A fake desktop application impersonating Anthropic’s Claude is reportedly being used as a delivery mechanism for RevStealer, a Windows malware strain designed to steal crypto-related data and other sensitive information. Researchers at Morphisec say the campaign has evolved beyond earlier distribution channels, including GitHub repositories and game-cheat themed sites, and that the “Claude Opus 5 Free Desktop” lure is now among the most prominent.

While the technical details are aimed at defenders, the operational choices behind RevStealer carry direct implications for users and anyone investing in or managing digital assets: the malware is built to avoid analysis, profile the infected machine, and then extract high-value information across browsers, password managers, wallet software, and even selected documents.

Key takeaways

• RevStealer is delivered via a fake “Claude Opus 5 Free Desktop” Windows app that impersonates Anthropic and offers supposed free access.
• The malware is designed to leave minimal traces and harvest browser data, cookies, password-manager records, VPN/remote-access settings, screenshots, and selected files.
• It targets more than 50 cryptocurrency wallets and can also capture messaging data and other credentials beyond crypto holdings.
• Before executing, it checks system characteristics consistent with real user environments and aborts if it detects signs of analysis or abnormal conditions.
• Curious about broader context: Morphisec’s report follows Kaspersky’s earlier identification of OkoBot, a separate framework aimed at crypto investors.

A Claude-themed lure masks a crypto-stealing payload

In a Monday report, cybersecurity firm Morphisec described how RevStealer has been distributed through multiple fronts, with earlier campaigns using GitHub repositories and game-cheat themed websites. The latest and most notable delivery method, the researchers said, is a project branded as “Claude Opus 5 Free Desktop” that impersonates Anthropic and promises free access to Claude.

From an attacker’s perspective, this approach is logical: it repackages a familiar consumer brand into a Windows installer or desktop program, lowering user skepticism and increasing the odds that victims will run the malicious payload.

Designed to extract high-value data from browsers, wallets, and more

Morphisec’s analysis portrays RevStealer as a multi-purpose stealer. The malware not only searches browser databases and cookies, but also looks for password-manager records and configurations tied to privacy and remote access. In addition, it targets VPN and remote-access settings and collects messaging data, which can reveal account recovery paths, authentication workflows, or direct access tokens.

For crypto users, the most significant operational detail is wallet targeting. Morphisec said RevStealer targets over 50 cryptocurrency wallets, positioning the malware to compromise both the user’s general credentials and the specific applications most likely to contain or facilitate asset management.

The report also notes that the malware can capture screenshots and selected documents. That matters because some users store seed phrases, backup codes, or operational instructions in non-wallet files—making document harvesting an extra layer of financial opportunity for attackers.

Execution gating: it tries to spot “analysis” before it acts

One of the more defensive-relevant elements of RevStealer, according to Morphisec, is the way it determines whether a machine resembles a real user environment. The malware checks available memory, the number of CPU cores, hostname and username information, and graphics hardware characteristics. It also monitors for debugging delays that are typical in malware analysis setups.

If the checks fail—if the system presents signals that look automated, instrumented, or otherwise atypical—RevStealer does not progress to the next stages of infection and malicious activity.

When the system passes, the malware decrypts its payload, stores it under a randomly generated name, and executes it covertly. This workflow is designed to reduce the chance that researchers can quickly identify the complete payload chain and to make behavioral detection harder when the malicious component only activates under specific conditions.

RevStealer follows a wider pattern of crypto-investor targeting

The Morphisec report arrives after earlier reporting by Kaspersky on a new malware framework targeting cryptocurrency investors called OkoBot. Kaspersky’s description, as referenced in Morphisec’s write-up, indicates that OkoBot can harvest crypto wallet files and browser data, steal user credentials, inject malicious extensions, and capture wallet application windows to help redirect or siphon assets.

Taken together, the two stories suggest a persistent trend: attackers are not limiting themselves to “wallet-only” theft. Instead, they are expanding into browser and credential ecosystems, then coupling that access with wallet application targeting and, in RevStealer’s case, extensive environmental checks to avoid discovery.

For investors, traders, and operators of digital asset infrastructure, this matters because compromises rarely begin in the wallet UI itself. The intrusion surface is often broader: downloadable “desktop” apps, browser states, stored credentials, and remote-access configurations that attackers can convert into the ability to act on funds.

What to watch next

With fake Claude desktop projects being used to deliver a stealer that targets both wallets and sensitive browsing credentials, users should watch for new impersonation campaigns and suspicious installers that promise free access to popular AI tools. On the defensive side, prioritizing endpoint protection, restricting execution of unknown binaries, and maintaining clean browser and password-manager hygiene may help reduce the odds that malware like RevStealer finds a usable environment before it can activate.

Identity verification is becoming a core part of the DeFi stack as developers look to embed reusable credentials, privacy-preserving proofs and compliance checks directly into lending, payments, stablecoins and tokenized asset platforms.

As decentralized finance expands into lending, payments, stablecoins and tokenized real-world assets, applications increasingly need ways to establish whether users meet specific requirements without turning every interaction into a traditional onboarding process.

That is driving interest in the embedded verification SDK: infrastructure developers can integrate directly into an application to handle identity, credentials or access requirements without sending users through disconnected experiences.

The strongest solutions for DeFi go further. They are increasingly focused on reusable credentials, privacy-preserving proofs and interoperability across applications and chains.

Here are five embedded verification SDKs and identity platforms worth watching in 2026.

1. AIR by Moca Network

AIR is a particularly interesting option for platforms that want verification to become part of a broader financial experience.

AIR Kit is Moca Network’s modular SDK for embedding identity, fintech services and programmable loyalty through one integration. Businesses can start with its identity functionality before expanding into additional modules.

For DeFi applications, AIR Identity is the most relevant component. It enables platforms to work with reusable credentials and verify user information without necessarily accessing the underlying raw data. Businesses can establish which credentials are shared, with whom and under which conditions.

The distinction is important: AIR is not itself positioned as a replacement for the underlying KYC or identity verification provider. Instead, it can consume those verification primitives and transform verified information into reusable, user-consented credentials and proofs.

That model can be useful for DeFi because a user’s verified status does not necessarily have to remain trapped inside one onboarding flow. Credentials can instead become portable infrastructure for determining eligibility across applications and services.

AIR also has a direct connection to zero-knowledge KYC infrastructure. zkMe joined the Moca ecosystem as an issuer of demographic and financial credentials, with AIR Kit enabling credentials including age, citizenship, location, credit score and investor accreditation to be reusable across applications and chains.

Best for: DeFi and fintech platforms looking for reusable identity infrastructure that can eventually connect verification with payments and loyalty.

2. zkMe

zkMe is built specifically around reusable zero-knowledge KYC for open finance.

Its infrastructure covers individual KYC, business verification, transaction monitoring and other credential types, with an emphasis on minimizing exposure of underlying personal information. Its SDK allows developers to integrate the verification flow directly into their front end.

The DeFi proposition is particularly clear. zkMe lists support for permissioned DeFi pools, compliant launchpads, stablecoins and tokenized real-world assets, and says its infrastructure operates across more than 30 blockchains.

For developers building regulated or permissioned financial products on-chain, the combination of reusable credentials, zero-knowledge proofs and multi-chain support makes zkMe one of the more DeFi-specific options available.

Best for: DeFi, RWA and stablecoin applications requiring privacy-preserving KYC and compliance credentials.

3. Privado ID

Privado ID takes a decentralized identity approach to verification, using verifiable credentials and zero-knowledge technology to allow users to prove information about themselves.

This architecture fits an important DeFi requirement: separating the verification of a claim from unnecessary disclosure of the information behind it.

For example, an application may need to establish whether a wallet belongs to an eligible participant without putting that person’s complete identity on-chain. Credential-based identity systems can make those types of conditional access models possible.

That makes Privado ID relevant to developers exploring permissioned DeFi, tokenized assets and other applications where identity needs to interact with smart contracts without making personal data public.

Best for: Developers seeking decentralized identity and zero-knowledge credential infrastructure.

4. Sumsub

Sumsub approaches embedded verification from a more traditional compliance direction.

Its SDK infrastructure supports identity verification within existing products, while its broader offering covers areas including KYC, KYB, AML screening and transaction monitoring.

For DeFi companies moving toward regulated financial services, this more comprehensive compliance approach can be useful. A protocol connecting with fiat infrastructure, operating tokenized assets or serving regulated jurisdictions may need considerably more than a simple proof-of-personhood check.

The trade-off is philosophical as much as technical. Sumsub is closer to conventional compliance infrastructure than decentralized, reusable identity. That can make it well suited to businesses prioritizing established KYC workflows over self-sovereign credential models.

Best for: Crypto and DeFi businesses requiring a broader traditional compliance stack.

5. Civic

Civic has long focused on bringing identity and access infrastructure into Web3.

Its current Civic Auth Web3 SDK combines authentication with embedded wallets, supporting Ethereum and a range of EVM-compatible networks as well as Solana. This can help applications onboard users without requiring them to arrive with an existing crypto wallet.

There is an important caveat for anyone comparing verification SDKs in 2026. Civic announced in 2025 that its Civic Pass identity verification, uniqueness and liveness products were being discontinued as the company shifted its focus toward Civic Auth and newer identity infrastructure.

That makes Civic more relevant today for Web3 authentication and wallet onboarding than as a direct equivalent to reusable KYC products such as zkMe.

Best for: Web3 applications prioritizing authentication and embedded wallet onboarding.

Why embedded verification matters for DeFi

The larger shift is from identity verification as a one-time compliance checkpoint to identity as reusable financial infrastructure.

A lending protocol might need proof that a participant meets jurisdictional requirements. An RWA marketplace may need investor accreditation. A token launch may need Sybil resistance, while another application may simply need to know that a user has already completed an approved KYC process.

None necessarily needs every piece of the user’s identity every time.

Embedded verification SDKs make it possible to bring these checks closer to the application layer. Reusable and privacy-preserving credentials take the idea further by allowing verified attributes to travel between compatible services.

That could prove particularly important for DeFi.

Open financial infrastructure depends heavily on composability. If identity develops in the same direction, credentials could become another interoperable primitive, allowing applications to verify what they need while reducing repeated onboarding and unnecessary disclosure of personal information.

For developers choosing an embedded verification SDK, the question is therefore becoming bigger than “can this provider perform KYC?”

The more important question may be: What can the application do with a verified identity after the verification is complete?

ETF inflows have broken the historical record of $1.66 billion, while XRP prices continue to decline amid market volatility. UE Crypto has launched a new cloud mining smart contract, and its return mechanism has attracted significant attention from XRP holders.

On August 31, XRP was trading at approximately $1.37, down about 2% over the previous 24 hours. Market attention has shifted toward the upcoming Senate vote on September 15, which could have a significant impact on XRP’s near-term price performance.

This procedural vote concerns a motion to invoke cloture on the Digital Asset Market Clarity Act, commonly referred to as the CLARITY Act. Reaching the required 60-vote threshold would only advance the bill to full Senate debate and would not guarantee its final passage.

Prediction platforms show that the situation has changed significantly. At present, the probability of the bill being passed in 2026 is estimated at approximately 14%, down sharply from 82% in February. Democratic lawmakers insist that stricter provisions regulating cryptocurrency transactions by political officials be included in the bill as a condition for their support.

Michael Selig, Chairman of the U.S. Commodity Futures Trading Commission (CFTC), has publicly stated that the agency has sufficient authority to regulate the cryptocurrency market under the current legal framework. In addition, on August 18, the U.S. Securities and Exchange Commission (SEC) released its “Crypto Asset Regulatory Framework,” which contains several definitional elements consistent with the CLARITY Act.

Crypto analyst XrpArab noted on August 31 that CFTC Chairman Michael Selig appeared optimistic about the outcome of the September 15 Senate hearing. The analyst highlighted several unresolved complexities and discussed the potential consequences if the cloture motion fails before the October election recess.

Unprecedented ETF fund flows reflect growing institutional demand

XRP exchange-traded funds recorded their highest-ever weekly inflows, totaling $110.49 million. On August 28 alone, net inflows reached $26.2 million, bringing cumulative net inflows to $1.66 billion.

Cumulative ETF net inflows have reached a record $1.66 billion. However, XRP prices have not surged accordingly and have instead experienced a pullback, further increasing investor caution.

Short squeezes, steady ETF inflows, and indications of Treasury buybacks have driven the broader market trend. However, despite these positive factors, because earnings determine actual spreads, these favorable conditions have produced significantly different results across various cryptocurrency stocks.

Weak performance offsets XRP’s overall uptrend

Although Bitcoin continued its rally in late August, cryptocurrency stocks with disappointing earnings declined. Investors viewed the promotion of cloud mining contracts as an alternative for XRP holders seeking returns beyond price appreciation, with daily returns varying by contract. This model has also demonstrated the ability of XRP holders to identify opportunities and potentially generate returns despite fluctuations in market prices.

Against this backdrop, an increasing number of investors are paying attention to the UE Crypto cloud mining platform, exploring potential sources of returns beyond simply holding digital assets. Compared with strategies primarily based on price speculation, cloud mining provides a different approach to generating returns from digital assets, even during periods of short-term price volatility.

Therefore, XRP’s current price performance cannot be attributed entirely to ETF inflows. Multiple factors, including ETF fund flows, “whale” trading activity, on-chain activity, and overall market sentiment, may have a significant impact on XRP’s subsequent price performance and broader market trends.

As market volatility increases, more investors are seeking ways to participate in digital assets beyond simple price speculation. UE Crypto provides a sustainable-energy-based cloud mining solution, offering investors a more structured channel to explore the digital asset ecosystem while focusing on the long-term value of XRP and expanding diversified sources of returns.

Through cloud mining, users can participate in the operation of blockchain infrastructure and earn returns according to predetermined rules, creating a cash-flow-oriented participation model without the need to deploy dedicated mining hardware or possess advanced technical expertise.

Compared with traditional mining models, cloud mining can reduce the burden associated with purchasing mining equipment, securing electricity supplies, maintaining hardware, and handling daily operations. The platform manages computing power allocation, technical maintenance, and related operations. Users can select an appropriate computing power plan according to their needs and monitor operational and return data through an automated system, allowing them to participate in digital asset mining more conveniently.

About UE Crypto

UE Crypto was established in 2015 and is headquartered in the United Kingdom. The company states that its operations follow relevant European regulatory frameworks, including the Markets in Crypto-Assets Regulation (MiCA) and the Markets in Financial Instruments Directive II (MiFID II), while continuously improving transparency, operational standards, and user protection mechanisms.

In terms of security and compliance, the platform states that it has implemented the following protective measures:

• Annual financial and security audits conducted by PwC
• Custodial digital asset insurance provided by Lloyd’s
• Enterprise-level security solutions from Cloudflare and McAfee®
• Bank-grade data encryption and professional security infrastructure to provide multiple layers of protection for user assets and accounts.

Currently, UE Crypto supports a range of major crypto asset payments, including XRP, BTC, ETH, USDT, BNB, ADA, USDC, DOGE, LTC, and SOL, providing users with a more flexible way to participate in digital asset services.

Join for free, Learn with ease: Start your UE Crypto journey in 3 steps

Step one: Register an account

Register a free account on the official UE Crypto platform using your email address. New users can receive a $20 trial reward.

Step two: Choose a mining package

Choose a suitable cloud mining contract based on your personal budget and requirements, then start mining with one click.

Step three: Start earning

Once the contract is activated, the system will automatically allocate computing power, and returns will be settled automatically every 24 hours. Users can withdraw their returns at any time or continue participating as needed to achieve long-term compound growth of their assets.

Popular UE Crypto contracts

BTC (Super computing system contract)

Investment Amount: $1,000
Investment Term: 10 days
Daily Return: $13.10
Principal Returned at Expiry: $1,000 + $131 return

LTC (Algorithm-driven system contract)

Investment Amount: $5,000
Investment Term: 25 days
Daily Return: $72
Principal Returned at Expiry: $5,000 + $1,800 return

BTC (Quantitative intelligent system contract)

Investment Amount: $10,000
Investment Term: 34 days
Daily Return: $158
Principal Returned at Expiry: $10,000 + $5,372 return

For more details about the contract plans, please visit the official UE Crypto website.

Conclusion

Continued net inflows into XRP ETFs further demonstrate institutional demand for XRP and sustained market interest. However, growth in ETF assets does not necessarily mean that XRP’s price will rise at the same pace. XRP’s current market performance continues to be influenced by multiple factors, including “whale” fund movements, on-chain capital flows, and overall cryptocurrency market sentiment.

For long-term XRP investors, in addition to continuously monitoring price movements and ETF fund flows, exploring more diversified ways to participate in the digital asset ecosystem is also worth considering. Through cloud mining and related digital asset infrastructure, UE Crypto provides investors with another channel to participate in the digital asset ecosystem, enabling them to focus on the long-term value of XRP while exploring potential diversified sources of returns and further refining their long-term asset allocation strategy.

“As a traditional financial investor, I place great importance on the platform’s compliance and transparency. UE Crypto provides daily return reports, and checking my returns every morning has become part of my routine. This is much easier than any side business I have done in the past.”

For more information, please visit the official website and download the application.

Ethena has launched Ethena Pay in beta for 400 early users, bringing USDe payments, Avalanche settlement and annual reward rates of up to 6% to a self-custodial mobile app.

Ethena Pay connects USDe balances with daily payments

Ethena said in a launch announcement that Ethena Pay will begin with an early-access group of 400 users before adding more participants each week. The company plans to increase access throughout September as the app moves beyond its initial beta stage.

Available on iOS, the app combines a self-custodial crypto wallet with bank transfers, fiat on-ramps and a Visa payment card. A user’s dollar balance is held in USDe, Ethena’s synthetic dollar, while Avalanche processes transfers, purchases, and settlement behind the app’s consumer-facing interface.

Advertisement

Users can receive fiat through assigned International Bank Account Number details or transfer crypto directly to their wallets. In either case, the received balance appears as USDe. Withdrawals sent to external bank accounts can be converted into the recipient’s local currency, according to Ethena.

Payments between Ethena Pay users can also be sent through a username or payment tag instead of a blockchain address. Ethena said transfers between app users carry no fee, while bank transfers denominated in U.S. dollars, euros, and British pounds are also free. Other bank transfers may cost between 0.05% and 0.1%.

The beta is available across 49 countries in Latin America, the Caribbean, Asia, the Middle East, Africa, and Oceania. Ethena Pay’s supported-market list includes countries such as Brazil, Mexico, Australia, Japan, Singapore, the United Arab Emirates, Kenya and South Africa, although individual products remain subject to local eligibility rules.

Advertisement

Ethena Pay rates depend on membership tier

Ethena Pay divides its balance rewards across Standard, Pro, and VIP tiers. Standard users can receive a total annual rate of up to 5% on eligible balances capped at $5,000.

Pro users can receive up to 6% on a maximum eligible balance of $15,000, while the VIP tier applies the same 6% rate to as much as $50,000. Amounts above each limit continue to receive the prevailing USDe base rate but do not qualify for the added Daily Boost.

Rather than adding a separate 6% payment to USDe’s existing rate, Ethena Pay uses the Daily Boost to bring eligible balances up to the advertised total. If the USDe base rate increases, the boost becomes smaller; if the base rate falls, the boost grows to maintain the applicable tier rate. No boost applies when the base rate exceeds the tier’s stated rate.

Calculated from a user’s time-weighted average daily balance, the boost is normally paid in USDe within 24 hours after the accrual day ends. Ethena Pay requires users to complete at least one qualifying card transaction during each calendar month to receive it.

Advertisement

Despite the app’s consumer-facing rate display, Ethena Pay’s terms describe the Daily Boost as a discretionary promotional incentive rather than interest, yield or a deposit product. The company also states that the balance and related rewards are not covered by the U.S. Federal Deposit Insurance Corporation or any other government-backed deposit insurance program.

Standard membership is free. Pro access can be obtained by locking $2,000 worth of ENA or referring 10 eligible users, while VIP membership requires $10,000 in locked ENA or 50 referrals, according to launch details reported by The Block.

Ethena’s balance model relies partly on returns generated from the assets supporting USDe. In August, Ethena and FalconX opened a $1 billion facility that uses part of USDe’s backing portfolio to finance secured, overcollateralized loans for institutional borrowers.

According to crypto.news, institutional lending already accounted for $310 million, or 6.9%, of USDe’s backing in early July. The reported portfolio also included roughly $2 billion in decentralized finance lending, about $1.2 billion in liquid stablecoins, and additional exposure to tokenized assets.

Advertisement

Self-custody leaves recovery with the user

Ethena Pay Ltd., a Malta-registered software company, states that it does not operate as a bank, broker-dealer, investment adviser or money services business. Third-party providers supply the financial services accessible through the app.

Under its self-custodial design, private keys, seed phrases and wallet recovery details stay on the user’s device. Ethena Pay says it cannot access customer assets or restore a wallet when the user loses the credentials needed to enter it.

The Visa Spend Card is issued by Third National, a Puerto Rico-chartered bank, under a Visa license. Signify Holdings, which operates as Rain, manages the card program.

Qualifying purchases earn cashback in AVAX rather than dollars or USDe. Standard users receive 4% on the first $2,500 spent each month, while Pro members earn 4.5% on their first $8,000 and VIP users receive 5% on their first $20,000.

Advertisement

Rates decline in bands after users cross those spending limits. For example, the Pro rate falls to 2% between $8,000 and $10,000, then to 1% from $10,000 to $12,000, and 0.5% above $12,000. Each lower rate applies only to spending within that band rather than repricing earlier purchases.

Ethena Pay excludes several categories from cashback, including ATM withdrawals, cash advances, gambling, gift cards, account funding, peer-to-peer transfers, and purchases of cryptocurrencies, stablecoins, non-fungible tokens, or securities. Transactions below $1 also receive no cashback.

Once a card payment settles, normally within one to three business days, the dollar value of the reward is converted into AVAX at the rate available when the credit is issued. Ethena Pay warns that its dollar value can rise or fall after reaching the user’s wallet because AVAX remains exposed to market movements.

U.S. users remain outside the Ethena Pay rollout

For U.S. readers, the main restriction is direct access. Ethena Pay is not yet available in the United States, and its card terms exclude U.S. citizens, residents and other U.S. persons even though the issuer is chartered in Puerto Rico.

Advertisement

The European Union, the United Kingdom, and Canada are also outside the initial release. Ethena has listed those markets for a later rollout, but access will depend on regional requirements and product approvals.

American investors can still obtain indirect public-market exposure to Ethena’s ecosystem through StablecoinX, which trades on Nasdaq under the ticker USDE. The company held approximately 3.03 billion ENA tokens valued at about $275 million when its merger with TLGY Acquisition Corp. closed in June.

Institutional access has developed through a separate channel. In June, BlackRock integrated USDe into Aladdin, its investment and risk-management platform used by institutions overseeing more than $20 trillion in assets. BlackRock’s BUIDL tokenized money-market fund was also selected as the main reserve asset for Ethena’s white-label stablecoin product.

Avalanche handles the app’s settlement activity

Avalanche serves as the exclusive settlement network for Ethena Pay, covering transfers, card-related money movement, and payments, while the blockchain layer remains largely hidden from users.

Advertisement

The network has already supported card and corporate-payment trials involving stablecoins. In July, Hyundai Card completed a $20,000 transfer between Hyundai Motor’s U.S. and Mexican entities using USDT on Avalanche.

Hyundai Card said the intercompany settlement took about seven minutes, compared with the three to four hours usually required for a conventional bank transfer. The company handled the project’s regulatory reviews, legal and tax assessments, internal controls, and remittance design, while blockchain payments provider Axiym also participated.

Judge Colleen McMahon has dismissed Burwick Law’s claims against Solana Labs, Solana Foundation, and its execs as part of the ongoing Pump Fun lawsuit. 

Yesterday’s court filing revealed McMahon’s orders that either denied or approved Pump Fun’s various motions to dismiss allegations put forward by Burwick Law. 

Racketeering (RICO) allegations that accuse Pump Fun’s parent company, Baton Corporation, and its executives, Noah Bernhard Hugo Tweedale, Alon Cohen, and Dylan Kerler, of wire fraud, illegal gambling, and unlicensed money transmission were upheld.

These two allegations were submitted by plaintiffs Carnahan and Okafor, but RICO claims put forward by the plaintiff Aguilar were dismissed. 

Pump Fun memecoins FRED and GRIFFAIN are not securities 

The judge also dismissed allegations that Pump Fun defendants broke the Securities Act by offering unregistered securities. 

They claim the two memecoins FRED and GRIFFAIN did not entail a “common enterprise” and, as such, do not fulfill the Howey Test. 

Crypto law firm founder Ariel Givner has noted, however, that this ruling does not mean all memecoins aren’t securities. She stressed this ruling only applies when a memecoin does not offer a shared goal of profits rising for everybody. 

Allegations of unjust enrichment were also dismissed from the suit. 

Read more: Iggy Azalea allegedly mis-sold MOTHER, leading to investor losses

Burwick Law hasn’t served 25 unnamed KOLs yet

The judge has also asked Burwick Law to explain why it hasn’t been able to serve 25 key opinion leaders (KOLs) since the lawsuit was filed in January 2025.

It accused the unnamed KOLs of promoting Pum Fun tokens and, in some cases, “concealing both their compensation and their own preexisting positions in the tokens they promoted.”

Burwick Law has until September 10 to explain why these KOL claims “should not be dismissed for failure to identify and serve them.”

Advertisement

The crypto influencer “Scooter” was named as one of these defendants in a previous filing. They shortly threatened to sue Burwick Law for “potential defamation.”

Solana Labs and Jito Labs were added last year

Burwick Law’s lawsuit added Solana Labs and Solana Foundation over a year ago. 

It claimed the two worked together to avoid US securities laws and extract capital from the US market. 

Read more: Burwick Law chief refuses to comment on Dogshit2 memecoin

Advertisement

It argued that Solana crypto infrastructure provided “no investor protections, disclosure obligations, or legal accountability” for the memecoin craze and its losses.

Jito Labs was also added alongside Solana Labs as a lawsuit defendant. However, Burwick Law voluntarily dropped Jito Labs months later.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Advertisement

A fake Claude desktop application is reportedly being used to distribute RevStealer, a Windows malware strain built to steal crypto, password and browser data.

According to a Monday report by cybersecurity company Morphisec, RevStealer was previously distributed through GitHub repositories and game-cheat-themed sites but the most notable is a fake “Claude Opus 5 Free Desktop” project that impersonates AI developer Anthropic and promises free access to Claude.

The researchers noted that the malware is designed to leave few traces and searches browser databases, cookies, password-manager records, VPN and remote-access settings, messaging data, screenshots and selected documents. RevStealer also targets over 50 cryptocurrency wallets.

The malware checks whether the machine looks like a real user device before unlocking its malicious payload, looking at available memory, the number of processor cores, hostname, username and graphics hardware. It also monitors for the debugging delays typical of malware analysis environment.

If RevStealer detects anything out of the ordinary, it does not move on to the next stages of infection and malicious activity. If the system passes those checks, the payload is decrypted, stored under a random name and covertly executed.

The report follows the discovery by Russian cybersecurity company Kaspersky of a new malware framework targeting cryptocurrency investors called OkoBot, which can harvest crypto wallet files, browser data and user credentials, inject malicious extensions and capture wallet application windows to steal assets.

Related: Microsoft warns users of ‘Crypto Clipper’ malware spread via USB drives

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

• KuCoin adds UTA support to its institutional lending program.
• New API clients face a lower 30-day volume requirement of 10M USDT.
• Eligible institutions can borrow up to 3M USDT across key products.

KuCoin has upgraded its Institutional Interest-Free Lending Program by integrating support for its Unified Trading Account (UTA), as the crypto platform looks to streamline capital management for institutional clients.

The upgrade reduces the qualifying external 30-day trading-volume requirement for newly registered API clients from 30 million USDT to 10 million USDT.

Eligible clients can also access 0% interest for the first two months without a trading-volume requirement.

Under the upgraded program, eligible institutional clients can borrow up to 3 million USDT.

Borrowed funds can be used across Spot, Margin, and Futures trading, while borrowing is available in USDT, USDC, Bitcoin, and Ethereum.

KuCoin integrates lending with unified accounts

The integration is designed to reduce capital fragmentation between separate trading accounts.

KuCoin said institutions operating across multiple products and strategies can face higher costs and operational friction when capital is divided between accounts.

UTA provides eligible users with a single account structure for managing capital across supported trading products.

With institutional lending integrated into the framework, borrowed funds can be deployed across Spot, Margin and Futures without requiring transfers between separate trading accounts.

The setup is intended to bring financing closer to execution and allow professional trading teams to deploy collateral and capital more efficiently.

KuCoin said the upgraded infrastructure is focused on how institutions access, manage, and deploy digital assets across different trading strategies.

Lending program expands from targeted credit

KuCoin introduced targeted interest-free credit in 2024, initially offering eligible API traders and quantitative teams access to up to 500,000 USDT alongside benefits including fee support, enhanced connectivity, higher API limits and technical assistance.

In 2025, the borrowing limit increased to 3 million USDT.

The program also added support for multiple borrowing assets and allowed clients to combine funds from sub-accounts as margin across eligible products.

The 2026 upgrade represents the latest stage of the program’s development, moving beyond targeted credit support toward a more integrated institutional capital infrastructure, according to the company.

The latest changes also lower the entry requirement for newly registered API clients, potentially expanding access to the lending program.

KuCoin highlights capital efficiency for institutions

Alison Qin, Head of KuCoin Institutional & VIP, said professional market participants require flexible and capital-efficient access to liquidity.

She added that institutional lending infrastructure needs to combine financing at scale with tailored terms and competitive pricing to support sophisticated trading strategies.

Qin said integrating lending with UTA brings capital closer to the accounts and products used for those strategies, while helping clients maintain control over execution and risk.

The company said the upgrade forms part of its broader product development strategy, connecting financing, account infrastructure and execution for institutional users participating in the digital asset market.

Founded in 2017, KuCoin said it serves more than 45 million users across more than 200 countries and regions.

The platform provides access to more than 1,500 digital assets and said it has built a compliance framework that includes AUSTRAC registration in Australia, a MiCA license in Europe, and regulatory progress in other markets.