Prediction market platform Kalshi has imposed lifetime and multi-year trading bans on US House of Representatives candidates Laurie Buckhout and former Republican lawmaker George Santos, citing violations of rules that prohibit traders who can influence an event’s outcome from trading on contracts tied to that same event.

The compliance notices, announced Friday, mark one of Kalshi’s most serious enforcement actions since the platform launched in 2021. They also land amid heightened political and regulatory scrutiny of prediction markets, particularly claims that some event contracts could be manipulated.

Key takeaways

• Kalshi permanently suspended George Santos from trading on its prediction markets and imposed a $71,356 penalty, according to a settlement notice.
• Laurie Buckhout received a three-year trading suspension and a $2,590 penalty following Kalshi disciplinary action.
• Kalshi tied both restrictions to alleged rule-breaches involving event contracts that could be influenced by the candidates’ own actions.
• The moves follow broader enforcement concerns as regulators and lawmakers push back on whether prediction markets can be adequately controlled against manipulation.

Lifetime ban for George Santos after alleged event-linked trading

In its notice of settlement of disciplinary action, Kalshi said it had permanently suspended Santos from trading on the platform and assessed a $71,356 penalty. The company’s account attributes the action to investigation findings that Santos traded using event contracts connected to matters tied to his own public schedule and actions.

Kalshi said Santos “engaged in trading activity in certain markets related to his attendance at the State of the Union address” in February 2026. Under Kalshi’s rules, the platform prohibits trading on contracts where the trader is a decision maker, or has any influence—direct or indirect—over the outcome of the underlying event.

“If a Trader is a decision maker, either directly or indirectly, or has any influence, directly or indirectly, no matter the scale and importance of the influence, on the outcome of the Underlying event of any Contract, that Trader is prohibited from attempting to enter into any trade, either directly or indirectly, on the market in such Contracts,” Kalshi’s rules state.

Notably, Kalshi’s compliance notice did not say whether Santos cooperated with the investigation. Santos, however, publicly disputed Kalshi’s approach afterward, calling the platform “unserious” in a post on X.

Three-year suspension for Buckhout tied to her own candidacy

Kalshi said its investigation into Buckhout led to a three-year suspension from trading and a $2,590 penalty. In its notice of settlement, the company described Buckhout—running in North Carolina’s 1st congressional district—as having announced her candidacy and being added as a market option for a contract on the North Carolina congressional election.

In describing the conflict, Kalshi referenced its rules on influence over an event’s outcome, emphasizing that if a trader has any meaningful ability to affect the underlying result, they are barred from trading on related contracts. Kalshi’s compliance department reported that Buckhout “cooperated with the inquiry” and agreed to the trading ban and penalty.

Buckhout remains a Republican candidate for the 2026 midterm elections in North Carolina’s 1st congressional district. Reports also indicated her comment after the settlement characterized her alleged conduct as a “dumb mistake.”

Why Kalshi’s enforcement matters for prediction market trust

These settlements are significant not only for the individuals named but also for how prediction markets defend themselves against manipulation concerns. Kalshi’s argument is essentially compliance-based: once someone can plausibly affect or influence an event tied to a market—whether by office-holding, public participation, or other decision-making—the market platform draws a line between ordinary speculation and trading while holding influence over the event.

That stance comes as prediction market platforms continue to face pressure from both federal and state authorities. Kalshi has already been in the crosshairs over event-contract conduct, and the new enforcement actions can be read as part of a broader attempt to demonstrate internal policing.

The same tension has also appeared in enforcement actions involving people connected to political communications. Earlier, federal regulators fined Gabriel Perez, described as President Donald Trump’s teleprompter operator, after trading event contracts on Kalshi related to Trump’s speeches. Kalshi’s latest disciplinary actions, while involving different individuals and circumstances, reinforce the idea that regulators and lawmakers are watching whether event markets can be gamed by participants whose own actions shape outcomes.

Prediction markets still face a legal battle over jurisdiction

Beyond Kalshi’s internal discipline, the wider market faces legal uncertainty in the United States. According to the article’s referenced context, Kalshi and other prediction platforms such as Polymarket have been hit by lawsuits filed by individual US state gaming authorities. Those suits allege the platforms facilitate illegal bets on sporting events.

At the same time, the US Commodity Futures Trading Commission (CFTC) has argued that it holds “exclusive jurisdiction” over prediction markets, and the CFTC chair, Michael Selig, has said the agency will pursue legal action against state authorities that challenge that position.

Earlier this year, the CFTC used rare emergency authority in a dispute involving New York’s attempt to bar Kalshi from offering certain types of contracts tied to sports, elections, and other events. The case reflects a broader regulatory asymmetry: even when platforms claim they are operating under federal frameworks, state-level enforcement threats can still shape market access, product design, and long-term compliance strategy.

Buckhout’s market remains live despite sanctions

Even with Buckhout sanctioned, Kalshi’s contracts tied to her election outcome appear to remain listed. As of Tuesday, Kalshi still showed event contracts related to the result of Buckhout’s North Carolina race, displaying probabilities for Democratic incumbent Don Davis versus Buckhout.

That detail matters for traders and observers because it highlights a separation between disciplinary action against a participant and the ongoing availability of the underlying contract market—an important operational question for anyone evaluating liquidity, pricing accuracy, and how quickly markets reflect compliance-driven changes.

Going forward, market participants should watch whether Kalshi expands similar enforcement across other categories of politically connected events, and whether the CFTC’s jurisdiction stance continues to deter or intensify state-level lawsuits—developments that could reshape which prediction markets remain accessible in the US and under what compliance standards.

In a post that attracted over 800,000 views yesterday, a pseudonymous crypto trader claimed to have bought a ‘controlling stake’ in a NASDAQ-listed pennystock for $1.8 million with a quirky plan to squeeze short-sellers through the power of memecoins.

Dropping clues obviously intended to drum up interest in his bizarre investment, he announced tantalizing plans to tokenize his equity, pairing it with a memecoin, and launch a short-squeeze campaign against the ‘92.3%’ of the float that he claimed was already sold-short.

There was one problem with his wild tale, however. No such company exists. 

A proposed Community Note on X correctly debunked the possibility that he could have bought shares in a company matching his description.

Three hours later, the attention-seeker admitted that he had fabricated some of those numbers, recasting his original post as intentionally obscure despite an otherwise sincere effort.

Delusional memecoin ‘trading’ of Nasdaq stocks

In this case, the backpedal is notable because it demonstrates a repeating pattern of misinformation about real stocks from crypto influencers.

Indeed, just one night prior, memecoin traders tried to squeeze short-sellers on Nasdaq-listed Hims & Hers. That effort entirely failed because, to state the obvious, memecoin trades do not oblige Nasdaq stocks to change their price.

Over the summer, crypto influencers tried to revive a short-squeeze narrative using chatter about tokenizing NYSE-listed GameStop using memecoins or Robinhood Chain smart contracts.

Horrifyingly, a researcher found 354 out of 361 Robinhood Chain contracts using the GME ticker had absolutely no link to Gamestop’s actual GME stock.

What’s blocking renewed U.S.-Iran peace talks?

A fake Claude desktop application has distributed RevStealer malware designed to steal data from more than 50 cryptocurrency wallets, password managers, and web browsers on Windows computers.

Fake Claude app conceals RevStealer payload

Cybersecurity company Morphisec said in an Aug. 31 report that RevStealer is being delivered through a trojanized Electron application presented as “Claude Opus 5 Free Desktop,” which uses Anthropic’s branding and offers free access to its paid artificial intelligence model.

Before appearing under the Claude name, the malware was distributed through GitHub repositories and websites advertising video game cheats, according to Morphisec Threat Labs. The researchers identified the Claude-themed GitHub project as the most notable example because it used interest in paid AI tools to encourage people to install unverified software.

The download arrives as an archive of about 101 megabytes containing a 64-bit Electron application. Although victims expect a working Claude interface, Morphisec found that the program opens no visible window and instead prepares an encrypted native payload in the background.

RevStealer’s loader stores the payload as an AES-256-CBC-encrypted resource inside the application. After clearing its initial checks, it decrypts the file, writes it under a random name in the Windows AppData directory, and launches the malware without displaying a window.

At the same time, the loader attempts to add the user’s AppData folder to the Microsoft Defender exclusion list. Morphisec said the process is designed to limit the evidence left on the device while allowing the malware to collect and transmit information quickly.

RevStealer checks the computer before running

Rather than immediately releasing its main payload, RevStealer first examines the computer for signs that security researchers are watching it. The loader requires at least 2 gigabytes of physical memory, two logical processor cores, and a recognized graphics adapter, according to Morphisec.

Hostname and username checks compare the device against a blocklist associated with research systems. A separate timing test measures the delay around a JavaScript debugger instruction, wiping the malware’s encoded string table when execution pauses for more than about 100 milliseconds.

The native stage conducts another 10 checks that produce a weighted anti-virtual-machine score. It also examines the computer’s language settings and shuts down on systems configured for Russian, Ukrainian, and several Central Asian languages.

Automated analysis faces another barrier through a CAPTCHA window, which requires interaction before the infection can continue. If the device fails one of the early checks, the loader does not decrypt or expose the payload, leaving researchers with less malicious activity to examine.

Once running, RevStealer resolves Windows application programming interfaces without using a standard import table. Morphisec also identified 14 indirect system-call wrappers that allow the malware to reach the Windows kernel while avoiding exported functions commonly monitored by security products.

“Every stage of it is engineered around the assumption that something is watching,” Morphisec researcher Shmuel Uzan wrote.

RevStealer targets crypto wallets and account sessions

On an accepted device, RevStealer searches browser databases, encryption keys, and extension storage for information that can provide access to online accounts. Morphisec confirmed that its collection list includes Windows Credential Manager, 12 password managers, more than 50 cryptocurrency wallets, and browser session cookies.

The malware also looks for VPN configurations, remote-access credentials, clipboard contents, messaging application data, selected documents, screenshots, game launchers and OBS streaming profiles. Information collected from each source is placed in an encrypted, typed record before being sent to the operator’s command-and-control server.

Stolen browser cookies can expose an account even when the owner uses multi-factor authentication. If a valid session has already passed the login process, a criminal may be able to reuse the cookie instead of supplying the victim’s password and second authentication factor, according to cybersecurity researchers cited in previous malware reporting.

RevStealer can also recover an alternative server address from a smart contract on the Polygon blockchain when its main command-and-control server becomes unavailable. Morphisec said the method lets its operators change infrastructure without rebuilding and redistributing the malware.

Unlike malware that creates scheduled tasks or startup entries to remain on a computer, RevStealer does not establish persistence. The program collects the available information, sends it to its operators, and removes itself.

Morphisec described the operation as a “single short burst of theft,” warning that the credentials, cookies and wallet material may already be gone by the time a detection system produces an alert for review.

Fake software remains a common crypto malware lure

The Claude impersonation follows several campaigns in which attackers packaged credential-stealing tools as familiar applications, entertainment files, or software updates.

In August, crypto.news reported that fake downloads of The Odyssey were delivering Lumma Stealer through Windows executable files disguised as 1080p, WEBRip, and Blu-ray movie releases. Bitdefender said the malware could collect cryptocurrency wallet data, saved passwords, payment information, browser cookies, and remote-desktop credentials.

A separate July campaign used lookalike meeting pages and compromised Telegram accounts to target crypto workers. According to reporting on fake meetings, North Korea-linked BlueNoroff operators scanned browsers for Ethereum and Solana wallets before presenting some victims with false Zoom or Microsoft Teams updates.

JUMPSEC found that the meeting campaign covered both Windows and macOS devices. On Windows, its PowerShell loader added a Microsoft Defender exclusion, while the macOS version collected system information and Chrome master keys from Apple’s Keychain.

Kaspersky identified another modular malware framework in July that used fake recovery screens, keylogging, and clipboard monitoring against cryptocurrency investors. The company said OkoBot’s 20 modules could capture wallet recovery phrases, passwords and copied wallet addresses, with affected users found in Brazil, Vietnam, Canada, Mexico and Turkey.

OkoBot’s SeedHunter component showed victims a false recovery interface associated with Ledger and Trezor devices, according to Kaspersky. Any recovery phrase entered into the screen was sent to the malware operators, while another module recorded open wallet windows.

U.S. authorities have tracked similar information theft

For users in the United States, the RevStealer report follows federal action against LummaC2, another malware service used to collect credentials and cryptocurrency wallet information.

The U.S. Justice Department said in May 2025 that LummaC2 had been used in at least 1.7 million information-theft incidents. Federal authorities seized five internet domains supporting the operation, while Microsoft said it helped disrupt about 2,300 domains that formed part of the malware’s infrastructure.

“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft,” Matthew Galeotti, then-head of the Justice Department’s Criminal Division, said at the time.

The Justice Department said the malware was sold through online forums and a Telegram channel, allowing customers to buy access and run their own theft campaigns. Court-authorized seizures redirected the five main domains to government-controlled pages, while the department said foreign and domestic partners assisted with the disruption.

The U.S. Securities and Exchange Commission has proposed its first major transfer-agent rule overhaul in more than four decades as blockchain recordkeeping, tokenized securities and automated systems enter regulated U.S. markets.

The SEC, in a proposed rule, said most of its transfer-agent requirements date from the late 1970s and early 1980s, when investors commonly held paper certificates and firms processed ownership changes manually.

Transfer agents maintain an issuer’s official ownership records, register securities transfers and monitor whether a company issues more securities than authorized. Many also process dividends, interest payments, fund redemptions, and other corporate actions.

Under the proposal, the commission would update rules covering transfer-agent registration, reporting, recordkeeping, processing times, and the protection of securities and client funds. The package also introduces requirements for restrictive legends, paying-agent activity, and the oversight of third-party service providers.

“Market participants are actively seeking to bring blockchain-native, or ‘onchain,’ transfer agents into the U.S. market,” the SEC said.

According to the regulator, firms are developing systems for blockchain-based ownership records, tokenized fund administration and cross-chain interoperability. Such models may require transfer agents to store shareholder information on distributed ledgers and manage processes run through smart contracts.

SEC transfer agent rules would cover digital records

As securities records move away from paper, the SEC said its existing requirements do not fully address information security, cybersecurity, disaster recovery or the operational risks created by connected systems.

Proposed amendments to Rule 17ad-7 would require transfer agents using electronic recordkeeping systems to install controls protecting the integrity, availability, reproducibility, redundancy, and continuity of their records. Firms could continue using current technology if their systems meet the proposed standards.

Records would need protection against unauthorized alteration, deletion, or destruction. Transfer agents would also have to maintain an audit trail identifying who accessed, changed, or deleted a record, along with the date and time of each action or attempted action.

For regulatory examinations, firms would need systems capable of immediately producing records in both human-readable and reasonably usable electronic formats. Recovery controls would also be required for information that becomes damaged, altered, or lost.

Although the proposal would apply to blockchain systems, the SEC described its approach as technology-neutral. The rules would not prescribe one type of database or require transfer agents to adopt distributed ledgers.

Recent registrations show why the distinction matters. In August, Injective Institutional Services secured transfer-agent registration, allowing the company to perform regulated functions connected to maintaining and changing securities ownership records.

The same report noted that Superstate registered its blockchain-based transfer agent in March 2025 to support tokenized funds, including its Short Duration U.S. Government Securities Fund and Crypto Carry Fund. Such registrations do not exempt the firms or their products from federal securities laws.

Safeguarding standards would include cyber risks

Proposed changes to Rule 17ad-12 would replace requirements centered on physical certificates with a risk-management framework covering paper and uncertificated securities.

Registered transfer agents would have to adopt written policies designed to protect securities and funds from theft, loss, misuse, damage, destruction, and unauthorized access. The framework would also require firms to identify, monitor, and reduce material custody, operational, and cybersecurity risks tied to their services.

Client and issuer funds held by a transfer agent would need to remain in a separate bank account designated as a “for the benefit of” account. Under the SEC plan, separating such funds from the transfer agent’s operating money would reduce commingling and help keep customer assets outside the firm’s general estate during insolvency.

Business continuity plans form another part of the proposal. Each transfer agent would need written procedures for events that could disrupt operations, including steps for restoring records and resuming its responsibilities. Firms would have to test, review, and update their plans periodically.

Data included in the proposal show the scale of the regulated activity. Of 253 transfer agents that submitted Form TA-2 for the 2025 reporting year, 152 acted as recordkeeping transfer agents, and 126 provided paying-agent services. Together, transfer agents distributed about $5 trillion in dividends and interest payments during the year.

Reliance on outside companies has also become common. SEC data show that 44% of transfer agents either used a service company for at least part of their work or provided services to another transfer agent in 2025.

Under the proposed framework, using an outside technology or processing company would not remove the registered transfer agent’s regulatory duties. New reporting and oversight requirements would give the SEC more information about the services performed by third parties and the risks created by those arrangements.

Tokenized securities put ownership records in focus

For U.S. investors, a token’s presence on a blockchain does not by itself determine who legally owns the underlying security. Transfer agents remain responsible for the official shareholder register, including changes arising from purchases, sales and corporate actions.

Ownership records can affect voting rights, dividend payments, stock splits, tender offers, and claims during insolvency. Two transfer-agent groups warned the SEC in July that tokens created without an issuer’s approval may not provide the same ownership rights as issuer-backed shares.

Continental Stock Transfer & Trust Company and the Securities Transfer Association asked the regulator to distinguish securities tokenized by an issuer from products created by unrelated platforms. According to the groups, an unaffiliated token may track a stock price or provide an indirect interest in shares without making its buyer a registered shareholder.

Restrictive legends present another recordkeeping issue addressed by the SEC proposal. Such legends identify limits on whether a security can be resold, but the commission’s current rules do not specify a transfer agent’s obligations when investors or issuers request their removal.

The proposed standards would require written policies for handling legend-removal requests and related documentation. Processing controls are intended to reduce delays while preventing restricted securities from entering the public market without a valid legal basis.

U.S. tokenization projects need regulated infrastructure

Traditional market operators are building systems that depend on the same transfer-agent functions covered by the proposal. Intercontinental Exchange agreed in August to invest in tZERO and use its blockchain patents while developing infrastructure for an NYSE-affiliated tokenized securities platform.

Under the arrangement, tZERO will help design digital transfer-agent and broker-dealer systems for issuing, trading, and settling public securities onchain. As crypto.news reported on Sept. 1, the planned platform still needs regulatory approvals before it can begin round-the-clock trading and immediate blockchain settlement.

The commission is separately considering a regulatory route that could let qualified platforms test tokenized U.S. securities under defined conditions. Its 24/7 trading plan could allow eligible products to trade outside regular exchange hours, although the SEC has not announced final eligibility rules or an implementation date.

Transfer-agent oversight forms only one part of the agency’s current rulemaking program. On Aug. 25, the SEC sent proposed custody-rule changes for investment advisers and investment companies to the White House Office of Management and Budget for review. Full requirements covering qualified custodians and crypto assets will not become public until the review ends and commissioners vote on whether to release the proposal.

In May, the regulator also proposed allowing domestic public companies to replace three quarterly Form 10-Q reports with one semiannual Form 10-S. Separate amendments would simplify filer classifications and allow more companies to use streamlined registration procedures for securities offerings.

None of the transfer-agent amendments is final. Interested parties will have 60 days from the proposal’s publication in the Federal Register to submit comments, after which SEC staff may revise the text before placing a final rule before the commission for another vote.

The U.S. Securities and Exchange Commission (SEC) has proposed a significant rewrite of the rules that govern transfer agents—firms responsible for maintaining key records and processing securities transfers. The agency says the overhaul is needed as blockchain-based recordkeeping and tokenized securities move closer to mainstream use in U.S. markets.

In a proposal published by the SEC, the agency outlines updated requirements covering registration, recordkeeping, safeguarding, and securities transfer procedures, while also introducing new controls for risks tied to “digital and automated” market infrastructure. The SEC noted that some market participants are actively looking to use blockchain-native, or “onchain,” transfer-agent models in the U.S.

Key takeaways

• The SEC’s proposal would modernize transfer-agent obligations for registration, recordkeeping, safeguarding, and transfer processing as tokenized securities expand.
• New compliance expectations would address risks the SEC says are not sufficiently covered under rules last updated in the late 1970s and early 1980s.
• The SEC calls out cybersecurity, operational resilience, and safeguarding of investor records as central concerns for digital recordkeeping.
• Transfer agents would face expanded reporting and new standards tied to restrictive legends and third-party service provider use.

Why the SEC is targeting transfer agents

Transfer agents play a critical role in the lifecycle of securities—handling ownership records, processing transactions, and managing investor-facing documentation requirements. The SEC argues that its existing framework has not been substantively updated since the era when paper certificates and manual recordkeeping dominated the market.

In the filing, the SEC points to emerging approaches that rely on blockchain-based recordkeeping and digital administration systems, including models used for tokenized fund administration and interoperability across networks. According to the SEC, the current rules do not adequately reflect these developments, particularly with respect to maintaining secure, reliable, and tamper-resistant investor records.

The SEC also frames the proposal as a response to broader changes in how markets are built and operated, emphasizing that digital and automated infrastructure can introduce new failure modes. In its view, compliance systems must evolve accordingly—especially in areas like cybersecurity and operational resilience, where a technical breakdown can affect investor protections.

What the proposal would change

The SEC’s proposed changes would update multiple layers of transfer-agent regulation. The agency highlights that the proposal covers requirements related to registration, recordkeeping practices, safeguarding responsibilities, and the handling of securities transfers. It also proposes additional standards that would apply as transfer agents incorporate or rely on more automated and digital processes.

Among the specific compliance areas the SEC flags are new or expanded requirements tied to:

• Expanded reporting: the agency is seeking additional disclosures and compliance reporting that better match the realities of digital systems.
• Restrictive legends: updated rules would govern how restrictive legends are handled for securities.
• Third-party service providers: the proposal introduces standards relating to the use of outside vendors or service providers in transfer-agent operations.

While the proposal is designed to accommodate modernization, the SEC’s emphasis is on controlling risk. The agency specifically calls out investor record safeguarding, operational durability, and cybersecurity as areas where the existing rules are described as insufficient for the modern stack—particularly when records are maintained electronically and potentially integrated with broader onchain workflows.

Onchain transfer agents: potential benefits and regulatory friction

The SEC directly acknowledges momentum toward blockchain-native transfer-agent models. In its proposal, the regulator says market participants are seeking ways to bring onchain transfer agents into the U.S., referencing blockchain-native recordkeeping and tokenized-administration approaches.

That acknowledgment is important for two reasons. First, it signals that the SEC is at least formally engaging with the possibility of onchain transfer-agent architectures rather than treating them solely as outside the regulatory perimeter. Second, it clarifies that “onchain” does not remove transfer agents from traditional investor-protection duties; instead, the SEC wants the rulebook to specify how those duties should be met when the underlying infrastructure shifts.

For investors and issuers, this matters because transfer-agent reliability affects the integrity of ownership records and the execution of securities transfers. If modern systems are adopted, market participants will likely need to align their implementations—especially around security controls, system uptime expectations, and how safeguards are enforced and audited.

SEC’s broader push to modernize securities regulation

This transfer-agent proposal sits within a wider pattern of SEC rulemaking aimed at revising outdated frameworks. According to an analysis by law firm Cahill Gordon & Reindel, the SEC has described its ongoing agenda as a mission to simplify its rules.

Earlier in the year, the SEC proposed three major changes to public-company reporting rules. Those steps would allow companies to opt for semiannual reporting, simplify the existing filer classification system, and expand access to streamlined registered securities offerings.

The SEC has also been moving in parallel on custody-related standards for investment advisers and investment companies. Earlier coverage from Cointelegraph noted that the SEC sent a proposed overhaul of custody rules to the White House for review, with potential changes related to how firms custody crypto assets while complying with federal securities rules.

Read together, these initiatives suggest the SEC is trying to reduce friction across multiple points in the securities value chain—from reporting and offerings to custody practices and transfer-agent operations. While each proposal addresses a different function, the common theme is updating rules to better reflect how modern market participants operate and where regulators believe existing requirements no longer map cleanly onto current technology.

What happens next for the transfer-agent rulemaking

The SEC is seeking public comment on the proposed transfer-agent changes. The agency states that comments are due 60 days after the proposal is published in the Federal Register.

Market participants considering blockchain-native transfer-agent systems—and issuers evaluating tokenized structures—should watch the comment process closely. The SEC’s focus on cybersecurity, operational resilience, and safeguarding investor records indicates that technical design choices will likely need to be paired with demonstrable compliance controls as the rulemaking moves forward.

Reference: SEC proposed Transfer Agent Rules (proposal document): https://www.sec.gov/files/rules/proposed/2026/34-106246.pdf