US federal law enforcement, in cooperation with cybersecurity company CrowdStrike and international partners, announced an operation targeting the Sality malware ecosystem—an infection chain authorities say has been used for more than two decades to steal cryptocurrency and carry out cyberattacks.

In a Tuesday announcement, the US Department of Justice (DOJ) said it disrupted the Sality botnet and related malware in an international effort involving Bulgarian, Hungarian, and Romanian officials, as well as private-sector partners CrowdStrike and the Shadowserver Foundation. The DOJ linked Sality to long-running compromise activity dating back to 2003, including the installation of malware on affected devices.

Key takeaways

• The DOJ says the Sality botnet and malware infrastructure were disrupted through a coordinated international takedown.
• CrowdStrike reports that clipboard-based “clipjacking” was used to replace cryptocurrency addresses with attacker-controlled ones.
• According to CrowdStrike, entities behind Sality stole at least 12.1 million rubles (about $150,000) over the prior eight years.
• Authorities described a peer-to-peer botnet of roughly 15,000 infected computers that periodically checked whether targets were online.
• During the operation, Sality operators reportedly lost the ability to communicate with infected machines.

Why clipboard hijacking matters for crypto security

The most consequential detail in the reporting is how the theft worked. CrowdStrike said that in the previous eight years, the operators used EggJagger, a clipjacking tool that monitors a victim’s clipboard for cryptocurrency wallet addresses and then silently swaps them for addresses controlled by the attacker.

In practical terms, the mechanism targets a common user behavior: copying and pasting wallet addresses when sending funds. According to CrowdStrike, when a victim copies a Bitcoin or Ethereum address to complete a payment, the funds are redirected to the substituted address.

This type of attack is particularly damaging because it doesn’t require the victim to sign malicious transactions or interact with a fake website in the moment. Instead, it compromises the transaction flow at the point of address entry—meaning users who rely on clipboard copy/paste can be tricked even if they never knowingly interact with malware prompts or phishing pages.

Scope and reported impact of the Sality operation

In its write-up on the takedown, CrowdStrike said that the clipjacking approach enabled theft of at least 12.1 million rubles, or roughly $150,000 in cryptocurrency, during the period it described. The company also emphasized that stolen assets remained “never-spent,” meaning the seized digital funds were not later spent or otherwise moved from the attacker-linked destinations in the observed timeframe.

It further stated that the value of these “never-spent” assets peaked at about $1.5 million in January 2025, giving a sense of how significant the stored proceeds could become once operational theft processes are running.

While the reported theft amount and peak valuation describe only what CrowdStrike observed in its analysis, they help clarify why disrupting the botnet’s communication channels is so important: if operators can’t reliably control or maintain infections, their ability to trigger address substitutions and collect funds diminishes.

How the botnet functioned—and what the disruption changed

US officials and CrowdStrike both described Sality as a peer-to-peer botnet. According to the company, about 15,000 infected computers were part of this network, which checked whether systems were online every 40 minutes. That periodic connectivity helped ensure the malware operators could maintain visibility into infection status and, when possible, continue malicious operations.

After the authorities’ efforts, CrowdStrike said the criminals “lost the ability to communicate with infected machines.” In botnet operations, that loss is often decisive: even if infected devices remain in place temporarily, removing command-and-control communications reduces the malware’s ability to coordinate, update, and execute its most profitable functions.

The DOJ’s announcement framed the disruption as part of a broader disruption of Sality malware and the botnet infrastructure tied to it, not just a removal of individual infections. For crypto users, the key takeaway is that these campaigns can persist for long periods—DOJ said Sality was responsible for installing malware on compromised devices since 2003—so enforcement actions and technical disruptions are critical for shrinking the attacker’s operational surface.

What investors and users should watch next

This takedown highlights how cryptocurrency theft campaigns increasingly blend malware distribution with human workflow attacks like clipboard hijacking. Users should treat clipboard-based address substitution as a real threat—especially when sending Bitcoin or Ethereum funds—and consider validating recipient addresses through out-of-band methods (for example, checking a pasted address against a trusted source or using verification steps in wallet software).

Looking ahead, the open question is how attackers adapt if their ability to communicate with infected machines is curtailed. Readers should watch for follow-on malware variants, new clipboard hijacking tools, or broader changes in how criminals maintain access to victim devices as the Sality infrastructure disruption ripples through criminal operations.

Kraken parent Payward has postponed its planned initial public offering until as early as the second quarter of 2027 after market conditions disrupted its previous listing schedule.

Kraken IPO timeline moves into 2027

As per reports on Wednesday, citing two people familiar with the matter, Payward had pushed the offering into the second quarter of 2027 at the earliest.

The new timeline extends the IPO process that has already faced several delays. Payward initially prepared for a public debut after cryptocurrency companies returned to U.S. equity markets in 2025, but falling digital asset prices and weaker trading activity made that schedule harder to maintain.

Payward confidentially submitted a draft registration statement on Form S-1 to the U.S. Securities and Exchange Commission in November 2025. A confidential filing allows a company to begin the SEC review process without immediately publishing its financial statements and other disclosures.

Kraken co-CEO Arjun Sethi later confirmed the confidential filing during an industry conference in April. Sethi said at the time that access to public capital was not the company’s main reason for pursuing a listing, describing regulatory trust and its long-term plans as more important factors.

In March, Payward paused its multi-billion-dollar offering as difficult market conditions reduced demand for new crypto stocks. Reuters said it could not independently confirm the report, while a Kraken spokesperson declined to comment on the listing plans.

An IPO in the second quarter of 2027 would still depend on SEC review, market conditions and Payward’s final decision to proceed. Since its draft filing remains confidential, the company has not publicly disclosed a proposed share price, ticker, exchange, or number of shares for sale.

Payward entered the process with a $20 billion valuation

Shortly before submitting the draft S-1, Payward completed an $800 million financing package across two tranches. The transaction valued the company at $20 billion and supplied additional private capital before the proposed listing.

As crypto.news reported in November, Citadel Securities contributed $200 million through a strategic investment. The funding also supported Payward’s work in regulated derivatives, tokenized financial products and international markets.

Public-listing expectations had increased after Circle Internet Group and Bullish completed IPOs in 2025. Several other digital asset companies also began preparing offerings, raising expectations that the industry would produce another group of U.S. listings in 2026.

Weaker cryptocurrency prices, lower trading volumes, and poor share performance at some recently listed companies later reduced investor interest. Grayscale, Consensys, and Ledger also postponed their listing plans as companies waited for a more favorable market.

Ledger paused preparations for a U.S. listing that could have valued the hardware wallet company at about $4 billion. The company had hired Goldman Sachs, Jefferies, and Barclays as advisers but had not filed a draft S-1, according to a May report.

BitGo, which was identified in that report as the only crypto-native company to list during 2026 at the time, was trading 36% below its January IPO price. The decline added another data point for private crypto companies assessing demand from public-market investors.

Payward revenue rises while trading activity falls

Payward has continued expanding its operations while the listing remains on hold. Company results for the second quarter showed adjusted revenue of $508 million, up 17% from the same period in 2025.

Funded accounts increased 42% from a year earlier to 6.6 million, while assets held on the platform reached $40 billion. Asset-based and other revenue accounted for 60% of total adjusted revenue, according to Payward’s financial report.

Trading figures presented a less favorable picture. Total platform transaction volume dropped 13% year over year to $310 billion as crypto spot activity slowed, while adjusted earnings before interest, taxes, depreciation, and amortization fell to $23 million.

First-quarter results had already shown how newer business lines were reducing Payward’s dependence on spot crypto trading. In May, the company reported $507 million in adjusted revenue, a 3% annual increase, even as Bitcoin fell 22% during the quarter and industry spot volume declined 38%.

Daily average revenue trades in futures rose 51% during the first quarter, supported by NinjaTrader, Breakout, and Bitnomial. Funded accounts stood at 6.1 million at the end of that period, compared with 6.6 million three months later.

Adjusted EBITDA was $18 million in the first quarter as Payward spent money on acquisitions, product development, and regulatory infrastructure. The company also reduced its workforce by about 150 employees in May, equal to roughly 5% of its staff, as part of a cost restructuring.

Kraken builds regulated U.S. derivatives business

Payward has used acquisitions and product launches to move into derivatives, tokenized stocks and payment services while its shares remain privately held.

The company acquired NinjaTrader, a U.S. retail futures platform, for $1.5 billion in 2025. Payward also bought Bitnomial, a CFTC-regulated derivatives exchange, in a $550 million transaction and added Breakout, a proprietary trading platform for qualified users.

Bitnomial gives Payward a regulated route for offering derivatives to eligible American customers. In August, Hyperliquid Labs and Payward entered advanced discussions about bringing selected Hyperliquid-linked perpetual futures to the United States through the platform, a recent report found.

Any products offered through Bitnomial would operate under rules enforced by the Commodity Futures Trading Commission. Bitnomial Exchange is registered as a designated contract market, while NinjaTrader Clearing operates as a registered futures commission merchant under the Kraken Derivatives US name.

In tokenized equities, Payward acquired Backed Finance, the issuer behind Kraken’s xStocks products. The deal gave the company more control over the issuance and trading infrastructure used to offer blockchain-based representations of stocks and exchange-traded funds.

Payward also agreed in May to acquire Hong Kong-based payment company Reap Technologies for $600 million in cash and stock. The transaction, which valued Payward shares at the same $20 billion level established by its funding round, added stablecoin-based cross-border and commercial payment services to the company’s operations.

Wyoming has moved Frontier Stable Token (FRNT) reserve reporting closer to real time, expanding its use of Chainlink infrastructure for onchain proof of reserves. The Wyoming Stable Token Commission said it adopted Chainlink Proof of Reserve to publish verified information about FRNT’s reserves and token supply on the blockchain.

Under the update, verified reserve data will be made available onchain using a setup that combines independent examinations by The Network Firm with Chainlink’s Proof of Reserve tooling, aiming to improve how quickly users can see changes in backing between reporting cycles.

Key takeaways

• Wyoming’s commission adopted Chainlink Proof of Reserve to publish verified FRNT reserve and supply data onchain in near real time.
• FRNT already had daily reserve attestations; the integration is designed to make changes in backing visible faster than periodic disclosures alone.
• Wyoming’s GENIUS Act framework still includes monthly disclosure requirements for reserve composition and outstanding supply.
• The commission is also working on Chainlink Secure Mint, which would gate new FRNT minting on verified reserves being at least equal to total supply.

From daily attestations to near-real-time proof

The Frontier Stable Token’s reserve transparency framework has been evolving alongside Wyoming’s regulatory requirements. The Wyoming Stable Token Commission said it already publishes daily reserve attestations for FRNT, while the GENIUS Act requires monthly disclosures covering reserve composition and outstanding stablecoin supply.

The new Chainlink Proof of Reserve integration is meant to tighten that feedback loop. By publishing verified reserve and supply information via Chainlink infrastructure, the commission expects more timely visibility into when the composition and size of FRNT’s backing changes between formal disclosure windows.

In the model described by the commission, independent examinations by The Network Firm are incorporated into the onchain reporting process through Chainlink’s system—an architecture intended to increase confidence that the onchain figures reflect underlying reserve verification rather than relying solely on issuer-provided updates.

Secure Mint on the roadmap

Beyond reporting, the commission also flagged a further step it is working toward: adopting Chainlink’s Secure Mint feature. In its described form, Secure Mint would require verified reserves to equal or exceed FRNT’s total supply before additional tokens can be minted.

For investors and integrators, that matters because it shifts reserve coverage from being an after-the-fact disclosure exercise toward a mechanism that can constrain issuance in real time. While Wyoming did not state a specific timeline for when Secure Mint would be activated for FRNT, the direction is clear: make reserve adequacy a condition for minting rather than only a periodic compliance metric.

How FRNT is backed—and what income supports

FRNT, launched in January, is described as being backed by US dollars and short-term US Treasurys. The commission also said interest income generated from the reserves is deposited into Wyoming’s School Foundation Program.

That structure is relevant to why “proof of reserve” is particularly consequential for this token: the backing is intended to be held in highly liquid instruments, and near-real-time visibility into reserve levels and supply can help stakeholders assess whether the backing remains aligned with outstanding FRNT as it changes.

Wyoming’s broader Chainlink rollout

This Proof of Reserve expansion arrives shortly after Wyoming completed FRNT’s migration from LayerZero to Chainlink’s Cross-Chain Interoperability Protocol (CCIP), with CCIP becoming FRNT’s exclusive cross-chain infrastructure.

According to the commission, the cross-chain infrastructure switch took place roughly two weeks before the Proof of Reserve announcement. Together, the changes point to a broader consolidation of FRNT’s operational stack around Chainlink—both for transparency (reserve verification onchain) and for interoperability (cross-chain messaging via CCIP).

Chainlink’s institutional momentum

The update also fits into a broader pattern of Chainlink integrations across tokenized assets and regulated market infrastructure. In recent months, Chainlink has been used as a pricing-data provider for tokenized equities, participated in banking-group initiatives focused on stablecoin-based atomic foreign exchange settlement, and been referenced in plans for tokenized collateral management platforms.

The article cited several examples of Chainlink involvement, including that Chainlink became a pricing-data provider for Coinbase’s B20 tokenized equities on Base after their August launch, and that Chainlink joined Project Pangea—an initiative involving European and South Korean banking groups exploring euro- and won-denominated stablecoins for atomic FX settlement.

In addition, the report referenced work connected to the Depository Trust and Clearing Corporation (DTCC) for a planned 24/7 platform to manage tokenized collateral, and noted a tokenized liquidity fund launched by Fidelity International using Chainlink and Sygnum infrastructure with daily net asset value data provided by JPMorgan for pricing.

Market participants are also watching LINK, the native token of the Chainlink network. CoinGecko data referenced in the source indicates LINK gained more than 34% over the past month, trading around $11.07 as of Wednesday.

Next, FRNT holders and integrators will likely look for whether Wyoming proceeds with Chainlink Secure Mint in practice and how quickly Proof of Reserve data updates compared with the existing daily attestations and monthly GENIUS Act disclosures. The key question is whether the “near-real-time” verification meaningfully reduces the gap between reserve changes and public visibility—especially during periods of rapid minting or redemption.

Related reading: Charles Schwab adda Solana, Avalanche and Chainlink to nascent crypto platform.

Federal law enforcement officials, working with cybersecurity technology company CrowdStrike, announced action against entities behind malware that enabled the theft of $150,000 in cryptocurrency.

In a Tuesday notice, the US Justice Department said it had disrupted the Sality botnet and malware in an international effort with Bulgarian, Hungarian and Romanian officials, as well as private sector partners CrowdStrike and the Shadowserver Foundation. US officials said that Sality was responsible for installing malware on compromised devices since 2003, resulting in crypto theft and cyberattacks. 

CrowdStrike reported that in the previous eight years, the entities behind Sality used EggJagger, a “clipjacking tool that monitors the clipboard for cryptocurrency wallet addresses and silently replaces them with addresses controlled by the operator,” to steal at least 12.1 million rubles, or about $150,000, in cryptocurrency. According to the company, the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

“When a victim copies a Bitcoin or Ethereum address to make a payment, the funds are redirected,” said CrowdStrike, explaining the technique behind the theft.

According to CrowdStrike, the criminals behind Sality “lost the ability to communicate with infected machines” as a result of authorities’ efforts to disrupt the network. US officials and the company said Sality was used to steal crypto, while about 15,000 infected computers formed part of a peer-to-peer botnet that checked whether its systems were online every 40 minutes.

Related: A fake crypto job interview nearly installed malware on my computer

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Coinbase has expanded its Canadian offering by launching crypto derivatives trading, including perpetual and dated futures linked to major digital assets such as Bitcoin, Ether, and Solana. The move gives eligible users access to a broader range of structured trading products through Coinbase’s regulated futures operation.

The launch is being delivered via Coinbase Financial Markets, a futures commission merchant registered with the U.S. Commodity Futures Trading Commission and operating in Canada under foreign dealer and futures commission merchant exemptions. Coinbase said the program includes 23 crypto perpetual and dated futures, five commodity futures, and exposure to the Coinbase 50 Index.

Key takeaways

• Coinbase is adding crypto derivatives in Canada, including perpetual and dated futures tied to Bitcoin, Ether, Solana, and other assets.
• The products are offered through Coinbase Financial Markets, using its U.S.-registered futures commission merchant framework with Canadian exemptions.
• Trading access is restricted to eligible Canadian customers, including those meeting a $5 million net financial assets threshold or qualifying for certain adviser/dealer arrangements.
• The contracts use nano-sized positions and provide leverage of up to 10x, making risk management central for participants.
• Coinbase’s launch follows other U.S.-linked platforms expanding in Canada, even as regulators tighten rules around parts of the crypto market.

What Coinbase is launching in Canada

Coinbase’s derivatives entry centers on futures contracts that allow traders to take directional or hedging positions without holding the underlying assets. According to the company, the Canadian lineup comprises 23 crypto perpetual and dated futures as well as five commodity futures and the Coinbase 50 Index.

The platform positions the offering as a first for “major crypto-native” exchanges in Canada to provide direct, native crypto futures. For Canadian users, availability is limited to qualifying customers, including those with at least $5 million in net financial assets, or those connected through registered investment advisers and dealers.

Coinbase also outlined contract design and trading mechanics: the futures use nano-sized positions and offer leverage of up to 10x. For retail and smaller professional accounts, leverage limits the margin of error—small price moves can quickly translate into gains or losses depending on position sizing and liquidation terms. Traders considering the product are likely to focus on margin requirements, contract specifications, and risk controls before entering.

How Coinbase’s step fits into a broader Canada push by U.S. platforms

Coinbase’s Canadian derivatives rollout arrives amid growing competition from U.S.-facing trading platforms that are already serving Canadian customers with crypto services. On Monday, Webull expanded crypto trading for Canadian users, citing its use of Coinbase’s infrastructure for both trading and custody.

That expansion added digital assets alongside Webull’s existing stocks, ETFs, and options offerings. Webull pointed to rising crypto adoption in Canada and said, according to Ontario Securities Commission research, crypto ownership has increased to 25% this year from 10% in 2023. The implication for Coinbase is clear: demand for crypto exposure in Canada is broadening beyond spot exchanges into more advanced trading venues.

Earlier in the year, Robinhood also entered Canada after completing a $180 million acquisition of WonderFi. The deal gave Robinhood control of Canadian exchanges Bitbuy and Coinsquare, bringing approximately 300,000 funded customers and WonderFi’s Canadian licenses and regulatory approvals under the Robinhood umbrella.

Taken together, these developments show that Canada has become a more attractive geography for companies seeking scale in crypto trading—spanning retail-style apps to institutional-grade derivatives providers. Coinbase’s derivatives launch extends that trend from spot and brokerage-style access into futures markets that are often used for hedging, basis trading, and structured exposure.

Regulatory pressure and market structure in Canada

While major trading platforms push into Canadian crypto markets, the regulatory picture is also evolving. Coinbase’s launch comes as Ottawa moves to tighten oversight on other parts of the ecosystem.

In April, Canada proposed banning crypto ATMs, pointing to concerns about scams and money laundering. Lawmakers also advanced legislation aimed at prohibiting cryptocurrency donations to political parties and candidates.

This juxtaposition—more product variety from large trading brands alongside tougher rules in areas viewed as high-risk—highlights the direction of travel for Canadian crypto policy. For investors and traders, it matters because regulation can shape which services are expanded, which customer segments are targeted, and how compliance requirements affect availability and liquidity.

Why derivatives access matters for Canadian traders

For participants, futures products can change how crypto exposure is managed. Perpetual futures are typically used for ongoing directional positions and sometimes for hedging, while dated futures introduce fixed expiry cycles that can align with investment horizons or corporate hedging needs.

The addition of nano-sized positions may lower the barrier to expressing smaller trade sizes compared with larger contract units, though leverage up to 10x still requires careful attention to liquidation risk. The most immediate practical impact for Canadian users is the ability to obtain crypto exposure through regulated derivatives rather than only via spot holdings or third-party structured products.

However, this also raises expectations around market quality. Derivatives markets depend on liquidity, order book depth, and consistent risk management across market makers and participants. Traders who adopt Coinbase’s futures offering will likely be watching bid-ask spreads, funding or roll behavior for perpetual products, and how executions perform during volatile market conditions.

Looking ahead, Coinbase’s success in Canada will likely hinge on both user demand for derivatives and the regulatory environment governing access, leverage limits, and product permissions. With Webull, Robinhood, and now Coinbase all broadening their Canadian crypto presence, market participants should watch for how contract specifications, customer eligibility rules, and liquidity develop as trading activity grows.

Fairshake has entered the final stage of the 2026 U.S. election cycle with $122 million available after supporting nearly 50 winning candidates during the primaries.

Fairshake adds nearly 50 primary wins

According to reports on Wednesday, Fairshake supported nearly 50 successful primary candidates as the crypto industry-backed super PAC prepared to direct its remaining funds toward the November elections.

Among its latest wins, Democratic Representative Jake Auchincloss secured his party’s nomination in Massachusetts after receiving support from Protect Progress, Fairshake’s Democratic-focused affiliate. Protect Progress spent $189,527.60 on four mailers supporting the incumbent, according to Federal Election Commission disclosures cited in a recent crypto.news report on the Auchincloss primary win.

Although Auchincloss has voted for several pieces of crypto legislation, his record has not aligned with the industry on every issue. Stand With Crypto, the Coinbase-backed advocacy group, gives him a C grade, partly because he did not support the GENIUS Act stablecoin legislation last year.

His opponent, Jason Poulos, criticized the outside spending and alleged that some of the material used artificial intelligence. The FEC filing and materials released by Poulos did not show that Auchincloss or his campaign helped prepare the advertisements, while federal rules require super PAC expenditures to remain independent of the candidates they support.

Fairshake and its affiliates have also spent money defending seven members of Congress who have regularly supported digital asset legislation. At the same time, the network backed first-time candidates from both parties who could enter Congress next year.

In August, Fairshake affiliates added several Michigan and Washington victories after spending hundreds of thousands of dollars across the two states. Republican Representative Bill Huizenga received nearly $512,000 in support from Defend American Jobs, Fairshake’s Republican-focused affiliate, while Protect Progress backed Democratic Representatives Suzan DelBene, Kim Schrier and Marilyn Strickland.

Republican Senate candidates lead election odds

Fairshake’s most notable results have come from Republican Senate primaries, where it helped Barry Moore in Alabama, Andy Barr in Kentucky, Kevin Hern in Oklahoma, and Harriet Hageman in Wyoming secure their party nominations.

Hageman is running for the seat held by retiring Senator Cynthia Lummis, one of Congress’ most active supporters of cryptocurrency legislation. The Wyoming lawmaker has worked on digital asset tax, market structure, and Bitcoin-related proposals during her time in the Senate.

Prediction traders expect all four Fairshake-backed candidates to win in November. Polymarket contracts gave Moore a 99% probability of victory, Hern 97%, and Hageman 96% at the time of the report. A Kalshi market placed Barr’s odds near 94%.

Prediction-market prices represent traders’ expectations rather than guaranteed outcomes, and the figures can change as election conditions develop.

If elected, the four Republicans would arrive in the Senate while lawmakers are still working on the Digital Asset Market Clarity Act. The proposed legislation would divide oversight of parts of the U.S. digital asset market between the Securities and Exchange Commission and the Commodity Futures Trading Commission.

Control of Congress will also determine which lawmakers lead the House Financial Services, House Agriculture, Senate Banking, and Senate Agriculture committees. Each panel has jurisdiction over parts of U.S. crypto policy, including securities rules, commodities regulation, stablecoins, and market structure.

Fairshake spokesperson Geoff Vetter said the organization would continue its election activity after its primary results.

“With dozens of wins in House and Senate races across the country, and $122 million ready for the fall, we’re not slowing down.”

Most party nominees have already been selected, although primary contests remain in New Hampshire, Rhode Island, Delaware and Louisiana. The general election is scheduled for Nov. 3.

Illinois delivers Fairshake’s largest defeat

Despite its victories elsewhere, Fairshake failed to stop Illinois Lieutenant Governor Juliana Stratton from winning the Democratic nomination for the U.S. Senate.

The super PAC spent more than $10 million trying to defeat Stratton, making the Illinois contest its largest unsuccessful expenditure of the current election cycle. Stratton defeated a field that included Representatives Raja Krishnamoorthi and Robin Kelly in the race to succeed retiring Senator Dick Durbin.

Fairshake’s advertisements did not prevent Stratton from securing the nomination, and prediction models cited by the report expect her to enter the Senate next year. Illinois has consistently elected Democrats in statewide federal races, giving the party’s nominee an advantage over Republican nominee Don Tracy.

The result showed that high outside spending did not decide every primary. Consumer advocacy group Public Citizen previously calculated that crypto companies had contributed a record $189 million to the 2026 election cycle by the end of June, accounting for about 37% of corporate political contributions included in its analysis.

Public Citizen said Fairshake had spent more than $82 million during the cycle by that point. The organization’s network entered 2026 with approximately $193 million in cash, though the current $122 million figure represents funds available for the final election phase.

Coinbase, Ripple and Andreessen Horowitz remain the main financial supporters of Fairshake and its affiliated committees. The network divides much of its political work between Protect Progress, which supports Democrats, and Defend American Jobs, which concentrates on Republicans.

Rival crypto PACs trail Fairshake’s spending

Other digital asset-linked political groups have raised money during the election cycle but have not matched Fairshake’s activity.

Fellowship PAC, backed by Cantor Fitzgerald and Anchorage Digital, had previously indicated that it could spend $100 million. The committee received about $11 million, with most of the money coming from Cantor Fitzgerald.

The PAC supported a group made up mainly of Republicans and three Democrats, including Virginia Senator Mark Warner. Almost all its spending went to a political firm co-founded by Bo Hines, a former crypto adviser to President Donald Trump who later took charge of Tether’s U.S. operation.

Fellowship’s early connection to Tether created a campaign-finance issue because U.S. political committees cannot accept foreign funds. Rather than receiving money from the stablecoin issuer, the PAC obtained backing from Cantor Fitzgerald, the U.S. financial firm that manages part of Tether’s reserves. It remains unclear whether Fellowship will spend again during the general election.

Tyler and Cameron Winklevoss have separately backed the Digital Freedom Fund through a $21 million contribution from Winklevoss Capital. Kraken parent Payward added another $1 million, but the committee had not started supporting individual candidates at the time of the report.