Figure Technology Solutions has completed its acquisition of real estate lender Kiavi, bringing its lending technology and residential investor loan products into Figure’s blockchain-based capital marketplace.

According to Figure’s Sept. 1 announcement, the Nasdaq-listed company acquired Kiavi’s technology and operating platform along with certain other assets under the merger agreement signed in June. A joint venture between Figure and investment firm Sixth Street purchased loans from Kiavi’s balance sheet as part of the transaction.

Figure completes Kiavi acquisition after $717 million agreement

The closing comes nearly three months after Figure agreed to acquire Kiavi in a transaction carrying a total purchase price of $717 million.

As crypto.news previously reported, Figure expected Kiavi to bring more than $7 billion in annual loan volume into its marketplace. The company projected more than $100 million in monthly flow for Democratized Prime, its onchain credit marketplace connecting lenders with investors.

Kiavi provides financing to residential real estate investors through short-term residential transition loans, or RTLs, and longer-term debt service coverage ratio loans, known as DSCR loans.

At the time the deal was announced, Figure described Kiavi as an asset-light business that generated more than $250 million in revenue and over $100 million in EBITDA during 2025. The company estimated that Kiavi’s lending products represented a $200 billion annual addressable origination market.

Figure said the Kiavi brand, technology and platform will now be integrated across its network of more than 480 active ecosystem partners. Figure Connect will provide access to Kiavi’s residential transition and DSCR lending technology as the company moves the products onto its blockchain-based marketplace infrastructure.

Kiavi CEO Arvind Mohan is joining Figure as chief business officer and will oversee the rollout of the platform across Figure’s ecosystem.

“We are thrilled to integrate Kiavi into Figure and welcome its team to our company,” Figure CEO Michael Tannenbaum said.

Tannenbaum said adding Kiavi’s platform, technology and staff accelerates Figure’s marketplace plans as the company works with partners in the $35 trillion home equity market.

Figure financed deal after $600 million note offering

Figure funded the transaction after completing a $600 million offering of 8.5% senior notes due 2031 in July.

The company’s Sept. 1 regulatory filing showed that it paid approximately $590 million in cash consideration, net of cash acquired, at closing. The amount remains subject to customary adjustments involving Kiavi’s cash, debt, transaction expenses and operating net working capital.

Under the merger structure, Figure’s wholly owned Project Mason Merger Sub merged into Kiavi, leaving Kiavi as a wholly owned Figure subsidiary.

The closing follows a period of rapid loan growth for Figure. Second-quarter loan volume reached $4.3 billion, up 77% year over year, while net income increased 192% to $90 million.

Consumer loan marketplace volume reached $4.1 billion during the quarter, a 72% increase from the same period a year earlier. Figure Connect accounted for $3.2 billion of that volume.

Small and medium-sized business loan volume rose 57% from the first quarter, while third-party borrowing through Democratized Prime stood at roughly $170 million as of Aug. 6. The figure was around 23 times the level recorded at the end of 2025.

Figure said during its second-quarter results that the Kiavi transaction remained on schedule to close during the second half of 2026.

Kiavi expands Figure Connect loan inventory

The acquisition gives Figure another source of residential credit assets as it expands Figure Connect and Democratized Prime.

Figure had already been pursuing a larger position in residential lending. Executive chairman and co-founder Mike Cagney said in May that the company was targeting the first-lien mortgage market, with particular attention on mortgages below $300,000.

Cagney said Figure’s technology could reduce costs associated with originating smaller mortgages. The company’s home equity line of credit system can approve applications in about five minutes and provide funding within three days, compared with conventional processes that can take several weeks.

Figure’s consumer loan marketplace had recorded $1.34 billion in volume in April, up 108% from the same month in 2025.

Kiavi extends that loan inventory into financing used by residential real estate investors. When Figure announced the transaction in June, it said the acquisition would increase the share of first-lien products in its consumer loan marketplace, with first-lien loans projected to account for more than 40% of full-year marketplace volume by 2027.

The company planned to use Kiavi as the first application for agent-to-agent onboarding through Adaptor, Figure’s AI product. Figure said the technology would be used to migrate loan origination onto its infrastructure while reducing operating costs.

Sixth Street’s participation builds on an existing relationship between the two firms. In February 2025, the investment manager committed $200 million to a joint venture with Figure designed to provide more than $2 billion of liquidity to the non-agency mortgage market.

Figure continues building tokenized asset business

Figure has been extending its blockchain infrastructure beyond consumer lending as it brings different financial assets onto its marketplace.

In May, Animoca-backed NUVA connected $19 billion of Figure-linked tokenized assets with Ethereum-based decentralized finance markets. The marketplace launched with products tied to Figure’s YLDS token and a home equity credit pool.

Figure’s regulated digital asset business expanded during the second quarter as well. YLDS circulation reached $556 million at the end of June, compared with $328 million at the end of 2025.

Earlier this year, the company launched the OPEN network for issuing and trading public equities directly through blockchain infrastructure. Figure said the system allows securities to be self-custodied and settled onchain, while its own shares are expected to be exchangeable between OPEN and its Nasdaq-listed stock.

Kiavi’s contribution has not been included in Figure’s existing third-quarter Consumer Loan Marketplace guidance.

Figure said it plans to revise that outlook when it reports its third-quarter 2026 results, including a reconciliation showing how the combined business changes the guidance previously issued by the company.

OKX may restrict account functions and funds for 15 days or longer when cryptocurrency deposits trigger enhanced anti-money laundering reviews, CEO Star Xu said on Sept. 2.

Xu issued the warning after responding to a user whose transfer from a sports betting platform reportedly triggered an OKX risk review. The executive said funds sent from high risk addresses can result in stricter checks, with the length of a review depending on the circumstances.

Accounts confirmed to be connected to high risk or illegal activity may have their services terminated, according to Xu. His statement did not identify the user, betting platform, deposited asset or amount involved.

Xu also warned about funds originating from escrow transactions conducted through Telegram groups, Huiwang and related platforms. Such channels can create elevated source of funds risks, although a transfer from a flagged address alone does not prove that an account holder committed a crime.

OKX reviews may restrict funds beyond 15 days

Xu said an OKX risk review may continue for 15 days or longer. During that period, the exchange may restrict access to funds and some account functions while its compliance team examines the transaction history.

The statement did not establish 15 days as a fixed minimum or maximum. Xu said the duration would depend on the facts of each case, meaning reviews may conclude sooner or continue beyond that period.

Crypto exchanges use blockchain monitoring tools to assess whether deposited assets have interacted with addresses associated with scams, hacks, sanctions, darknet markets or other flagged services. They may also request transaction records and evidence explaining how a customer obtained the assets.

Blockchain screening works by tracing transaction paths and assigning risk labels to wallets. Those labels can help exchanges prioritize reviews, but they do not independently establish ownership, criminal intent or legal liability. Assets can pass through several unrelated wallets before reaching an exchange.

Xu did not disclose which blockchain analytics providers OKX uses or what risk score triggers a restriction. The exchange also has not published a detailed appeals process specific to the case that prompted his response.

OKX CEO identifies higher risk funding channels

Xu specifically cited Telegram escrow transactions and Huiwang variants as examples of channels that may expose users to elevated source of funds risks. Telegram itself is a messaging platform, but private groups can be used to arrange informal trades without the customer verification controls found on regulated exchanges.

Escrow arrangements can also make a transfer harder to document. The address sending cryptocurrency to an OKX customer may belong to an intermediary rather than the original buyer or seller, creating gaps in the transaction record.

Xu used the name Huiwang, which is commonly associated with Huione, a Cambodia based group operating payment and online marketplace services. Different spellings and successor brands have appeared in public reporting, making it important not to treat every similarly named platform or address as automatically connected.

The U.S. Treasury’s Financial Crimes Enforcement Network took action against Huione Group in October 2025. FinCEN’s final rule identified the company as a foreign financial institution of primary money laundering concern and cut it off from the U.S. financial system.

FinCEN said Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. The agency attributed at least $37 million to North Korean cyber heists, $36 million to virtual currency investment scams and $300 million to other cyber scams.

Those amounts are U.S. government findings concerning Huione Group. Xu did not say that every transaction involving Huiwang or its variants contains criminal proceeds. He described them as channels carrying higher source of funds risk.

Previous U.S. case placed pressure on OKX compliance

OKX’s warning comes after the exchange faced a major U.S. enforcement case over its earlier compliance controls. In February 2025, its operating company pleaded guilty to operating an unlicensed money transmitting business in the United States.

The company agreed to pay more than $500 million in penalties and forfeiture. U.S. prosecutors said OKX had served American customers despite formally restricting the market and had failed to maintain an adequate anti-money laundering program for part of the relevant period.

The enforcement action helps explain the exchange’s stricter approach to customer screening. U.S. registered crypto businesses must maintain compliance programs, retain transaction records, file required reports and screen customers against sanctions and criminal risk indicators.

A detailed review of federal rules governing cryptocurrency exchanges explains that custodial exchanges and hosted wallet providers can fall under FinCEN’s money services business framework. Covered companies face anti-money laundering, recordkeeping and suspicious activity reporting duties.

These requirements do not mean an exchange must permanently seize every deposit that receives a high risk label. Exchanges must assess available information, apply their terms and comply with legally binding orders. The appropriate response can vary by jurisdiction and transaction.

Users may need to document their source of funds

Xu advised customers not to use OKX accounts for money laundering, fraud, illegal fund transfers or other unlawful conduct. Users receiving assets from betting sites, private markets or informal trading groups may face requests to document where the funds originated.

Useful records can include withdrawal receipts, platform account statements, transaction hashes, communications with counterparties and proof showing how the underlying funds were earned. Complete records do not guarantee that an exchange will release funds, but they can help compliance teams evaluate a transaction.

Customers should also check whether the sending platform is legal in their jurisdiction and whether OKX permits transfers from it. A betting platform can be licensed in one country and prohibited in another, while an exchange may apply stricter internal policies than the law requires.

Xu did not announce a new policy, product restriction or blanket ban on deposits from sports betting services. His statement explained how OKX may respond when a transaction activates its existing risk controls.

No regulator announced an investigation connected to the unidentified user’s case. OKX also did not disclose whether the review had concluded or whether the account remained restricted.

The next confirmed development would come from OKX resolving the review or releasing more detailed guidance about affected funding sources. Until then, Xu’s statement establishes that reviews can exceed 15 days and that confirmed illegal activity may result in the complete termination of services.

G20 finance ministers and central bank governors have committed to advancing clearer regulatory frameworks for digital assets while keeping financial stability and cross-border risks in focus.

The G20 Chair’s Statement, issued after officials met in Asheville, North Carolina, on Aug. 31 and Sept. 1, recognized digital assets as part of the financial innovation that could support economic growth and private-sector development.

Officials said member countries would work toward regulatory and supervisory frameworks that provide defined pathways for digital financial innovation while maintaining trust in monetary and payment systems.

“We commit to advancing responsible and effective regulatory and supervisory frameworks that preserve financial stability, support economic growth, and establish clear pathways for sound digital financial and digital assets innovation,” the officials said.

The commitment places digital asset regulation within the G20’s work on modernizing financial oversight, which covers financial stability, new technology and payment infrastructure.

U.S. Treasury Secretary Scott Bessent had identified support for a digital asset ecosystem and improvements to cross-border payments among the priorities of the U.S. G20 presidency in February. The Asheville meeting formed part of the 2026 Finance Track, ahead of another ministerial meeting scheduled for October in Bangkok and the G20 Leaders’ Summit in December.

G20 digital assets work puts stablecoins under focus

Stablecoins received specific attention in the statement as G20 officials wait for further work from the Financial Stability Board.

The group said it expects the FSB to publish findings covering the cross-border implications of global stablecoin arrangements, along with work examining stablecoin data sources, their availability and potential problems with the information regulators currently have.

Cross-border use has become one of the areas drawing closer attention from financial authorities as stablecoins move through payment networks without relying on the same infrastructure used for conventional international bank transfers.

In June, crypto.news previously reported that the People’s Bank of China was monitoring stablecoin payments as officials considered their effect on international payment networks and the monetary system.

Chinese central bank officials said stablecoins could take on a larger role in cross-border transactions and called for stronger international coordination as their use increases. Beijing has maintained restrictions on cryptocurrency activity while examining how stablecoins and central bank digital currencies could affect global payments.

Regulatory coordination has moved ahead elsewhere. The United Kingdom and United States agreed in July to pursue closer stablecoin coordination covering regulatory standards, cross-border payments and tokenized financial markets.

Officials from the two countries have been examining pathways that could allow regulated stablecoins issued in one jurisdiction to access the other market. Their discussions have included requirements for one-to-one reserves and protections for holders if an issuer becomes insolvent.

The G20 statement did not propose a common stablecoin licensing system or set a deadline for countries to adopt identical rules. Its commitment instead centers on advancing national regulatory frameworks while considering opportunities and risks that extend across borders.

Cross-border payment reforms remain part of G20 plans

Payment infrastructure sits alongside digital asset regulation in the G20’s current work.

Finance ministers and central bank governors reaffirmed their commitment to the G20 Roadmap for Enhancing Cross-border Payments and called for countries to expand the operating hours of large-value payment systems.

Officials want jurisdictions to encourage use of the harmonized ISO 20022 messaging standard and facilitate cross-border transmission of financial services data while taking domestic laws and data security requirements into account.

Stablecoin use has increasingly intersected with the same payment issues. The UK Financial Conduct Authority identified cross-border payments as the strongest practical stablecoin use case during its Stablecoin Sprint, based on feedback from banks, payment firms and crypto companies.

Participants told the regulator that stablecoins could be particularly useful in markets where access to U.S. dollars remains limited. The FCA found less incentive for UK consumers to replace existing domestic payment methods, though businesses could potentially use stablecoin infrastructure for settlement.

Individual G20 members have taken different approaches to incorporating crypto into international payment systems. Brazil’s central bank, for example, moved in May to bar virtual assets from settlement within regulated eFX cross-border payment rails, while allowing cryptocurrency transfers outside those supervised channels.

The G20’s latest position leaves room for those differences, with the statement calling for jurisdictions to consider cross-border opportunities and challenges under their respective regulatory systems.

Major G20 economies have already built crypto frameworks

Several members have moved ahead with domestic digital asset laws while international organizations continue working on common standards.

In the United States, the GENIUS Act established the first federal framework specifically covering payment stablecoins. Permitted issuers will be required to maintain one-to-one backing using eligible liquid reserve assets and comply with disclosure, supervision and redemption requirements.

Implementation remains unfinished. Federal regulators missed a July 18 deadline to complete several rules required under the law, with the Office of the Comptroller of the Currency subsequently setting a November target for its main regulations.

The framework is scheduled to take effect on Jan. 18, 2027, or 120 days after the primary federal regulators complete their implementing rules, whichever comes first.

Across the European Union, the Markets in Crypto-Assets regulation has established a common licensing and supervision system covering crypto service providers and stablecoin issuers. MiCA’s transition period ended on July 1, leaving firms without the required authorization unable to legally provide covered crypto services to EU customers under the framework.

Japan has continued restructuring its digital asset rules as well. Lawmakers in July passed amendments classifying cryptocurrencies as financial products under the Financial Instruments and Exchange Act, creating a path toward domestic crypto exchange-traded funds, a separate 20% tax treatment and tighter market conduct requirements.

The country’s Financial Services Agency subsequently established a dedicated crypto division responsible for cryptocurrency and stablecoin supervision, digital payment planning and related policy work.

Japan regulates stablecoins separately under its payment services framework. MUFG Bank, Sumitomo Mitsui Banking Corporation and Mizuho Bank are preparing jointly issued stablecoin transactions for fiscal 2026 following an FSA-backed pilot that tested corporate cross-border payments.

G20 calls for tighter oversight of illicit crypto finance

Financial crime formed another part of the G20’s digital asset agenda.

Officials reaffirmed support for the Financial Action Task Force and called for countries with significant virtual asset activity to make effective implementation of FATF standards a priority.

The group specifically backed risk-based supervision covering anti-money laundering, terrorism financing and proliferation financing, while calling attention to fraud involving scam compounds and the use of artificial intelligence by criminals.

FATF and its regional bodies have been tasked with overseeing implementation of those standards across jurisdictions. The United States is due to host a FATF Learning and Development Forum in Dallas later this year as countries continue work on applying the organization’s financial crime rules.

The G20 finance ministers and central bank governors are scheduled to meet again in Bangkok on Oct. 15 before the U.S. presidency concludes with the G20 Leaders’ Summit in Miami on Dec. 14 and 15.

TradeXYZ recorded $202.36 billion in trading volume during the second quarter of 2026, an increase of 79.2% from the previous quarter, according to a Sept. 1 report from the Hyperliquid Research Collective.

The platform’s estimated share of trading across Hyperliquid’s HIP-3 markets rose from 84.5% to 95.1% during the quarter. Its fastest-growing segment was equity perpetuals, where volume increased 377% quarter-on-quarter to $58.9 billion across 55 markets.

The figures come from an external research report prepared by GLC Research, Four Pillars, Arrakis and GRZ Research. They should not be treated as audited financial results or figures confirmed through a TradeXYZ regulatory filing.

The report also calculated $7.59 million in quarterly revenue, up 32.9%, while open interest reached $2.96 billion at the end of June. Open interest increased 64.6% from the previous quarter.

TradeXYZ captures 95.1% of HIP-3 trading volume

TradeXYZ’s quarterly volume rose by approximately $89.43 billion from the estimated Q1 level of $112.93 billion. Growth in trading activity outpaced revenue, which increased by 32.9% over the same period.

That difference can reflect changes in product mix, fee rates, trader tiers and the proportion of volume generated by markets with lower effective fees. The report did not provide enough audited information to identify a single cause.

TradeXYZ’s HIP-3 market share increased by 10.6 percentage points during Q2. The research group estimated that its share had reached approximately 99.5% on a trailing 30-day basis by the time the report was prepared.

HIP-3 allows third parties to deploy perpetual futures markets on Hyperliquid while using the network’s trading infrastructure. Deployers can choose market parameters and list assets that are not available through Hyperliquid’s original validator-operated markets.

Hyperliquid’s current fee documentation says HIP-3 deployers may retain up to 50% of the trading fees generated by their markets. That creates a direct revenue model for platforms that can attract traders and maintain liquid order books.

The structure also separates TradeXYZ from a conventional centralized exchange. Users trade through Hyperliquid’s on-chain infrastructure, while TradeXYZ acts as the deployer responsible for its market selection and related parameters.

Equity perpetuals drive the fastest growth

Equity perpetual volume reached $58.9 billion during Q2, representing about 29.1% of TradeXYZ’s total reported volume. The segment covered 55 equity-linked markets by the end of the quarter.

A perpetual contract gives traders price exposure to an underlying asset without a fixed expiration date. Equity perpetuals can therefore track the market value of a company’s shares while trading outside the normal operating hours of traditional stock exchanges.

These contracts do not necessarily provide the same rights as owning the underlying shares. Perpetual holders generally do not receive voting rights, legal ownership or direct claims on company assets. Funding payments and liquidation rules also create risks that do not apply to ordinary unleveraged share ownership.

TradeXYZ introduced its pre-IPO perpetual product, known as IPOP, on May 1. The first market tracked Cerebras, followed by contracts linked to SpaceX and Quantinuum, according to the report.

The research group said those contracts continued through the companies’ public listings and then converted into standard equity perpetuals. It also claimed that the pre-IPO markets provided prices close to the companies’ opening public trades.

Those conclusions come from the report’s analysis. TradeXYZ has not filed audited evidence showing that pre-IPO perpetual prices consistently predict opening prices, and three completed examples would not establish long-term reliability.

The growth forms part of a wider convergence between cryptocurrency infrastructure and equity markets. For example, Wintermute registered as a U.S. broker-dealer while preparing to expand into equities and tokenized securities, as covered in the report on its regulated U.S. securities entry.

Rival closures increase market concentration

TradeXYZ’s rising share also reflects the departure of competing HIP-3 deployers. Felix, Ventuals and Dreamcash stopped operating between June 19 and July 2, according to the research report.

Their closures removed alternative venues during and shortly after the quarter. This means TradeXYZ’s 95.1% share resulted from both its own volume growth and reduced competition.

The report did not provide detailed reasons for each closure. It also did not disclose whether customers experienced losses, whether open positions were transferred or how much volume each departing platform handled before stopping operations.

A market share approaching 100% gives TradeXYZ a strong position among HIP-3 deployers, but it also concentrates activity and operational dependence in one platform. Future market share could change if new deployers enter, existing teams relaunch or Hyperliquid modifies the HIP-3 framework.

The concentration is specific to HIP-3 markets and should not be confused with TradeXYZ controlling all Hyperliquid trading. Hyperliquid also hosts its original perpetual markets, spot assets and other infrastructure outside TradeXYZ’s deployed products.

CFTC action does not directly approve TradeXYZ

The report described the U.S. Commodity Futures Trading Commission’s May action on perpetual futures as regulatory validation for the broader product category.

On May 29, the CFTC issued a policy statement explaining its position on listing perpetual contracts. The agency released the statement alongside an order allowing a designated contract market to list a bitcoin-linked perpetual futures contract.

That action covered a U.S.-regulated contract offered by a registered market operator. It did not approve TradeXYZ, Hyperliquid’s offshore markets or TradeXYZ’s equity perpetual products.

TradeXYZ users should therefore not interpret the CFTC decision as granting U.S. regulatory authorization to the platform. The legal treatment of equity-linked perpetuals can involve derivatives and securities rules that differ from those governing a bitcoin contract.

Regulators in other jurisdictions have followed separate approaches. One Trading received a Dutch license to offer regulated perpetual futures in the European Union, according to coverage of its European derivatives authorization.

The comparison shows that regulatory approval normally applies to a specific operator, legal entity and product structure. Broader acceptance of perpetual futures does not automatically authorize every on-chain market using a similar contract design.

Q3 data will test whether TradeXYZ retains its lead

The next relevant update will be TradeXYZ’s third-quarter volume, revenue and open-interest data. Those figures should show whether Q2 growth continued after three competing HIP-3 deployers closed.

Equity perpetual activity will be another key measure. The segment must maintain liquidity across its expanded list of markets for the 377% quarterly increase to represent more than a short-term surge around major listings.

Future pre-IPO conversions will also provide more evidence about how TradeXYZ handles corporate listings, reference prices and contract transitions. The report did not announce a fixed schedule for additional IPOP markets.

TradeXYZ’s U.S. availability remains a separate regulatory question. Neither the research report nor the CFTC statement announced approval for the platform to offer equity perpetuals directly to U.S. customers.

Fogo has restarted its mainnet after recovering and permanently removing 237 million of the 400 million FOGO tokens stolen in a security incident that forced the Layer 1 blockchain to halt operations.

Fogo said in its latest update that the mainnet was operating normally again, while efforts to recover the remaining affected tokens were continuing with centralized exchanges and law enforcement.

Fogo mainnet has restarted after 237 million FOGO recovery

The restart comes several days after Fogo stopped its blockchain on Aug. 29 to prevent the attacker from moving tokens received during a compromise involving the Fogo Foundation.

Of the 400 million FOGO taken during the incident, 237 million have now been recovered and permanently removed from the token’s total supply, the project said. That leaves 163 million FOGO from the original amount that have not been reported as recovered.

“Efforts to recover the remaining affected assets are ongoing with CEXs and law enforcement,” Fogo said.

The project did not provide further details on how the 237 million tokens were recovered or the process used to permanently remove them from supply. Fogo said its investigation remained underway and asked users to rely on its official channel for further information.

The latest update gives the network a clearer recovery figure after several days of uncertainty over the status of the stolen assets, though Fogo has yet to publish a full account of how the compromise occurred.

Fogo initially disclosed the incident on Aug. 28, when the Foundation said an unknown actor had compromised the organization and transferred 400 million FOGO to what it described as a “bad actor.”

At the time, the Foundation said the blockchain itself had not been affected and continued operating normally. Exchanges, law enforcement agencies and forensic specialists had been notified as the project began tracing the assets.

That changed the following day when Fogo halted the network while validators prepared an upgrade. The pause was intended to stop further movement of the affected tokens, with the project providing no restart time when it announced the action.

Stolen FOGO represented more than 10% of circulating supply

The 400 million FOGO involved in the incident represented 4% of the blockchain’s 10 billion-token genesis supply and more than 10% of the circulating supply at the time.

FOGO was trading near $0.0075 when the network was halted, putting the value of the affected tokens at approximately $3 million based on DefiLlama data.

Exchange restrictions had started shortly before the Foundation publicly disclosed the compromise. Bitget suspended FOGO deposits and withdrawals around an hour before the first announcement and cited wallet maintenance, while KuCoin later introduced similar restrictions.

Fogo did not disclose which addresses or systems within the Foundation had been compromised, and its latest statement does not identify the attack vector. No complete post-incident report has been released as the investigation continues.

The response follows several security incidents this year in which blockchain projects have worked with exchanges and law enforcement to contain stolen or improperly created tokens.

In August, crypto.news previously reported that Harmony proposed a chain rollback after forged ONE tokens spread across its network. Harmony’s proposed recovery plan would return its two shards to checkpoints recorded on Aug. 11, discarding more than 109,000 regular transactions and 315 staking transactions. One wallet involved in the incident moved 2.385 trillion forged ONE through 477 successful transfers in 106 seconds.

Another network interruption occurred in August when Maya Protocol halted operations after an attacker exploited six linked software flaws. The attacker took an estimated $1.7 million in Bitcoin and other assets, including roughly 20 BTC, before the cross-chain protocol activated a global halt to prevent further losses.

Crypto projects have used network halts after security incidents

Network stoppages have been used under different circumstances when developers or validators identify threats that could affect blockchain operations or assets.

MANTRA Chain resumed block production on Aug. 22 after its mainnet spent roughly 30 hours unable to process transactions because of a Cosmos-EVM vulnerability. Validators deployed version 8.4.0 to patch the issue, while MANTRA said two wallets managed by the project were affected and user balances remained unchanged.

Earlier in the year, Humanity Protocol disclosed a separate security incident involving compromised administrative credentials. A malware-infected developer device exposed seven private keys that had been inadvertently backed up during its June 2025 mainnet launch.

The credentials allowed the attacker to drain 141.2 million H tokens from an Ethereum bridge and mint another 300 million H on BNB Smart Chain. Humanity Protocol said the compromise involved private keys instead of a vulnerability in its smart contracts or bridge infrastructure.

Fogo’s incident remains under investigation, with the Foundation yet to disclose whether compromised credentials, internal systems or another attack method allowed the 400 million FOGO transfer.

Fogo launched its mainnet in January

Fogo launched its mainnet in January 2026 after raising $7 million through a Binance token sale conducted at a $350 million valuation.

The Layer 1 network was built primarily for onchain trading and markets itself around high-speed transaction processing, including a target block time of 40 milliseconds and infrastructure designed to reduce exposure to maximal extractable value.

Before the Aug. 29 interruption, a guide published on Fogo’s website in March said the blockchain had maintained 100% uptime since its launch. The network halt ended that uninterrupted run several months after mainnet went live.

Fogo has not specified how long the network remained offline before the latest restart or detailed the validator upgrades carried out during the interruption.

With 237 million FOGO now recovered and removed from supply, the project said work with centralized exchanges and law enforcement remains focused on the rest of the affected assets. Further information will be released as the investigation continues.

Core DAO has begun coordinating an emergency hard fork after a small group of validators obtained CORE rewards above the blockchain’s intended issuance, prompting several exchanges to restrict token transfers.

Core said on Sept. 1 that it had contained the issue and stopped what it described as “malicious validators” from drawing further excess rewards. The network is now working with validators on a permanent fix through a forward upgrade, meaning previously confirmed transactions will remain unchanged.

“Assets remain safe,” Core said, adding that a full technical postmortem would be published after the response is completed.

The project has not disclosed the amount of CORE distributed through the incident, the number of validators involved, how long they were able to obtain the excess rewards, or whether any of the additional tokens reached the market.

Core DAO hard fork will not reverse transactions

Core first disclosed the problem on Monday, when it said a small number of validators were accruing block rewards significantly above the amount intended under the protocol.

At the time, the project said it had identified the root cause and was working on mitigation measures. Core described the problem as limited to reward issuance and said it had not affected network security or custody of user assets.

By Tuesday, the team said the activity had been contained and moved to coordinate the emergency hard fork with its validator set. Core has not published an activation time for the upgrade or disclosed the technical vulnerability that allowed the excess rewards to be claimed.

The distinction between a forward upgrade and a rollback means the planned fork is intended to change the network rules from a specified point without rewriting transactions already recorded on the blockchain.

Mainnet upgrades can require coordination between validators and other network participants because nodes must run compatible software after new protocol rules take effect. As crypto.news previously reported, hard forks on production blockchains can require validators and users to reach agreement around the updated network rules.

Core has not said whether validators will need to install a specific software release before the emergency upgrade or what level of validator participation will be required for the fork.

Exchanges restrict CORE transfers

The reward problem led several centralized exchanges to restrict CORE deposits or withdrawals while the network investigated the incident.

Coinbase paused sends and receives on the Core DAO network, according to its status page. Trading functions remained available, with buys, sells, conversions and fiat transactions unaffected by the network transfer restriction.

South Korean exchanges Bithumb and Coinone suspended CORE deposits and withdrawals, citing security concerns surrounding the network.

Bitget restricted CORE deposits and withdrawals under what it described as wallet maintenance, while LBank suspended deposits in response to project requirements. The exchanges did not attribute losses of customer funds to the Core incident.

Core has maintained that user assets were not affected and said the problem involved the issuance of validator rewards.

The project has yet to disclose whether the exchanges will need to complete technical work related to the hard fork before normal CORE transfers can resume.

Validator rewards remain under scrutiny

The unanswered questions center on the amount of CORE obtained by the validators and the mechanism that allowed them to receive more than the protocol intended.

Core has not said whether the excess rewards represented newly created CORE, rewards that would otherwise have been distributed at a later date, or another accounting problem within the validator reward system.

The project has likewise not disclosed whether any of the validators sold, transferred or otherwise moved the additional CORE after receiving it. Its planned postmortem is expected to provide technical details about the root cause, though Core has not given a publication date.

Validators form part of Core’s network architecture, which combines delegated proof of stake with Bitcoin-linked security. Core has spent the past several years building its network around Bitcoin staking and decentralized finance applications.

In March 2025, Core integrated with Cobo to expand its dual Bitcoin staking service for institutional users in Asia. The arrangement allowed Cobo users to stake Bitcoin and CORE while earning BTC-denominated yields.

At that point, institutions had used Core to stake more than 6,200 BTC, while more than 150 Ethereum Virtual Machine-compatible decentralized applications had been integrated into the ecosystem. Core’s total value locked stood above $525 million when the partnership was announced.

The network had already become one of the largest Bitcoin sidechains by locked value. Earlier data showed Core with $423 million in TVL while 55% of Bitcoin’s hash rate was helping secure the network. Messari data cited at the time showed Core had 23 validators during the second quarter of 2024.

Core’s validator system plays a direct role in distributing CORE rewards. The current incident, however, remains limited in publicly disclosed technical details because the project has not explained which part of that reward process was exploited.

Emergency upgrade follows other recent hard forks

Core’s planned response comes shortly after other blockchain networks used hard forks to modify protocol rules, though the reasons for those upgrades differed.

BNB Chain, for example, activated its Pasteur hard fork on Aug. 25 after scheduling changes to bridge verification, validator authorization and block capacity.

One of the Pasteur changes addressed a cross-chain verification weakness that could allow duplicate validators to be counted when determining whether an approval had reached the required threshold. BNB Chain said it had not identified an exploitation of that flaw or linked it to asset losses before the correction was deployed.

Cardano completed another network upgrade in July when the van Rossem hard fork moved its mainnet to Protocol Version 11 that introduced changes to Plutus costs while preparing the network for its planned Ouroboros Leios architecture.

Core’s emergency upgrade is being coordinated after the reward problem was detected rather than as part of a previously announced protocol development schedule.

The network has said the excess reward activity can no longer continue under the mitigation already put in place. Core has not disclosed the identities of the validators it described as malicious or whether it plans to take further action against them.

Its forthcoming postmortem is expected to address the technical cause of the incident, while the amount of excess CORE issued and whether any of those tokens entered circulation remain undisclosed.