Hyperscale Data stopped all Bitcoin mining operations at its Michigan facility on Sept. 1 as it began preparing the site for an artificial intelligence computing customer.

The company switched off the facility’s mining equipment after an inspection by an unnamed California based neocloud provider, according to a Sept. 2 announcement. Hyperscale intends to sell the servers previously used to mine Bitcoin.

The shutdown completes the first operational step in converting the Michigan property from a Bitcoin mine into an AI data center. Hyperscale has also sold most of its Bitcoin treasury to provide capital for the project.

Its holdings have fallen approximately 79% from about 1,006 BTC on July 30 to 215 BTC at the end of August. The remaining Bitcoin was worth approximately $16.7 million when the company published its latest treasury update.

Hyperscale Data has ended all Bitcoin mining operations at its Michigan facility as it prepares the site for an artificial intelligence data center customer. 

On Wednesday, the company said that all Bitcoin miners at the facility were switched off following an inspection by the unnamed California-based neocloud provider. Hyperscale said it intends to sell the associated mining equipment. 

Hyperscale said the customer has contracted for 20 megawatts (MW) of AI computing capacity under a 10-year master services agreement with two optional five-year extensions. The company estimated that the agreement would generate more than $1.2 billion over the maximum 20-year term. An additional 32 MW option could lift potential revenue above $3 billion, while the site is expected to support 340 MW. 

The shutdown marks a further step in Hyperscale’s conversion of its Michigan facility from Bitcoin mining to AI infrastructure, a project it is also funding through sales from its Bitcoin treasury. 

Hyperscale also cautioned that its expansion plans remain preliminary and subject to financing, approvals and other risks. The $1.2 billion estimate requires the customer to exercise both extension options, while the $3 billion projection also depends on it taking the additional capacity.

Hyperscale Data stock slides to record low

According to Yahoo Finance data, Hyperscale Data shares closed at $0.1984 on Wednesday, down about 17%, after touching an intraday low of $0.1932. The closing price marked a split-adjusted record low for the NYSE American-listed stock.

The decline came shortly after Hyperscale completed a one-for-five reverse stock split. Its shares began trading on a split-adjusted basis on Aug. 25, according to a filing with the US Securities and Exchange Commission. 

Related: Bitcoin ETFs notch best month of 2026 as BTC gains 25% in August

Hyperscale has also reduced its Bitcoin holdings sharply while funding the AI buildout. On July 30, the company held about 1,006 Bitcoin and had sold 100 BTC while arranging a BTC-backed credit facility for the Michigan campus. 

On Tuesday, the company said that it sold about 65 BTC for $5.1 million during the week ending Aug. 30. Hyperscale said the proceeds would provide additional capital for the Michigan development. 

BitcoinTreasuries.NET now lists Hyperscale as holding 215 BTC, worth about $16.7 million. This represents a decline of about 79% from the amount cited in July and leaves it ranked 84th among public companies tracked by the platform. 

Magazine: BTC will hit $1M by 2030… but Arthur Hayes is buying ETH instead

Japan’s Remixpoint has substantially reshaped its corporate crypto portfolio by exiting all of its major altcoin positions and concentrating its holdings on Bitcoin. In a disclosure filed this week, the company said it sold its Ether (ETH), Solana (SOL), XRP (XRP) and Dogecoin (DOGE), leaving it with approximately 1,506 BTC as its only cryptocurrency holding.

According to the company’s Wednesday disclosure, Remixpoint raised a combined 878.8 million yen (about $5.5 million) from the sales and expects to recognize the resulting gains in the second quarter of its fiscal year ending March 2027. The net effect of the transactions was a 117.8 million yen gain (about $736,000), after accounting for losses on its DOGE position.

Key takeaways

• Remixpoint sold all holdings of ETH, SOL, XRP and DOGE for a combined 878.8 million yen, according to the company filing.
• The company expects to book the net gain of 117.8 million yen in the second quarter of the fiscal year ending March 2027.
• After the trades, Bitcoin becomes the company’s sole remaining cryptocurrency exposure, with about 1,506 BTC on hand.
• The disclosure indicates Remixpoint booked gains on ETH, SOL and XRP, while selling DOGE at a 3.26 million yen loss.
• Remixpoint also cited capital-efficiency and strategy clarity as reasons for narrowing its crypto focus to Bitcoin.

From multi-asset crypto to a Bitcoin-only stance

Remixpoint described the move as a deliberate shift in investment strategy. The company, which is listed among Japan’s largest corporate Bitcoin holders, sold its altcoin positions after assessing market conditions, the risk-return characteristics of those assets, and how the portfolio fits into its broader financial approach.

The company said concentrating on Bitcoin is intended to “clarify investment strategy” and “improve capital efficiency.” In practical terms, that means reducing exposure to multiple token classes—each with different liquidity profiles, volatility drivers and market narratives—and consolidating that risk around a single asset.

Prior to the sale, Remixpoint held about 901 ETH, 13,920 SOL, 1.19 million XRP and 2.8 million DOGE. Based on CoinGecko prices at the time of publication, those amounts were valued at roughly $2.14 million, $1.36 million, $1.57 million and $226,000, respectively.

Breakdown of the sales and the timing

Remixpoint completed the altcoin divestment on Tuesday. The company reported that it generated the majority of proceeds from ETH, SOL, XRP and DOGE combined—878.8 million yen (about $5.5 million)—and that the overall portfolio outcome translated into a net gain of 117.8 million yen (about $736,000).

The filing specifies that Remixpoint recorded gains on ETH, SOL and XRP, while its DOGE sale resulted in a loss of 3.26 million yen (about $20,000). The company said it expects those results to be reflected in its second-quarter reporting for the fiscal year ending March 2027.

What remains: roughly 1,506 BTC and ongoing Bitcoin activity

After the divestments, Remixpoint reported that it retains about 1,506 BTC, worth about $115 million based on the disclosure’s figures. The company’s posture therefore changes from holding a diversified set of large-cap crypto assets to effectively running a single-asset treasury approach.

The company also pointed to returns generated through its Bitcoin holdings. In the same disclosure, Remixpoint said it earned 14.92 BTC from lending between Feb. 24 and Aug. 31, valued at 164.2 million yen (about $1 million). While the altcoin positions were exited, this lending activity suggests Remixpoint is still actively managing its remaining Bitcoin exposure rather than simply holding it passively.

Why the pivot matters for corporate treasury investors

Corporate crypto strategies often balance two competing priorities: maintaining exposure to the growth potential of the broader crypto market, and preserving capital efficiency with clearer risk management. By liquidating ETH, SOL, XRP and DOGE, Remixpoint is effectively choosing simplification—reducing token-level decision complexity and leaving its market exposure concentrated in Bitcoin.

That concentration can influence how the company’s financial performance may respond to future crypto market swings. With altcoin exposures removed, the value and results of Remixpoint’s crypto assets are more likely to track Bitcoin’s direction more closely, while idiosyncratic altcoin volatility becomes less relevant to its reported holdings. Still, the exact impact will depend on future price movements and any additional portfolio actions the company may take after this sale period.

Investors and market watchers may also look for whether Remixpoint’s shift changes its risk controls around lending and treasury management. Since the company already reported gains from Bitcoin lending over a defined period, the next question is whether it will broaden that activity further, adjust lending practices as conditions change, or continue prioritizing capital efficiency through a Bitcoin-only framework.

Remixpoint’s filing shows a concrete example of corporate players trimming multi-token crypto exposure in favor of a clearer Bitcoin-focused strategy. The key developments to watch next are whether the company continues to execute Bitcoin lending and whether any future disclosures indicate a return to altcoin exposure—or a firm continuation of the Bitcoin-only approach.

Crypto argument against traditional finance has remained ideological, with banks acting as gatekeepers, centralized institutions restricting access, and money seen as something that should flow freely through open networks.

That argument hits differently when you hear it from executives operating inside the regulated financial system.

The OCC reported last year that nine of the largest U.S. banks had actively restricted services for certain perfectly legal businesses, with digital asset companies singled out. That creates a paradox where regulators urge crypto companies to act like traditional financial institutions with strict compliance, audit trails, and governance. Yet jumping through those hoops gave no guarantee from being cut off from basic banking services.

Ault Blockchain was born out of that frustration. Developed by a subsidiary of NYSE-listed Hyperscale Data, the EVM-compatible Layer 1 is the brainchild of founder Todd Ault. After years of navigating regulated and publicly traded structures, Ault experienced the systemic friction firsthand. During the height of COVID-19, one of his operating companies had its cash frozen and was handed a 30-day notice to find a new home.

For an operator spanning Bitcoin mining, digital infrastructure, and public markets, there was only one takeaway. If a private intermediary can unilaterally cut your access, being compliant and being permissionless are two completely different things. That now guides Ault Blockchain’s strategy.

Most new L1s pitch faster block times and higher throughput. Ault Blockchain is taking a finance-first approach built specifically for trading, settlement, and tokenizing real-world assets. It’s built on the Cosmos SDK and Cosmos EVM with CometBFT consensus, targeting sub-second 200ms block times.

Instead of focusing purely on raw speed, the network features an integrated stack where its core settlement layer is tied directly to dedicated trading via the Ault DEX, streamlined distribution through Ault Affiliates, and community governance managed by a Wyoming DAO LLC. To maintain and strengthen institutional trust, the platform takes its parent company Hyperscale 

Data’s public-market audit and disclosure standards, baking compliance straight into the tech. The project is also skipping a traditional public token sale because $AULT relies on a deterministic ten-year declining emissions schedule that rewards Licensed Mining Nodes as they execute verifiable offchain work like oracle services, indexing, and AI-related computing.

The project is proving that permissionless finance doesn’t have to mean anonymous, wild-west operations. You can comply with legal standards while using infrastructure that can’t be arbitrarily shut off by a bank’s shifting risk appetite. It won’t be easy, but Ault isn’t running away from traditional finance. It’s taking its best controls, stripping away the fragile middleman dependencies, and building stronger rails underneath.

September opens with XRP under pressure

XRP is trading at approximately $1.35 as September 2026 begins, down 8.20% from its August peak near $1.70, after delivering its best August performance since 2021 with a 28.5% monthly gain.

The month opened with two immediate headlines: Ripple unlocked 1 billion XRP through three escrow transactions on September 1 — worth approximately $1.38 billion at current prices — and XRP broke below the $1.35 support level that analyst Ali Charts had identified as one of the most significant demand zones on the chart.

For XRP investors, September 2026 is not a month to watch passively. Three specific events — each with a defined date — will determine whether August’s gains were the start of a sustained recovery or simply a relief rally that September will partially unwind.

Event 1: Ripple unlocks 1 billion XRP—What does this really mean?

On September 1, Ripple unlocked 1 billion XRP in accordance with its established monthly escrow mechanism, through three separate transactions of 500 million, 400 million, and 100 million XRP, respectively. It is important to note that unlocking does not equate to selling: In the past, Ripple has typically re-locked the majority of unused XRP back into escrow, so the actual amount entering the market is far less than 1 billion; following this unlock, there are still approximately 31.28 billion XRP in Ripple’s escrow accounts.

Consequently, what the market should really focus on is not “how much was unlocked,” but rather where these XRP will flow next and whether the actual increase in circulating supply will put pressure on the price.

Event 2: XRPL 3.3.0 upgrade — September 11

The upcoming XRPL 3.3.0 release introduces a “confidential transaction” feature that uses technologies such as zero-knowledge proofs to hide transaction amounts and balances while maintaining address visibility. This feature is primarily aimed at multi-purpose tokens (MPTs) and institutional users.

The proposal has received 82.86% support from validators and has entered a two-week activation window, with activation on the mainnet expected as early as September 11, 2026. The new version also addresses vulnerabilities in single-asset vaults, lending protocols, AMMs, and pseudo-accounts, further enhancing the security and stability of XRPL DeFi.

Event 3: Senate vote on the CLARITY Act—September 15

The U.S. Senate’s vote on the CLARITY Act on September 15, 2026, will be one of the most critical events of the month—and indeed of the entire year. If passed, the bill could further clarify XRP’s classification as a commodity and provide longer-term legal certainty regarding its regulatory status;

September seasonal challenges

Historical data adds uncertainty to XRP’s September performance. XRP rose 28.5% in August, marking its strongest August performance since 2021, but most of the gains were concentrated in the final two weeks, suggesting that the capital driving the rally may not be held for the long term. At the same time, three major catalysts—the unlocking of custodial funds, the XRPL 3.3.0 upgrade, and the vote on the CLARITY Act—may help alleviate the traditional September seasonal pressure, but it remains uncertain whether they can fully offset potential selling pressure.

XRP vs. Bitcoin: A comparison of two risk profiles

Bitcoin is generally regarded as the more mature asset in the crypto market, thanks to its spot ETFs, institutional capital, and relatively mature regulatory framework; XRP, on the other hand, is more sensitive to market liquidity and regulatory developments, and while it may see greater gains during favorable market conditions, it may also experience more pronounced declines during market corrections.

For investors seeking exposure to crypto assets while minimizing their reliance on regulatory developments involving XRP, ASDeFi’s cloud mining model takes a different approach by continuously accumulating Bitcoin, rather than relying directly on XRP regulatory policies, the unlocking of escrowed funds, or XRPL governance events.

How does the ASDeFi cloud mining platform work?

ASDeFi is a Bitcoin cloud mining platform founded in 2020, with over 5 million users in more than 170 countries and regions worldwide. It operates nine physical data centers globally and is powered by Bitmain, the world’s largest ASIC manufacturer. ASDeFi accounts for over 1% of global Bitcoin hash rate, with a total hash rate of 16.7 million TH, reaching an all-time high.

How do I join ASDeFi cloud mining?

1. Go to https://asdefi.com to register for a Cloud Mining account.

Enter your email address and password to create an account. You’ll receive a $15 bonus upon registration, and a $0.60 bonus for logging in every day.

2. Deposit cryptocurrency

The platform supports deposits and withdrawals of more than a dozen cryptocurrencies, including XRP, BTC, SOL, ETH, DOGE, BNB, and USDT.

3. Purchase hashrate contracts

Purchase a $15 contract. The platform also offers a variety of hashrate contracts; choose different tiers based on your investment budget.

Examples of Common Contracts:

Check-in Contract: $15 — 1-day cycle — Total profit of approximately $15.60

Introductory Contract: $100 — 2-day cycle — Total profit of approximately $108

Basic Contract: $1,500 — 10-day cycle — Total profit of approximately $1,717.50

Stable Contract: $6,000 — 20-day cycle — Total profit approximately $8,040

Stable Contract: $30,000 — 30-day cycle — Total profit approximately $47,100

(For more contract details, please visit the official website.)

4. Withdraw earnings

After purchasing a contract, the platform automatically allocates computing power, and the system runs automatically. You can monitor the process in real time on your phone and choose to withdraw your earnings or purchase new contracts.

Portfolio Logic: XRP Position + Bitcoin Cloud Mining

For investors who are bullish on XRP’s long-term regulatory outlook and payment infrastructure, ASDeFi’s sustained accumulation model can serve as a complementary allocation. XRP is more akin to a directional bet on specific regulatory developments and market catalysts; its performance in September is highly dependent on key events such as the CLARITY Act, resulting in relatively concentrated risk. In contrast, ASDeFi continuously accumulates Bitcoin through cloud mining without relying directly on any single regulatory vote, the unlocking of custodial funds, or market events.

The two are not mutually exclusive: XRP carries higher event-driven risks and potential returns, while ASDeFi offers a relatively steady path to accumulating Bitcoin. Together, they can form a complementary portfolio with different sources of risk. For more details, visit: https://asdefi.com

App Download:https://asdefi.com/xml/index.html#/app

Customer Service Email: [email protected]

Kalshi plans to seek U.S. regulatory approval as early as next week for a perpetual futures contract linked to West Texas Intermediate crude oil, Bloomberg reported on Sept. 2.

The proposed contract would have no fixed expiration date. It would trade 24 hours a day from Monday through Friday, rather than operating continuously throughout the week, according to the report.

If the Commodity Futures Trading Commission approves the product, it would become the first WTI perpetual futures contract offered through a regulated U.S. exchange. The information came from an unidentified person familiar with Kalshi’s plans because the filing was not yet public.

No application for the proposed WTI contract appeared in the CFTC’s public product filing database as of Sept. 3. Its specifications, margin requirements, position limits, funding mechanism and expected launch date therefore remain unconfirmed.

Kalshi would remove the traditional expiration date

A conventional WTI futures contract expires during a specified month. Traders who want to retain exposure must close or settle the expiring position and open another contract with a later maturity.

Kalshi’s proposed product would remove that recurring expiration process. Traders could theoretically hold positions for an indefinite period, provided they maintained sufficient collateral and met the contract’s other requirements.

Perpetual futures normally use recurring payments or another price adjustment mechanism to keep their value close to the underlying reference market. Offshore crypto exchanges commonly use funding payments exchanged between long and short traders.

Kalshi has not publicly disclosed how its WTI product would remain aligned with the underlying oil benchmark. The method should become clearer if the exchange submits its proposed contract terms to the CFTC.

Existing WTI futures also have a direct connection to the physical oil market. CME Group’s benchmark contract represents 1,000 barrels and uses physical delivery at Cushing, Oklahoma. More than one million WTI futures and options contracts trade daily, according to CME’s product page.

Kalshi’s reported contract may use cash settlement or another structure to avoid physical delivery. No settlement method has been confirmed because the regulatory filing has not been published.

Kalshi already offers a Bitcoin perpetual

The planned oil product would expand Kalshi’s use of perpetual futures beyond cryptocurrency. The CFTC approved the exchange’s Bitcoin perpetual contract on May 29 under Commission Regulation 40.3.

Kalshi began offering the contract in June. As previously reported, the regulated Bitcoin perpetual gave U.S. traders continuous exposure without a fixed expiration date.

The earlier approval established that the CFTC can treat a contract without an expiration date as a futures product under the Commodity Exchange Act. It did not automatically authorize Kalshi to list perpetual contracts tied to other assets.

Each new product remains subject to applicable CFTC requirements. The regulator can examine whether its design prevents manipulation, provides reliable price discovery and complies with limits intended to protect market participants.

CFTC Chair Michael Selig later defended the regulator’s treatment of perpetual futures. He said existing U.S. law does not require every futures contract to have a predetermined expiration date.

Selig also rejected claims that regulated U.S. perpetuals would automatically offer the extreme leverage seen on some offshore platforms. In related coverage, the CFTC chair said regulated perpetual contracts remain subject to domestic leverage and risk controls.

Oil perpetual enters the 24-hour trading debate

Kalshi reportedly plans to make the WTI contract available continuously on weekdays. Trading would run 24 hours per day for five days, leaving the market closed during part of the weekend.

The schedule represents a compromise between existing commodity trading hours and fully continuous markets. Oil prices can react sharply to geopolitical events, production disruptions and policy announcements that occur while regulated exchanges are closed.

Supporters of longer trading hours argue that continuous access allows market participants to respond immediately. Critics warn that overnight or weekend periods may have lower liquidity, wider spreads and fewer market makers.

These concerns can become more serious in energy markets because commercial participants use futures to hedge physical production and consumption. A perpetual product could also behave differently from dated futures when the oil market moves into contango or backwardation.

Contango occurs when later-dated contracts trade above near-term prices. Backwardation describes the opposite structure. These price relationships reflect storage costs, supply conditions and demand for immediate delivery.

Kalshi’s filing will need to explain how the perpetual contract reflects those market structures without relying on a single delivery month. The funding or price adjustment formula will be central to understanding that relationship.

CME dispute creates a legal complication

Kalshi’s expansion comes while CME Group disputes the CFTC’s decision to classify perpetual contracts as futures rather than swaps. CME CEO Terry Duffy has argued that products without expiration dates should fall under the swaps framework created by the Dodd-Frank Act.

CME has threatened legal action over the regulator’s approval of crypto perpetual contracts. As crypto.news reported, the dispute concerns whether perpetual products can legally qualify as ordinary futures.

The disagreement becomes more direct when the underlying asset is WTI crude. CME operates the dominant regulated U.S. market for WTI futures and holds licensing arrangements connected to energy benchmarks.

A Kalshi WTI perpetual could therefore compete with an established commodity franchise rather than only with offshore cryptocurrency exchanges. However, the proposed product’s size, customer base and settlement design remain unknown.

CME is also preparing smaller WTI futures with continuous trading throughout the week, pending regulatory review. Its website advertises planned 10-barrel contracts that would offer access to global oil markets at all times.

The CFTC will need to assess Kalshi’s contract independently of the broader commercial dispute. Approval is not guaranteed, and Bloomberg’s report did not provide a regulatory timetable beyond the planned filing.

Public filing will reveal the contract mechanics

The next confirmed milestone will be Kalshi’s submission to the CFTC. A public filing should include the contract specifications, reference price, settlement process, position limits and safeguards against manipulation.

It should also explain the trading schedule and procedures for periods when the underlying physical and futures markets are less active. Margin and liquidation rules will determine how the exchange manages sharp oil price movements.

The filing route will matter as well. Kalshi previously sought formal CFTC approval for its Bitcoin perpetual under Regulation 40.3 instead of relying on immediate self-certification.

If Kalshi uses the same process for WTI, the regulator may approve the product, reject it or extend its review while requesting more information. The product cannot be treated as confirmed until the filing is submitted and the CFTC completes the applicable process.

An attacker exploited an outdated Rain card contract on Aug. 28, draining approximately $1.1 million from multiple stablecoin card programs operating on Solana, according to blockchain security company Blockaid.

Avici and Tria were among the affected crypto neobanks. The two companies disclosed combined losses of more than $932,800 across 2,321 users. Blockaid said other Rain-supported programs were also exposed, bringing the estimated loss to approximately $1.1 million.

The attacker did not access customers’ self-custodial wallets or private keys. Instead, the exploit targeted collateral contracts holding stablecoins that users had deposited to fund their card balances.

Rain said its monitoring systems discovered a vulnerability affecting a “small number of programs” using an outdated version of its Solana card contract. The company upgraded every program still running the affected version, according to its public statement.

The incident adds to wider concerns about contract and operational vulnerabilities. Crypto security failures caused approximately $1.1 billion in losses during the first half of 2026, according to research published by Blockaid.

Rain contract flaw exposed shared card infrastructure

Rain provides infrastructure that allows crypto companies to issue cards funded with stablecoins. When customers fund their cards, the deposited assets move into collateral accounts managed through onchain contracts.

These balances are separate from assets held inside customers’ personal wallets. Once funds enter a card collateral contract, their security depends on the infrastructure provider’s code and authorization controls.

Blockaid identified four deployments containing code with the same opcode hash as the vulnerable contract. The security company said the attacker drained at least two deployments. The other two reportedly carried the same vulnerability but had no confirmed losses.

Rain confirmed that an outdated contract caused the incident. However, it has not published a complete technical report identifying every affected deployment or explaining why some programs continued using the older version.

The situation resembles other incidents in which outdated or repeatedly vulnerable infrastructure remained active. In related coverage, attackers exploited the same Verus bridge contract twice within two months, raising similar questions about upgrades across shared deployments.

The Rain incident did not represent a compromise of Solana itself. The blockchain continued processing transactions normally while the attacker exploited application code deployed on the network.

Reused signature bypassed withdrawal controls

The outdated Rain contract required two independent authorizations before allowing certain account actions. It used Solana’s Ed25519 verification instructions to confirm the required signatures.

According to Blockaid’s analysis, the attacker manipulated the second verification instruction. Its signature, public key and message offsets pointed back to information contained in the first instruction.

The vulnerable contract therefore accepted one attacker-controlled signature as two independent approvals. This allowed the attacker to satisfy the authorization requirement without permission from the owners of the collateral accounts.

After bypassing the signature check, the attacker used an AddCollateralAdmin instruction to give itself administrative privileges over individual accounts. It then called WithdrawCollateralAsset to transfer USDC and USDT from those accounts.

Blockaid recorded 2,945 administrator additions and 5,288 withdrawal calls. The company identified 8,233 core exploit transactions over approximately two hours and 29 minutes.

The operation proceeded at an automated pace. Blockaid said the first two successful withdrawals occurred three seconds apart, indicating that the attacker had prepared a system for targeting multiple accounts.

Customers did not authorize the malicious transactions. The exploit occurred at the contract level, meaning protections against phishing or malicious wallet signatures would not have prevented these withdrawals.

A different application-level weakness recently exposed another protocol when faulty collateral controls enabled a $75 million DeFi exploit. In both cases, the underlying networks continued operating while application logic allowed unauthorized activity.

Attacker moved funds through deBridge

The withdrawn USDC and USDT accumulated in one Solana wallet identified as FVNFzqAny8spWdPmYw6RQ9TkYa29ueFFiqCFD1gQnCEj.

The attacker exchanged the stablecoins for SOL through decentralized trading platforms. Blockaid then traced the proceeds from Solana to Ethereum through the deBridge cross-chain protocol.

Approximately 455.9 ETH entered Tornado Cash between 19:20 and 19:49 UTC, according to Blockaid. Tornado Cash pools deposits and permits withdrawals to addresses that are not publicly connected to the original sending wallets.

The mixer therefore made subsequent movements harder to trace through public blockchain records. Blockaid said the stolen funds had not been recovered after entering Tornado Cash.

The use of cross-chain infrastructure added another stage to the laundering route. Crypto bridges have also become direct targets, with a forged transfer exploit draining $11.5 million from the Verus Ethereum bridge earlier in 2026.

Blockaid connected two Ethereum addresses to the initial financing of the Rain attacker’s Solana activity. Neither Rain nor law enforcement authorities have publicly identified the people controlling those addresses.

The company’s statements about detecting the attack and tracing the funds represent its own findings. Blockaid provides security and monitoring services to crypto companies, including stablecoin card issuers.

Avici and Tria disclose customer losses

Avici reported that the attacker removed $500,859.22 from card balances belonging to 1,685 users. The company said it refunded all affected customers and provided 10% cashback following the incident.

Tria disclosed approximately $431,945 in losses across 636 customers. It said in an official update that each affected customer was being reimbursed.

The two disclosures account for $932,804.22 of the estimated losses. Blockaid also named Solayer Pay as an affected program, but no independently verified figure for its losses was available.

The difference between the disclosed Avici and Tria losses and Blockaid’s $1.1 million estimate appears to involve other Rain-supported programs. A complete breakdown has not been published.

Avici’s token fell 49% from its daily high after reports of the exploit emerged, according to market data. The token reached a reported low of $0.217 before partially recovering. Tria’s token also declined by more than 10% at one point.

Those price movements followed public reports of the attack, although broader market conditions may also have influenced trading.

Rain upgrades affected contract deployments

Rain said all card programs using the outdated contract had been upgraded. The company reported no additional unauthorized activity after completing the changes.

It also said affected users would be made whole. Rain has not disclosed whether it will reimburse card programs directly or whether individual providers will carry the costs.

Several questions remain unanswered. Rain has not released the vulnerable contract’s full version history, the date the flaw was introduced or the reason older deployments remained active.

The company also has not disclosed whether an audit identified the authorization flaw before the attack. No recovery of the funds deposited into Tornado Cash has been publicly reported.

The episode renews questions about whether periodic audits provide enough protection after contracts enter production. Recent industry research found that institutions increasingly want continuous monitoring alongside traditional security audits, particularly for contracts holding user assets.

A detailed technical report would allow outside researchers to confirm the vulnerability and determine whether similar code remains active elsewhere. Card providers may also review how they track contract versions and limit administrative permissions across shared infrastructure.

Users can retain control of their personal wallets while still facing risks after depositing funds into a card program. The security of those balances depends on the contracts holding the collateral, the provider maintaining them and the operators responding when vulnerabilities emerge.