Trezor says the fallout from a data exposure tied to its shipping partner is wider than it first indicated. In a Friday post on X, the hardware wallet provider updated the number of potentially impacted US customers, saying an additional 67,000 people may have had their full order details exposed.

The company stressed that its own systems were not breached. However, it warned that exposed information—such as names, email addresses, shipping addresses, and order specifics—could still be used by criminals to target victims with convincing phishing attempts. The goal, Trezor said, would be to trick users into revealing seed phrases, the credentials that control funds stored in hardware wallets.

Key takeaways

• Trezor’s latest update suggests the shipping-related exposure may involve an additional 67,000 US customers.
• Company systems were not compromised, but order records were reportedly not deleted by the shipping provider for certain customer orders.
• Trezor believes the main risk is impersonation-based phishing aimed at extracting wallet seed phrases.
• Earlier estimates put the exposure at 14,000 users, indicating the scope expanded after further information from ShipMonk.
• Investors and wallet users should treat any “Trezor support” messages as suspicious until verified through official channels.

Updated scope: more US customers at potential risk

Trezor’s Friday X update referenced a new report from its shipping provider, ShipMonk. The hardware wallet firm said the affected population includes US customers who placed orders between November 2019 and August 2021. According to Trezor, these customers may have had their complete details exposed, including identity and contact information, delivery addresses, and order-specific data.

This revision matters because it changes the number of people who may need to take additional precautions. Trezor initially estimated in August that only 14,000 users had their data exposed through ShipMonk. The new figure indicates that the problem’s reach was underestimated at the time—or that additional affected orders were identified as the investigation progressed.

What was exposed—and why it can still be dangerous

Trezor said the exposed records included the full set of personal and purchase information that bad actors typically need to make impersonation scams credible. That includes users’ names, email addresses, shipping addresses, and order specifics.

Even though Trezor said its systems were not breached, the company argued that the exposed information could be used to carry out more targeted social engineering. The concern is not just general spam or list-based fraud; it is the possibility of messages that appear to come from Trezor, designed to pressure recipients into revealing their seed phrases or otherwise compromising their wallets.

In other words, attackers may not need technical access to a wallet to cause loss. If a scam convincingly imitates the legitimate support process—or references a customer’s order to establish trust—victims may be more likely to comply.

Why impersonation scams keep costing the industry

Security research underscores how effective phishing and related social engineering can be in crypto. In the first quarter, blockchain security firm Hacken reported that social engineering and phishing drove most of the industry’s losses. According to Hacken, these attacks accounted for $306 million of $482 million total losses in that period.

The mechanics are often straightforward: fraudsters send messages that mimic trusted brands, then guide victims toward actions that compromise accounts or keys. Trezor’s warning fits that pattern, targeting the most sensitive asset in self-custody setups—the seed phrase.

Earlier coverage also highlighted how phishing can lead to direct on-chain loss. In July, a crypto investor reportedly lost nearly $1 million after signing a malicious phishing token approval transaction on Ethereum.

Trezor’s prior communications and what remains unclear

While the latest update expands the number of potentially impacted customers, it aligns with earlier disclosures that Trezor had been tracking risk tied to contact and support interactions. In January 2024, Trezor reported that about 66,000 users were at risk of phishing attacks if they had contacted the company’s support team since December 2021.

That earlier statement focused on a different slice of risk—support-related contact—whereas the new update centers on order-related data tied to shipping. Taken together, the communications suggest that Trezor’s threat model evolved as more information became available and as different parts of the customer journey were assessed.

One important point remains: Trezor continues to state that its systems were not compromised. The danger appears to come from information that may have been retained or not deleted by the shipping provider for certain orders, enabling third parties to craft more personalized scams.

What readers should watch next is whether Trezor provides further detail on mitigation steps—particularly how it plans to reach potentially exposed customers—and whether additional countries or time ranges are affected. The company’s current update is limited to additional 67,000 US customers in the November 2019 to August 2021 window, but future revisions are possible if ShipMonk’s findings expand again.

For now, the practical takeaway for hardware wallet holders is to be especially cautious of any outreach that claims to be from Trezor, especially if it references an order. Verify through official channels before taking any action, and treat requests involving seed phrases as an immediate red flag.

Binance placed four cryptocurrencies under its Monitoring Tag on Sept. 4 while separately removing 14 tokens from the Binance Alpha recommendation list.

AVA, Gains Network, Scroll and Towns Protocol received the Monitoring Tag following the exchange’s latest project reviews. The designation warns users that the tokens carry higher volatility and risk than other assets listed on the main Binance exchange.

In a separate notice, Binance Alpha removed MTP, BDXN, TALE, BOS, MAIGA, TIMI, SAROS, U, SERAPH, RVV, AIAV, PENGUIN, ODOS and SN3. Selling and withdrawals remain available for those assets.

Binance Monitoring Tag places four tokens under review

The Monitoring Tag does not immediately remove AVA, GNS, SCR or TOWNS from trading. Related Binance services also remain available following the designation, according to the exchange.

The U.S. Treasury’s Financial Crimes Enforcement Network has linked approximately $12.7 billion in suspicious financial activity to digital asset investment scams largely run from overseas scam compounds, based on nearly 34,000 reports filed over more than two years.

The Financial Crimes Enforcement Network said Thursday that its analysis covered 33,904 Bank Secrecy Act reports filed by roughly 1,300 financial institutions between Sept. 8, 2023, and Dec. 31, 2025, giving regulators a view of how money moved through banks, crypto businesses and securities firms as victims were drawn into fraudulent investment schemes.

As the industry matures and borrows more pages out of TradiFi’s playbook, crypto projects are starting to adopt some of the behaviors of public companies.

The latest craze rocking cryptoville is token buybacks: using revenue to buy back your own token.

So far in 2026, crypto projects have spent about $640 million on the practice, up around 17% from the same period the year prior, and an order of magnitude more than the $366,000 spent in 2024. Hyperliquid and Pump.fun accounting for almost 90% of the current spend.

So what’s the sudden appeal?

Buybacks can create demand for a token, while burns can reduce the supply making each token more valuable. That dynamic can cause upward pressure on the token price.

It also gives holders a more tangible connection to the economic activity on the underlying protocol. Orest Gavryliak, chief legal officer at decentralized exchange aggregator 1inch, tells Magazine:

“When projects implement revenue-funded buybacks and burns, they typically have one of two objectives in mind: either to decrease the token supply in circulation or to demonstrate the rationale for investing in protocol revenues.”

Gavryliak says that telling users a project has “bought and burned tokens” is “much more straightforward” than explaining how governance rights work, how fees are set, or how the protocol is used.

Related: Pump.fun laid off workers before they received millions in PUMP tokens: Report

But there’s a flipside: every dollar a protocol spends buying its token is a dollar it could have spent hiring developers, expanding the business, strengthening its balance sheet or building the product.

So, as buybacks become one of crypto’s hottest tokenomics tools, are they actually good for the projects using them?

Why crypto projects are buying themselves

You might wonder if projects buying their own token is counterproductive. After all, projects typically sell tokens to raise funds to cover costs.

Almost, but with an important caveat. Using revenue generated to buy back tokens (and then to hold them or burn them) creates an implicit connection between the success of the protocol and the value of its token. That’s something crypto projects have long struggled with. As Max Shannon, senior research associate at Bitwise Europe, explains:

“Buybacks and burns remain an effective way to accrue value to tokenholders: they create a continuous bid in the open market for the token, directly tethering token success to the platform’s adoption.”

That marks a sea-change for an industry that has spent the past couple of years chasing narratives or speculating on the greater fool theory — users who bought Fartcoin or Peanut the Squirrel didn’t do so for their sound economic models.

Some protocols are taking the idea much further than others. Hyperliquid, for example, has used 99% of its revenue to buy back and burn HYPE and 50% of Pump.fun’s revenue goes toward buying and burning its token, with $446.65 million worth of PUMP already removed from circulation.

HYPE Burns. Source: Hyperliquid

DeFi infrastructure protocol Spark offers a slightly different model, acquiring over 143 million SPK through open-market buybacks funded by protocol surplus, according to co-founder and chief executive Sam MacPherson.

But those tokens were not burned, and instead remain in the Spark treasury to reward long-term participants in the ecosystem. MacPherson tells Magazine the point is not simply to reduce supply:

“Tokenholders should participate in the long-term economic success of the protocol, rather than simply receive a distribution every time it generates revenue.”

He says buybacks allow Spark to create that alignment while “retaining flexibility over how and when the acquired SPK is ultimately deployed,” allowing the protocol to make its token economically relevant rather than “a simple dividend mechanism.”

Token buybacks are also a highly tax effective way to return revenue to holders, because users don’t cop a hefty tax bill on dividends or rewards.

Is buying the token really the best use of the money?

While that all sounds perfectly rational, the bigger question is whether buying your own token is really the best use of a project’s funds?

Probably not in every case. MacPherson says:

“The question should be: what is the highest-value use of the next dollar of surplus?”

If a protocol can reinvest capital at attractive returns, he says, that can be “far more valuable” than simply distributing revenue as it arrives.

PUMP Burns. Source: Pump.fun

Buybacks can support token economics without actually improving the underlying business.

There is also no ironclad guarantee that buybacks will translate into higher token prices. Pump.fun has been aggressively buying and burning PUMP since July 2025, but the token is still hovering 50% below its September 2025 all-time high. UNI has also given back around half of the gains it made after Uniswap unveiled its UNIfication proposal in November 2025.

Related: Robinhood Chain nears $1B TVL as Uniswap drives liquidity: Standard Chartered

Shannon points out that “many factors” contributed to those price movements, so they don’t prove buybacks failed, but:

“They have prompted investors to debate whether these startup-like projects would be better served by reducing the share of revenue committed to buybacks and burns and reinvesting more in the team and the project itself.”

Investors should make a careful distinction between a buyback scheme that pumps prices, and a successful business model.

A sustainable protocol that generates genuine surplus may decide that buying its token is the best use of some of that money, but equally a project that’s limping along might simply attempt to buyback tokens to move the price. MacPherson notes:

“A buyback doesn’t make an unsustainable protocol sustainable.”

When a token starts looking like a stock

While token buybacks may superficially resemble share buyback program, that doesn’t mean tokens are becoming more like stocks.

UNI is down around 50% since it started buybacks and burns. Source: Coingecko

A shareholder owns part of a company and may have voting rights, dividends or a claim on its residual assets. Tokenholders generally do not have those same legal rights, and Orest says that distinction is critical. “This is a market mechanism, not a legally enforceable entitlement,” he says.

MacPherson describes SPK as a form of “pseudo-equity” for an onchain protocol. While there isn’t a legal ownership structure in the traditional corporate sense, economically Spark is “trying to create many of the same characteristics: participation in governance, long-term alignment, and a mechanism through which those most committed to the protocol can benefit from its success.”

When buybacks start looking like dividends

But as crypto starts to emulate TradFi buybacks, storm clouds may be gathering on the horizon, as regulators consider what those mechanisms actually amount to.

While the Digital Asset Market Clarity (CLARITY) Act of 2025 remains a draft and should not be treated as settled law, Gavryliak says its proposed framework highlights the key question of where a token’s value comes from:

“If it stems from the functionality of the network itself, then the asset looks like a commodity. But if the value is based on the efforts of the project’s team in matters of shipping, marketing, or providing returns to token holders, then it is already a security. In the end, don’t put the clothes of a stock on the token and expect it to be a commodity.”

At the end of the day, crypto investors want to know what sits underneath a token — revenue, users, sustainable economics — and some credible way for the token to benefit from those things.

While buybacks may offer a solution, they can also be just another piece of financial engineering that makes a token look more valuable than it actually is without fixing the issues underneath, as Gavryliak points out:

“If the buybacks stopped, would there still be a reason to hold the token? If the answer is no, the problem runs deeper than tokenomics.”

Magazine: Mystery surrounds why an OG burned $1M in Bitcoin

Bitcoin price pulled back after briefly breaking above $82,000 on Sept. 4, as traders took profits following a short squeeze driven by softer Federal Reserve expectations and renewed demand for US spot Bitcoin ETFs.

Bitcoin price pulls back after testing $82,000

According to data from crypto.news, Bitcoin (BTC) price traded near $81,150 at the time of writing, having failed to hold an intraday move above the $82,000 psychological level. The pullback left the asset about 1% below its local high but still well above the $80,000 mark reclaimed during the previous session.

The rally accelerated after Bitcoin moved out of a range around $77,000–$79,000. Short sellers were forced to close leveraged positions as the price crossed $80,000, adding automatic buy orders to the market.

CoinGlass data cited by market reports showed that the broader crypto market recorded more than $500 million in liquidations during the rally, with short positions accounting for most of the total. Bitcoin shorts reportedly absorbed about $415 million of those losses.

Price action has since slowed near a technically important area. Galaxy Research data shared by analyst Quinten François placed Bitcoin’s 50-week moving average near $81,041, almost level with the current market price.

According to François, Bitcoin has not closed a weekly candle above that moving average since November 2025. He said a move through $82,800 would also produce the first higher high of the broader downtrend and bring $90,000 back into consideration.

Fed expectations and ETF inflows supported the rally

Bitcoin’s recovery followed a drop in expectations for another US interest-rate increase in September. Fed Governor Christopher Waller said policymakers could keep rates unchanged if incoming inflation data confirms that price pressures are cooling.

The probability of a September rate increase fell from about 63% to nearly 50% after Waller’s comments, according to CME FedWatch. Lower Treasury yields and a weaker dollar accompanied the shift, improving conditions for risk assets.

The move also followed softer US private employment figures. ADP reported weaker job growth than economists expected, adding to the view that the Fed may have less room to tighten monetary policy further.

US-listed spot Bitcoin ETFs provided another source of demand. François, citing Galaxy Research data, said the products recorded $730.8 million in combined net inflows on Sept. 3. The figure marked a sharp improvement from the mixed flows recorded at the beginning of the month.

US investors will now focus on the August employment report and upcoming inflation readings. Waller has not ruled out a hike, meaning stronger inflation data could reverse part of the market’s recent repricing.

Bitcoin technical indicators favor buyers above $78,000

The daily chart shows that Bitcoin has recovered above its major moving averages. The 20-day simple moving average stands near $75,700, while the 50-day and 100-day averages sit at approximately $68,845 and $66,405, respectively.

Bitcoin is also above its 200-day moving average near $69,665. The separation between price and the shorter moving averages reflects the strength of the rebound, but it also leaves room for a larger correction if buyers fail to defend the breakout.

The daily Aroon Up reading reached 92.86%, while Aroon Down fell to zero. The indicator shows that a recent high occurred much more recently than a fresh low, supporting the current bullish trend.

Shorter-term readings are less decisive. On the 4-hour chart, Bitcoin is trading close to the upper Bollinger Band at $82,034. The middle band near $78,678 acts as the first mean-reversion target, while the lower band stands around $75,321.

The 4-hour relative strength index was 67.3, just below the conventional overbought threshold of 70. Momentum remains positive, though the reading helps explain why the first move above $82,000 attracted profit-taking.

Liquidation levels frame the next Bitcoin move

The 24-hour CoinGlass liquidation heatmap shows a dense group of leveraged positions between approximately $81,700 and $82,300. A move back through that range could force additional short liquidations and help Bitcoin challenge the next supply area near $83,000–$84,000.

A larger concentration of liquidity is visible below the market between $79,800 and $80,300. Another band sits near $78,900, making both areas possible targets if Bitcoin loses $80,000.

The heatmap does not indicate which level the price will reach first. However, the concentration of leveraged positions on both sides raises the risk of sharp intraday swings as traders approach the weekly close.

Analyst Dami-Defi said Bitcoin had reclaimed a weekly exponential moving-average ribbon extending roughly from $71,000 to $78,000. According to the analyst, weekly closes above $78,000 would preserve the improved structure, while another loss of the ribbon would invalidate the reclaim.

The immediate bullish case requires Bitcoin to close above the 50-week moving average near $81,000 and clear the local high around $82,800. Such a move would expose $84,000, followed by the wider resistance zone between $95,000 and $96,000 identified by Dami-Defi.

Failure to hold $80,000 would instead put the $78,700 Bollinger midpoint and the weekly EMA region near $78,000 back in focus. A deeper decline could extend toward the 20-day moving average around $75,700.