Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

The Commodity Futures Trading Commission has prepared digital asset market structure proposals that could move forward even if Congress does not pass the CLARITY Act.

Whale Insider reported on Aug. 20 that Selig said the CFTC already had regulatory proposals prepared, giving the agency a route to continue its crypto agenda if lawmakers fail to complete the legislation.

Wall Street did not wake up one morning and decide it liked Bitcoin. It woke up and realized the custody fees were too large to leave on someone else’s balance sheet.

For most of the past decade, holding digital assets for institutions was a job only crypto-native firms would touch. Coinbase built a custody arm. BitGo pioneered multi-signature wallets for institutional clients. Anchorage Digital became the first federally chartered crypto bank. They earned the business because traditional banks either could not or would not hold the keys.

That era is ending. In the span of 18 months, BNY Mellon, State Street, Standard Chartered, U.S. Bank, and now Citigroup have either launched or committed to launching direct crypto custody services. The question is no longer whether banks will hold Bitcoin. It is what happens to the companies that held it first.

The regulatory gates that opened everything

Two regulatory changes made the bank custody wave possible, and both arrived within weeks of each other. Understanding the sequence matters because it explains why the bank entry wave happened in 2025 and 2026 and not before: the barriers were legal and accounting constraints, not technological ones.

In January 2025, the SEC rescinded Staff Accounting Bulletin 121 through SAB 122, removing the rule that had forced any company holding crypto on behalf of clients to record a corresponding liability on its own balance sheet. SAB 121 had been the single most effective barrier to bank participation in crypto custody since its introduction in March 2022. The math was simple and punishing: a bank holding $10 billion in client Bitcoin had to treat that $10 billion as its own liability, which meant setting aside capital against it. For institutions already managing trillions in traditional custody without any such requirement, the asymmetry made crypto custody economically irrational. No amount of client demand could overcome a rule that turned a fee business into a capital drain.

The OCC followed months later with Interpretive Letters 1183 and 1184, which confirmed that national banks and federal savings associations may custody crypto assets, execute buy and sell orders on behalf of custodial clients, and use sub-custodians for digital asset services. Critically, Letter 1183 also rescinded the requirement for banks to obtain supervisory nonobjection before engaging in crypto custody. Under the prior regime, a bank wanting to hold Bitcoin had to apply to its regulator and wait for written permission, a process that could take months and carried no guaranteed timeline. Removing that requirement turned crypto custody from a special privilege into a standard banking power.

Then came the GENIUS Act, signed into law in July 2025. While written primarily for stablecoins, the Act created new national trust bank charter pathways that Circle, Paxos, BitGo, Fidelity Digital Assets, and Ripple have all used to secure preliminary OCC approval. The OCC conditionally granted national trust bank charters to all five firms by the end of 2025. The legislation codified for the first time that digital asset custody is a permissible banking activity under federal law, not merely an interpretive stretch of existing authority. The Financial Stability Oversight Council simultaneously dropped its classification of crypto as a systemic “vulnerability,” signaling that the broader regulatory posture had shifted from containment to integration.

The combined effect was immediate. Within months of SAB 121’s repeal, BNY Mellon expanded its crypto ETF custody operations. State Street launched its Digital Asset Platform. Morgan Stanley applied for a bank charter specifically to custody crypto. Nomura’s Laser Digital applied for a U.S. national trust bank charter dedicated to crypto custody. Even Charles Schwab began exploring direct crypto services for its advisory clients. The regulatory question shifted from “may banks hold crypto?” to “how quickly can they staff up?”

Who is already live

The landscape of bank crypto custody in mid-2026 is more developed than most market participants realize.

BNY Mellon is the furthest along. The world’s largest custodian, with $59.4 trillion in assets under custody, began holding Bitcoin and Ethereum for ETF issuers in 2022 and has since expanded the service. In May 2026, BNY announced a collaboration with Finstreet Limited and ADI Foundation to offer crypto custody in Abu Dhabi Global Market, marking its first expansion of direct crypto custody outside the United States. BNY serves as custodian for Morgan Stanley’s MSBT Bitcoin ETF and as primary reserve custodian for Ripple’s RLUSD stablecoin.

State Street, the world’s second-largest custody bank at $51.7 trillion in assets under custody, launched its Digital Asset Platform in January 2026 in partnership with Taurus, a Swiss digital asset infrastructure provider. The platform supports wallet management, custody, and settlement for tokenized money market funds, ETFs, tokenized deposits, and stablecoins across both public and permissioned blockchains.

Cybersecurity firm Rapid7 has disclosed a large-scale cryptocurrency phishing and vishing campaign dubbed “Operation Asterix,” designed to compromise crypto investors by impersonating popular wallet brands and luring victims to fraudulent applications.

In its report released this week, Rapid7 says attackers obtained data tied to roughly 885,000 phone numbers across multiple countries, then used exchange-account matching to identify targets—ultimately queuing thousands of victim accounts associated with Binance for follow-on attacks.

Key takeaways

• Rapid7 estimates the campaign worked from a dataset of about 885,000 phone numbers, with a largest file containing 316,002 German mobile numbers.
• Rapid7 found evidence of matching 5,576 accounts associated with Binance users, “queued for attack.”
• Among validated exchange-linked targets, Rapid7 calculates an approximate 13.6% “hit rate” from the larger German dataset.
• The scheme used impersonation tactics aimed at seed phrase theft, including fake prompts and support-style outreach.
• Rapid7’s recovered artifacts indicate automated tooling, including use of AI, to support aspects of the campaign.

How Operation Asterix targets crypto users

Rapid7’s analysis, authored by Anna Sirokova and Jan Recinsky, describes how the attackers moved from acquisition of contact data to attempts at credential and seed phrase theft. The core technique involved directing victims to fake applications designed to impersonate wallets and wallet ecosystems.

According to the report, the fraudulent lures specifically referenced well-known self-custody brands including Ledger, Trezor, and Exodus. The attackers attempted to extract seed phrases by pushing victims toward the counterfeit software and accompanying “support” interactions.

Rapid7 also reports that outreach included both fake emails and phone-based inquiries, consistent with a phishing plus vishing workflow. In other words, the campaign wasn’t limited to a single lure method; it used layered contact channels to increase the odds of a victim engaging with the scam.

Target filtering and exchange-account matching

A major component of Rapid7’s findings is the apparent use of target filtering. The report indicates that the attackers matched 43,066 accounts connected to cryptocurrency users with exchange accounts, which were then validated against the larger set of over 316,000 German phone numbers. On that basis, Rapid7 calculates a “hit rate” of approximately 13.6% for the German dataset.

Rapid7’s findings go further by highlighting that the campaign included a checker for Kraken—used to bulk-validate phone numbers against accounts from that exchange. That implies the adversaries were not simply blasting contact lists; they were trying to confirm that particular numbers corresponded to exchange-registered identities before escalating.

For Binance specifically, Rapid7 says the campaign identified and queued 5,576 accounts for attack. The report frames this as a direct outcome of matching efforts tied to the wider phone-number dataset.

Seed-phrase theft via wallet spoofing

Rapid7’s recovered artifacts point to a strategy aimed squarely at self-custody weaknesses: the combination of wallet brand impersonation and human trust in “official” support channels. Rapid7 says victims were driven to fake apps that mimicked Ledger, Trezor, and Exodus, with the goal of stealing seed phrases.

This matters because seed phrases remain the highest-value target in many crypto theft attempts. Once a seed phrase is obtained, the attacker can often access the associated wallets without needing to bypass complex cryptography—making social engineering a uniquely effective attack surface in practice.

Rapid7’s report also notes that the campaign used AI tools as a significant part of operations. While the disclosure does not provide step-by-step details of how AI was applied, it supports the broader pattern that attackers increasingly rely on automation to scale personalization, message creation, and workflow management.

Why this fits the wider pattern of crypto fraud

Operation Asterix arrives amid a continued run of phishing and social engineering losses across the sector. Hacken, a blockchain security company, reported that phishing and social engineering scams accounted for $306 million of the $482 million lost in the first quarter of the year—according to Rapid7’s reference to Hacken’s figures.

That concentration underscores an ongoing asymmetry in crypto security: many of the most costly incidents still involve attackers exploiting user behavior rather than breaking protocol rules. In that environment, phone-number datasets and exchange-account matching can become especially dangerous, as they help scammers reach likely victims through direct, targeted contact.

The tactics described in Rapid7’s report also echo prior industry incidents: Cointelegraph previously reported on a Trezor customer data breach involving about 14,000 users via its shipping provider, ShipMonk, earlier in August; a nearly $1 million loss for an investor after signing a malicious phishing token approval transaction on Ethereum in July; and a fake Ledger Live app incident on the Microsoft Store in November 2023 that resulted in theft of $588,000 across 38 transactions.

Earlier onchain reporting has similarly highlighted how scammers can use mainstream platforms to distribute fake prompts; Cointelegraph has noted cases where malicious ads impersonating Uniswap appeared via Google, leading to losses reportedly exceeding $400,000.

What to watch next

Rapid7’s disclosure is likely to raise renewed attention on how attackers blend contact-data targeting with wallet brand impersonation and automated tooling. Investors and builders should watch for follow-on indicators such as new fake wallet app deployments and continued exchange-linked targeting methods, while the industry works toward reducing the human friction that scammers rely on.