure to provide multiple layers of protection for users’ assets and accounts.

UE Crypto supports a range of mainstream digital assets, including XRP, BTC, ETH, USDT, USDC, DOGE, LTC, and SOL, providing users with a more flexible and convenient digital asset service experience.

Start earning daily returns in just three steps

1. Register an Account

Visit the official UE Crypto website and register using an email address to receive a $20 trial bonus.

2. Choose a Mining Package

Choose a suitable cloud mining contract based on personal budget and needs, and start mining with one click.

3. Start Earning

Once the contract is activated, the system will automatically allocate computing power, and returns will be settled automatically every 24 hours. Users can withdraw their earnings at any time or continue participating according to their own needs, thereby achieving long-term compound growth of their assets.

Popular UE Crypto contracts

• BTC (Beginner Experience Contract) Investment amount: $100，Contract duration: 2 days，Daily return: $4，Total return at contract expiration: $100 + $8
• Dogecoin (DOGE, Digital Intelligent System Contract) Investment amount: $500，
  Contract duration: 5 days，Daily return: $6.25，Total return at contract expiration: $500 + $31.25
• BTC (Super Computing System Contract) Investment amount: $1,000，
  Contract duration: 10 days，Daily return: $13.10，Total return at contract expiration: $1,000 + $131
• LTC (Algorithm-Driven System Contract) Investment amount: $5,000，
  Contract duration: 25 days，Daily return: $72，Total return at contract expiration: $5,000 + $1,800
• BTC (Quantitative Intelligent System Contract)Investment amount: $10,000，
  Contract duration: 35 days，Daily return: $158, Total return at contract expiration: $10,000 + $5,530

For more details about the contract plans, visit the official UE Crypto website.

Will XRP fall below $1?

As market sentiment remains weak, XRP is very likely to fall below $1. Whale buying may temporarily delay the price decline, but it cannot replace a fundamental reason to buy, and XRP currently has no clear buying rationale ahead of the CLARITY Act vote in September.

The leverage accumulated since August could cause this decline to happen faster than the scenarios described above. Forced selling by bulls could push the XRP price below $1 before buyers have an opportunity to defend the level again.

When the price falls to a certain level, borrowed positions are automatically liquidated. These forced liquidations further suppress the price, which in turn liquidates more positions. Therefore, if XRP falls below $1, its decline could accelerate far beyond the slow downward trend that whales have maintained throughout this year.

Therefore, for long-term XRP holders, market attention is shifting from simply relying on price appreciation toward more diversified cloud mining digital asset platforms.

For example:

Unlike highly volatile leveraged trading or strategies that rely solely on price appreciation, UE Crypto’s cloud mining platform provides users with a low-risk, long-term alternative for participating in the digital asset ecosystem. UE Crypto’s cloud mining services help investors move away from short-term market noise, focus on the long-term value of their assets, and establish more resilient and sustainable passive income.

Join UE Crypto now and earn daily passive income through a cloud mining digital asset platform.

A $116 million hardware wallet exploit has reignited an old Bitcoin question: what is the real risk trade-off between self-custody and using regulated products? The debate is heating up as US spot Bitcoin ETFs post strong inflows, suggesting institutional capital may be finding ways to participate in Bitcoin without directly taking on custody and operational risk.

Meanwhile, major companies across the sector are making moves that underline how intertwined Bitcoin, corporate balance sheets, and emerging AI compute demand are becoming. Strategy is preparing to resume Bitcoin purchases after a rare period of selling, Riot Platforms is reportedly pursuing a large AI-focused compute arrangement tied to its mining footprint, and Trump Media says it will rethink its crypto treasury approach after a sizable quarterly loss.

Key takeaways

• A Coldcard-linked hardware wallet exploit drained about $116 million in Bitcoin, adding fresh fuel to the self-custody versus custody-by-others debate.
• US spot Bitcoin ETFs reportedly saw roughly $1 billion in net inflows for the week, with Bloomberg analyst Eric Balchunas calling it one of the strongest periods since October.
• Strategy CEO Phong Le said the firm plans to resume Bitcoin accumulation later this year after selling in multiple quarters to support shareholder-related obligations.
• Riot Platforms is reportedly arranging 191 megawatts of compute capacity for a “leading frontier AI” project at its Texas campus, highlighting the economic pull of power availability.
• Trump Media is revising its digital asset treasury strategy after recording large unrealized losses and reshaping how it funds and manages its Bitcoin exposure.

Strategy signals a return to net buying

Strategy CEO Phong Le said the company plans to resume Bitcoin accumulation later this year, aiming to reinforce its long-term position after a stretch of smaller sales drew criticism against its earlier messaging. The firm has been publicly associated with a “never sell” posture, and the shift in behavior has become a key talking point for investors tracking whether the company remains purely acquisition-led.

According to Le, Strategy bought roughly 175,000 BTC and sold about 7,000 BTC this year, a ratio that indicates it remains net-buying in magnitude even if it has been selling at notable times. Strategy currently holds more than 840,000 BTC, making it the largest institutional Bitcoin holder.

Le also pointed to a pattern of discrete sell events. The company has reportedly sold Bitcoin on four occasions since May, most recently unloading 1,690 BTC to fund preferred dividends, buybacks, and a dollar reserve. That detail matters because it shows the tension between corporate treasury behavior and a strict “hold only” narrative: shareholders still require liquidity, while Bitcoin’s role in the treasury can put firms in a position where capital needs must be balanced against accumulation targets.

Third-party analysis referenced in the report suggests this model becomes harder when companies trade below their Bitcoin net asset value, because capital raises can be more dilutive and ongoing financing may be more difficult to sustain. For Strategy, that context helps explain why investors are watching not only the size of purchases, but the timing and stated intent around future net buying.

ETF inflows rise as self-custody concerns resurface

US spot Bitcoin ETFs are reportedly seeing renewed demand even while Bitcoin’s price action remains subdued. For the week, the ETFs attracted about $1 billion in net inflows, according to the report cited, marking the third-best week since October—an interval Bloomberg analyst Eric Balchunas described as Bitcoin’s “silent IPO.”

The “silent IPO” framing refers to the idea that early holders or initial investors may sell into a rising stream of institutional buying via ETFs, helping explain why new capital can flow in without immediately lifting prices. In that sense, the ETF rebound becomes more than a headline number: it’s a reminder that ETF demand can coexist with supply dynamics that keep the market from moving as fast as some observers expect.

The timing of this demand rebound is also notable given the hardware wallet incident. Earlier coverage highlighted a Coldcard exploit tied to faulty key generation that reportedly drained around $116 million worth of Bitcoin. Balchunas said the episode could ultimately improve ETFs’ attractiveness for investors who worry about self-custody risks—though he emphasized that the relationship may be correlative rather than causal.

He cautioned against assuming causation from any single data point, but suggested that “long-term” some investors may migrate toward ETF structures if self-custody concerns persist. For market participants, the practical takeaway is that custody risk is now part of the investor conversation—not just a technical footnote. If institutional investors continue to treat ETFs as the most operationally straightforward exposure route, demand could remain resilient even when broader confidence fluctuates due to security headlines.

Riot taps power for AI compute partnerships

Riot Platforms is reportedly working on a large compute arrangement tied to Bitcoin mining infrastructure. According to the report, Anthropic struck a $9 billion deal with Riot for 191 megawatts of capacity from Riot’s Texas campus, underscoring how access to reliable power is increasingly valuable as AI data center buildouts hit constraints.

Riot said it secured a 20-year agreement to supply 191 megawatts from its Rockdale campus to a “leading frontier AI” company, with Bloomberg identifying the counterparty as Anthropic. The announcement follows Anthropic’s reported $19 billion data center lease with TeraWulf, reinforcing the broader trend of AI firms seeking additional compute capacity and predictable energy sourcing.

The report places Riot among a growing set of miners expanding toward AI-adjacent strategies, naming Bitdeer, CleanSpark, MARA Holdings, Core Scientific, Hut 8, and IREN as other examples. While Bitcoin mining remains the original mission for these companies, the convergence with AI is shifting how investors think about their long-term asset value: power availability and grid agreements can become a “platform” for multiple high-demand workloads.

The cited discussion also notes that research from Bernstein has suggested partnerships between AI companies and miners could help alleviate power bottlenecks that restrict data center expansion. Even if the details of each company’s arrangement differ, the key point for crypto investors is that miners’ balance sheets and future cash flows may increasingly depend on energy leverage rather than solely on Bitcoin’s mining economics.

Trump Media revises its crypto treasury after large losses

Trump Media says it will revamp its digital asset treasury strategy after a $238 million second-quarter net loss, pointing to balance-sheet risks created by corporate holdings of crypto and crypto-adjacent securities. The company attributes part of the loss to unrealized mark-to-market swings across its digital assets and securities.

In its quarterly reporting, Trump Media reported $190.4 million in unrealized losses across its digital assets. The company also pledged digital assets and equity securities during the second quarter, reflecting how its treasury exposure is constrained by collateral requirements and counterparty structures.

Bitcoin holdings also changed over the quarter. Trump Media reported holding 9,477.16 BTC as of June 30, down from 9,542.16 BTC in the previous quarter. In July, it sold $159.6 million in Bitcoin-related securities and used the proceeds to buy more Bitcoin, increasing holdings to about 14,139 BTC worth $890.5 million by July 31.

Management warned that generating additional income from its Bitcoin holdings could expose the company to counterparty risk—particularly if a partner were to default or become insolvent. It also noted the possibility that, in some cases, it could be unable to recover Bitcoin committed under unsecured arrangements.

The company said it plans to direct more resources toward Truth Social, Truth+ and other media operations as part of a broader shift in capital allocation. For readers, this is a reminder that corporate crypto strategies are not purely about directional exposure; they also involve liquidity management, collateral frameworks, and the operational risks of funding structures that can carry different outcomes than spot holding alone.

Going forward, the market will likely watch whether ETF inflow strength persists as more security-related events test investor comfort with self-custody. At the same time, corporate decisions—whether Strategy’s stated intent translates into consistent net buying, and how companies like Riot and Trump Media manage compute demand or custody-related risk—will continue to shape how Bitcoin is absorbed beyond crypto-native participants.