The UK Financial Conduct Authority has targeted three London premises suspected of running illegal peer to peer crypto trading businesses, extending an enforcement campaign against unregistered digital asset activity.

According to the FCA, the operation was carried out on Sept. 10 alongside HM Revenue & Customs and the Metropolitan Police Service. Cease and desist letters were issued at all three locations, requiring traders to stop any suspected illegal crypto business.

Peer to peer crypto trading involves people buying and selling digital assets directly with one another. Personal transactions do not require FCA registration, but anyone conducting the activity by way of business in the UK must have the appropriate registration. No peer to peer crypto trading businesses are currently registered with the regulator.

The FCA said unregistered operators can provide a route for criminals to move and launder illicit funds because businesses operating outside its registration system avoid controls designed to detect and prevent money laundering.

“Working with partners, we continue to track and disrupt illegal crypto activity,” Steve Smart, executive director of enforcement and market oversight at the FCA, said. “Anyone running an unregistered peer-to-peer crypto business should assume we are looking at them.”

FCA expands crackdown on illegal peer to peer crypto trading

The latest operation extends enforcement activity that began earlier this year. In April, the FCA and partner agencies targeted eight London locations suspected of hosting unregistered peer to peer crypto businesses, crypto.news previously reported.

During the April 22 operation, the FCA worked with HMRC and the South West Regional Organised Crime Unit. Cease and desist letters were issued at all eight locations, while evidence collected during the inspections was retained for criminal investigations.

The regulator said evidence gathered during that operation is now being used to support ongoing criminal investigations and other enforcement action. Like the September action, the earlier inspections were conducted under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.

FCA officials have focused their enforcement efforts on businesses conducting crypto activity without the registration required under the existing anti money laundering framework. The regulator has been responsible for supervising relevant UK crypto businesses for compliance with anti money laundering and counter terrorist financing requirements since 2020.

Detective Sergeant Sathish Alalasundaram of the Metropolitan Police Service said investigators face challenges because cryptocurrencies allow funds to move rapidly across jurisdictions.

“Law enforcement and partner agencies are working significantly hard to tackle criminal activity involving digital assets,” Alalasundaram said. “The complex nature of cryptocurrency, combined with the speed at which funds can be moved across jurisdictions, presents ongoing challenges for those investigating.”

He said the Metropolitan Police continues to adapt its investigative capabilities and disruption methods as criminals change how they use digital assets.

FCA has previously pursued unregistered crypto businesses

The London operations follow several enforcement cases involving crypto businesses operating without FCA registration.

One of the regulator’s earlier cases involved Olumide Osunkoya, who pleaded guilty in September 2024 to offenses linked to an illegal crypto ATM network that processed £2.6 million in transactions between December 2021 and September 2023.

Osunkoya admitted operating crypto ATMs without the required registration, along with offenses involving false documents and criminal property. He was later sentenced to four years in prison, becoming the first person in the UK to receive a criminal sentence for unregistered crypto activity.

Separate enforcement action in June 2024 resulted in two London residents being arrested on suspicion of operating an illegal crypto exchange. Authorities believed more than £1 billion in unregistered cryptoassets had been bought and sold through the business.

The FCA inspected offices connected to the suspects, while Metropolitan Police officers searched two residential properties and seized several digital devices. Both individuals were interviewed under caution and released on bail while the investigation continued.

Enforcement continued in July 2025 when the FCA and Metropolitan Police searched four premises in southwest London. Seven crypto ATMs were seized and two people were arrested on suspicion of money laundering and operating an illegal cryptoasset exchange.

UK cryptoasset businesses providing services covered by the existing Money Laundering Regulations must register with the FCA and comply with applicable financial crime controls. Operating covered services by way of business without the required registration can lead to enforcement action.

UK crypto oversight will expand in October 2027

The Sept. 10 operation comes shortly before the FCA opens applications for the UK’s incoming crypto authorization framework.

Under final FCA guidance published on Sept. 16, applications for the new regime will open on Sept. 30, 2026. Firms seeking transitional arrangements must apply by Feb. 28, 2027, before the framework becomes mandatory on Oct. 25, 2027.

The incoming system will expand FCA oversight beyond the anti money laundering and financial promotion requirements that currently apply to much of the sector. Activities covered by the new framework include operating cryptoasset trading platforms, safeguarding cryptoassets, dealing and arranging transactions, issuing qualifying stablecoins and arranging cryptoasset staking.

Existing registration under the Money Laundering Regulations will not automatically convert into authorization under the new system. Companies already registered with the FCA will need to assess their activities and seek the relevant permissions if they intend to continue providing regulated services after the new rules take effect.

The regulator finalized key crypto rules in June covering financial resilience, market integrity, stablecoins and consumer requirements. Firms supporting customers who buy, trade or hold crypto will face standards including capital requirements and stress testing, while market integrity provisions will cover conduct such as insider trading and market manipulation.

Until Oct. 25, 2027, crypto remains largely outside the UK’s full financial services regulatory framework apart from areas including anti money laundering requirements and financial promotions. The FCA advises consumers to use its Firm Checker to establish whether a crypto business has the required registration or permissions before dealing with it.

Revolut said Thursday it had received no direct contact from those claiming responsibility for a customer data breach despite multiple public ransom demands.

A group calling itself “IAmNotAVillain” publicly demanded 6,000 Monero (XMR), worth about $3 million, from Revolut within 24 hours, threatening to sell the customer records to other criminal groups, the Financial Times reported Wednesday.

“Revolut has not received any direct contact or demand from the individuals or group making these claims,” a Revolut spokesperson told Cointelegraph.

The public ultimatum is the latest development in a data breach Revolut first disclosed last week, with Italian authorities now widening their investigation into how a government email account was allegedly used to obtain customer data.

One breach, multiple ransom demands

Revolut’s claim that it has received no direct contact adds to uncertainty over who is behind the public ransom demand, as “IAmNotAVillain” is not the only name linked to claims of responsibility for the incident. Its website, iamnotavillain.xyz, was unavailable when checked by Cointelegraph at the time of publication.

An earlier group calling itself “Revolut Smilik” reportedly demanded 10,000 Bitcoin, worth about $780 million at the time, vastly more than IAmNotAVillain’s current $3 million Monero demand.

IAmNotAVillain disputed the competing claim in a notice on its website, alleging that a former associate had received only a small sample of the data before taking credit for the breach. The site warned others not to deal with the rival claimant.

Cybersecurity-focused account Dark Web Informer also flagged another website, revoloot.lol, associated with a separate actor claiming responsibility, further complicating efforts to establish who controls the stolen customer records. The revoloot.lol website was also unavailable when checked by Cointelegraph.

Italian authorities widen Revolut data breach probe

Italy’s National Anti-Mafia and Anti-Terrorism Directorate is also now involved because the suspected intrusion concerns a government entity, Italian news agency ANSA reported Wednesday.

Related: Italy investigates government email breach linked to Revolut data leak

Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest, while investigators work to establish whether the institutional email account was breached or cloned.

Italy’s privacy regulator has separately asked banks to urgently review the security of their access systems and is examining whether other banks or financial institutions may have been involved.

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

A New York federal judge has denied Susquehanna’s bid to freeze nearly $100 million tied to dozens of traders accused of profiting from alleged insider information before China announced a crackdown on cross border trading platforms.

According to a Sept. 14 opinion and order from the U.S. District Court for the Southern District of New York, Judge Arun Subramanian found that Susquehanna Securities and Susquehanna Investment Group had not shown they were likely to suffer irreparable harm without a preliminary injunction.

Susquehanna filed the lawsuit on June 29 against 100 unnamed defendants, alleging violations of Section 20A of the Securities Exchange Act of 1934 and unjust enrichment. Citadel Securities later joined the case as an intervenor.

The dispute centers on trading before a May 22 announcement concerning the Chinese government’s crackdown on cross border trading platforms. Susquehanna alleged that the defendants traded using material nonpublic information before the news caused a sharp decline in certain securities.

The market maker initially targeted 100 defendants but narrowed its request for a preliminary injunction to 40. It asked the court to prevent them from transferring, encumbering, removing or otherwise disposing of proceeds held at third party brokerage firms that Susquehanna claimed came from insider trading.

As an alternative, the company sought an attachment order that would allow assets to be seized to secure a potential judgment.

Susquehanna failed to show an imminent risk to the funds

Subramanian found that Susquehanna had not produced enough evidence to establish that the defendants were likely to dissipate or conceal their assets before a judgment could be enforced.

Susquehanna argued that the defendants’ allegedly suspicious trading created a significant risk that the proceeds could be moved beyond the court’s reach. The judge rejected the argument, finding that accepting it would effectively allow asset freezes as a matter of course in many insider trading or fraud cases.

The court separately considered defendants living in the United States, foreign defendants who had appeared in the case and foreign defendants who had not appeared.

For domestic defendants, Susquehanna pointed to their failure to appear as part of its argument that the funds could be dissipated. The court found no evidence showing that their absence meant they intended to frustrate enforcement of a future judgment, noting that some apparently had not yet been formally served.

Susquehanna raised a similar concern over defendants living outside the United States, arguing that their assets could be moved beyond the jurisdiction of U.S. courts. Subramanian found that the possible difficulty of enforcing a judgment overseas was not enough by itself to establish irreparable harm.

The company did not identify a pattern of defendants hiding funds, making fraudulent transfers or engaging in evasive conduct, according to the order. Some foreign defendants who had appeared in the case submitted evidence indicating that they had enough funds to satisfy a potential judgment.

Susquehanna came closest to establishing a potential risk when it said in a reply filing that one defendant, identified as John Doe 3, appeared to have removed more than $10 million from a relevant account before a freeze took effect.

The court found that the claim lacked supporting evidence and said moving money from an account did not necessarily show an attempt to avoid a judgment. Funds used for active trading could have been reinvested elsewhere or could have belonged to a fund, employer or client.

Trading patterns did not establish likely insider trading

Susquehanna faced another problem because the court found that it had not demonstrated a likelihood of success on the merits of its claims.

To prevail on its Section 20A claim, the company would need to establish that someone owing a fiduciary duty of trust and confidence used material nonpublic information to profit from trading or tipped the confidential information to others.

Susquehanna submitted trading charts that it said showed defendants buying highly risky, short dated put options expiring on or shortly after the May 22 announcement. The company argued that there was no plausible explanation for the pattern other than trading based on material nonpublic information.

One defendant, Zhengfei Li, offered a different explanation. His trading records showed two equally sized positions, with half expiring before May 22 and the remainder afterward.

Li said the pattern was consistent with repeated speculation based on market signals instead of precise knowledge of an announcement. He told the court that unusually heavy put option activity visible through public market information and investor discussions led him to buy his own put options.

Evidence submitted by Li showed a put to call ratio of roughly 49 to 1 on May 21, the day he entered positions expiring after the announcement. Another defendant said she bought put options for similar reasons and submitted messages showing her reaction when the Chinese crackdown became public.

The court said defendants could have noticed unusual market volatility or publicly available posts suggesting that negative news was approaching and traded on those signals. Information available publicly would not qualify as nonpublic information under the insider trading claim.

Subramanian noted that some defendants’ trading records appeared more suspicious than Li’s. Susquehanna, however, brought the defendants together in one lawsuit and relied on broad arguments instead of providing detailed individual treatment of each trader.

The judge pointed to the scale of the original case, which accused 100 defendants of receiving insider information even though Susquehanna later stopped seeking a preliminary injunction against more than half of them.

Susquehanna had not identified the alleged tipper, the fiduciary duty that person owed or the personal benefit received for providing the information. The court found that the large number of investors who were not connected to each other could support explanations other than insider trading.

China crackdown triggered the trading dispute

The May 22 regulatory action at the center of the case involved Chinese scrutiny of overseas trading services offered to mainland investors.

crypto.news previously reported that Chinese securities regulators had targeted cross border brokerage activity involving firms including Tiger Brokers, Futu and Longbridge. The action concerned companies providing mainland clients access to overseas markets without regulatory approval.

China had already tightened restrictions on crypto and real world asset tokenization in February, extending restrictions to offshore entities serving mainland users and maintaining limits on virtual currency related financial services.

Days after the May 22 development, China’s Supreme People’s Court said judicial authorities would study rules for virtual currency disputes and cases involving cross border financial activity.

Enforcement involving overseas fund movements continued in July, when a Shanghai court sentenced five people over an illegal foreign exchange network that prosecutors said used cryptocurrency to move more than $29.4 million abroad. Authorities said the network helped domestic clients transfer more than 200 million yuan overseas over three years.

Court rejects alternative request to attach assets

Susquehanna’s failure to establish likely success on the merits affected its alternative request for an attachment order.

Federal Rule of Civil Procedure 64 allows courts to seize property to secure a potential judgment when the remedy is available under the law of the state where the court sits. In New York, a party seeking attachment must show, among other requirements, that it is probable to succeed on the merits.

Susquehanna relied on the same arguments it presented in support of the preliminary injunction. Subramanian found that the company had not demonstrated likely success on either its Section 20A claim or its unjust enrichment claim.

The unjust enrichment allegation was based on the same underlying claim that defendants had engaged in illegal insider trading. The court found that Susquehanna had not clearly shown that the defendants traded using material information unavailable to the market.

Questions remained over the extent of Susquehanna’s losses because the market maker acknowledged using hedging strategies. The court said the record did not establish how much of the defendants’ alleged gains, if any, came at the plaintiffs’ expense.

Subramanian stressed that the ruling did not decide whether Susquehanna had adequately pleaded plausible claims for relief, an issue the court had not yet addressed. The higher standard required to freeze funds totaling just under $100 million had not been met.

The court denied both the preliminary injunction and the alternative attachment request. An earlier order restricting the funds was set to dissolve at 5 p.m. ET on Sept. 16.

What higher Fed rates mean for everyday Americans

The Celsius bankruptcy estate has filed a lawsuit in the U.S. Bankruptcy Court for the Southern District of New York accusing several companies tied to BitMEX of fraud, market manipulation, and wrongful liquidation activity during the March 2020 crypto crash.

According to court filings, the estate alleges that BitMEX liquidated Celsius positions and seized Bitcoin collateral during the sell-off—actions it says were driven by an exchange “liquidation engine” that controlled liquidation trigger prices, executed orders, and received proceeds into an insurance fund. The complaint was filed on Sept. 12 by Celsius entities acting through the estate representative Blockchain Recovery Investment Consortium (BRIC), and was submitted just days before BitMEX is scheduled to stop exchange services on Sept. 23.

Key takeaways

• The lawsuit alleges BitMEX liquidated Celsius-related positions on March 12–13, 2020, seizing 1,325.84 BTC and additional collateral linked to an investment fund.
• The estate claims liquidation triggers and order placement on BitMEX were set in ways that produced deeper-than-necessary sell pressure during the crash.
• The filing seeks roughly $490 million in Bitcoin recovery based on the value described at the time of writing, along with various forms of damages and fees.
• BitMEX says it was hit by distributed denial-of-service (DDoS) attacks on March 13, a disruption the estate points to as evidence that its forced-selling mechanism suppressed prices.
• The court filing leaves several damages figures to be determined at trial, rather than specifying all claimed amounts up front.

A complaint targeting BitMEX-linked entities

The Sept. 12 complaint names five defendants alleged to be connected to BitMEX: HDR Global Trading, ABS Global Trading, Shine Effort, 100x Holdings, and HDR Global Services. It was filed in the Celsius bankruptcy proceedings and can be viewed in the PDF court docket submission provided with the report: https://cases.stretto.com/public/x191/11749/PLEADINGS/1174909152680000000029.pdf.

In the filing, the estate alleges BitMEX wrongfully liquidated Celsius collateral on March 12, 2020, seizing 1,325.84 BTC. It further alleges that, the next day, BitMEX liquidated 5,034.33 BTC from the investment fund JST. The complaint says JST later assigned related claims to the estate.

The lawsuit seeks recovery of Bitcoin worth nearly $490 million at the time of writing. It also requests actual damages of at least 6,360.16 BTC (or its current equivalent), along with either return of the Bitcoin in kind or payment of an equivalent market value. Additional requested relief includes statutory damages, punitive damages, treble damages where applicable, profits the estate says BitMEX earned from the liquidations, and legal fees and costs. The complaint does not quantify some of these additional claims, stating that amounts should be determined during trial.

Allegations of liquidation mechanics that worsened the crash

A central theme in the estate’s allegations is that BitMEX controlled key parts of the liquidation process. The complaint asserts that BitMEX determined the prices used to trigger liquidations, provided the “engine” that executed them, and managed the insurance fund that received proceeds from certain liquidated positions.

More specifically, the estate alleges that some liquidation sell orders were placed at prices more than 24% below the next-best ask available on the platform. The estate also claims that during the intensified liquidation cycle, Bitcoin traded at a lower price on BitMEX than on competing exchanges.

The court filing argues that these mechanisms contributed to downward price pressure, not merely reflected it. In the estate’s view, the timing of events around March 13, 2020 is particularly telling: it claims liquidation orders stopped when BitMEX became unavailable, and Bitcoin’s price then recovered. That pattern is presented as evidence that the exchange’s forced-selling activity had been suppressing the market price.

DDoS disruptions cited on March 13

The estate points to a March 13 service disruption as part of its argument that BitMEX’s liquidation activity intensified the sell-off. In support of the timing, the filing references statements by BitMEX indicating that the exchange experienced distributed denial-of-service (DDoS) attacks on March 13.

As described in BitMEX’s published response at the time, the exchange reported two DDoS attacks occurring at 02:16 UTC and 12:56 UTC on March 13: https://www.bitmex.com/blog/how-we-are-responding-to-last-weeks-ddos-attacks.

For investors and market participants, the practical question embedded in the litigation is straightforward: if exchange liquidation systems were operating in a way that pulled prices lower—potentially more aggressively than the prevailing order book suggested—then the impact of liquidations during crises may not be limited to “necessary” risk reduction. Instead, it could reflect specific matching and execution behavior inside a particular venue.

Why the timing and targets matter

The filing’s timing is notable. The complaint was submitted on Sept. 12, according to the report, and it arrives shortly before BitMEX is scheduled to stop exchange services on Sept. 23. That proximity raises the stakes for the bankruptcy estate, which is attempting to recover assets allegedly lost during a historic stress period for crypto markets.

The case is also not the first legal action tied to BitMEX’s liquidation behavior during the same window. Earlier coverage referenced in the source material noted that, on July 23, BKX Services and David Namdar filed a separate proposed class action alleging combined losses of 622.66 BTC from forced liquidations. That earlier complaint, as described in the source, alleged an internal trading desk could access private customer information and continue trading during server freezes.

In response to the July case, the source states that a BitMEX spokesperson told Cointelegraph the claims were an “opportunistic claim with no basis” and that BitMEX would defend itself. The report also notes that this statement was about the July lawsuit and not a response to the Celsius complaint.

What comes next for the Celsius estate

With the lawsuit seeking both direct recovery of Bitcoin and a broader set of statutory, punitive, and treble damages—while leaving some claimed amounts for trial—the Celsius bankruptcy estate’s next challenge will be substantiating the alleged liquidation mechanics and linking them to specific losses during the March 2020 crash. Market watchers should focus on how the court handles proof related to execution quality during stress periods and whether the alleged price discrepancies and timing around the March 13 disruptions are sufficient to support the estate’s fraud and market manipulation theories.

Upbit has delayed the start of JPYC trading by three hours on Sept. 17, moving the yen-backed stablecoin’s scheduled launch from 12:00 p.m. to 3:00 p.m. KST across its KRW, BTC and USDT markets.

Upbit said in its Sept. 17 listing notice that the original support plan covered both JPY Coin (JPYC) and PayPal USD (PYUSD), with trading initially set to begin at noon. The exchange updated the notice at 11:50 a.m. KST and changed only JPYC’s start time. Upbit did not give a specific reason for the delay in that update.

At 1:58 p.m. KST, the latest public update reviewed still showed JPYC trading scheduled for 3:00 p.m. KST. Upbit had not posted a second postponement at that point. Public listing trackers had already registered JPYC/KRW, JPYC/BTC and JPYC/USDT as newly added pairs, but the exchange’s notice sets the official start of trading support.

JPYC trading on Upbit moves to 3 p.m. KST

The delay affects all three JPYC markets announced by Upbit. Once trading begins, customers will be able to trade JPYC against the South Korean won, Bitcoin and Tether. Upbit said deposits and withdrawals will use the Ethereum network, with other JPYC networks outside the scope of the listing notice.

Upbit identified the supported Ethereum JPYC contract 0xE7C3D8C9a439feDe00D2600032D5dB0Be71C3c29. The exchange warned customers to verify the network and contract before transferring funds because unsupported deposits may require a lengthy return process.

For pricing controls, Upbit used CoinMarketCap data when setting its initial trading restrictions. Its notice showed JPYC at 8.81 won at 9:40 a.m. KST on Sept. 17, compared with a previous closing reference of 8.78 won. Those figures were reference prices published before Upbit JPYC trading began and do not represent a post-listing market reaction.

Upbit’s general trading guidance explains that new assets do not have a previous Upbit closing price on their first trading day. Once trading starts, the platform uses the first executed price when calculating the day’s change for newly supported assets.

PYUSD schedule remained unchanged after JPYC delay

PayPal USD appeared in the same original listing announcement, but Upbit’s 11:50 a.m. update named only JPYC when changing the schedule. PYUSD therefore retained the noon start time stated in the original notice, with KRW, BTC and USDT markets included.

Deposits and withdrawals for PYUSD are limited to Ethereum under this Upbit listing. The exchange identified the supported token contract as 0x6c3ea9036406852006290770bedfcaba0e23a0e8.

PayPal describes PYUSD as a dollar-denominated stablecoin redeemable 1:1 for U.S. dollars.PayPal’s current PYUSD information says Paxos issues the token and backs it with U.S. dollar reserves and cash equivalents. PayPal’s terms list Ethereum, Solana, Arbitrum and Stellar among supported PYUSD networks, though Upbit is accepting only Ethereum transfers for its new markets.

PayPal, M0 and MoonPay had launched the PYUSDx framework, which lets businesses issue customized tokens backed by PYUSD. The report said Saturn, Concrete and Cap were the first projects using the platform.

Upbit limits early orders and Ethereum transfers

Upbit applies several controls during the opening period for newly listed assets. The exchange said buy orders are blocked for roughly five minutes after trading starts. Sell orders priced more than 10% below the previous closing reference are restricted for roughly the same period.

For approximately two hours after launch, only limit orders are available. Upbit blocks other order types and conditions during that window. The rules apply when each asset’s trading support begins, meaning JPYC’s restrictions start from its revised opening time.

Upbit requires customers to use supported virtual asset service providers or personally verified wallet addresses for deposits subject to its travel-rule procedures. Large deposits with unclear origins can lead to requests for information about the source of funds, according to the exchange notice.

The exchange’s trading guide lists minimum orders of 5,000 won in its KRW market, 0.00005 BTC in its Bitcoin market and 0.5 USDT in its Tether market. Upbit calculates its daily market data from midnight UTC, corresponding to 9:00 a.m. KST.

JPYC arrives after Japan’s regulated stablecoin rollout

JPYC Inc. received registration as a funds-transfer service provider under Article 37 of Japan’s Payment Services Act on Aug. 18, 2025. The company lists its registration as Kanto Local Finance Bureau No. 00099.JPYC’s registration announcement said the status allowed it to issue a yen-linked electronic payment instrument redeemable against Japanese currency.

The company formally launched the current JPYC stablecoin and its JPYC EX issuance and redemption service in October 2025. JPYC said the token is designed to track the yen at 1:1 and is backed by yen-denominated deposits and Japanese government bonds.

JPYC has since expanded beyond issuance and redemption. The issuer said on July 10 that on-chain circulation had passed 2 billion yen, while an earlier June update put cumulative JPYC EX account openings above 19,000 and cumulative issuance above 3 billion yen.

Retail payment tests have provided another use case. Japanese convenience-store operator Lawson expanded a stablecoin payment test in August to include JPYC, USDC and USDT at Tokyo stores. The trial used existing point-of-sale systems to process wallet-based payments.

In another JPYC deployment,crypto.news reported in July that AZ-COM Maruwa Holdings planned to use the yen stablecoin for payments involving roughly 2,300 business partners, including transport contractors.

JPYC Inc. says its regulated token is available across Ethereum, Avalanche and Polygon. Upbit’s Sept. 17 support, however, accepts only the Ethereum version for deposits and withdrawals, with JPYC trading scheduled to begin at 3:00 p.m. KST following the three-hour postponement.

Ethereum Classic node operators have been urged to avoid a disputed Core Geth v1.13.0 release after several mining pool nodes briefly adopted the software before returning to the maintained Argos client.

Classix said in a Sept. 16 incident report that the ethereumclassic/core-geth repository released v1.13.0 on Sept. 14 before the @ETC_Network account promoted it as an Ethereum Classic security update and told node operators to migrate. Similar messaging appeared on CoinMarketCap, while mining pools received emails from an ethereumclassic.com address.

The report described the release as a rogue version because the existing Core Geth maintainers had not reviewed it and the maintained etclabscore/core-geth repository had not issued the update. Classix recommended that operators continue using Argos v1.12.23, the current release from the repository that has maintained Core Geth since 2020.

Rogue Core Geth release reached some ETC mining nodes

Development of the disputed version accelerated during the days before its release. According to Classix, 96 commits containing 13,422 added lines and 3,977 deleted lines were pushed within 56 hours directly to the fork’s main branch without pull requests or outside review.

The ethereumclassic/core-geth repository itself had been forked from etclabscore/core-geth in December 2024. Activity increased on Sept. 12, 2026, when v1.13.0-rc1 was tagged. Six more release candidates followed before v1.13.0 was labeled stable at 15:06 UTC on Sept. 14. The @ETC_Network account published the migration request the following morning.

The software reached part of Ethereum Classic’s mining infrastructure before operators reversed the migration. Four 2Miners nodes were running CoreGeth v1.13.0 at 12:09 UTC on Sept. 15, according to node status data cited by Classix. By 23:35 UTC, all four had returned to Argos v1.12.23. Other listed mining pools remained on versions in the 1.12 series.

Some individual nodes continued running the disputed software. Etcnodes.org showed 11 v1.13.0 nodes at 07:33 UTC on Sept. 15, with the number falling to 10 by Sept. 16. Three of the remaining nodes matched bootnode IP addresses hardcoded into the new client, according to the report.

No blocks were lost, no chain reorganizations occurred, no funds were affected and no service interruption was recorded during the incident, Classix said. The report classified the event as high severity but low impact because the software altered consensus behavior while producing no recorded economic or transaction losses.

Ethereum Classic has faced chain reorganizations before. As crypto.news previously reported in its coverage of Ethereum Classic majority attacks, ETC suffered three majority attacks in August 2020, including reorganizations involving thousands of blocks.

Classix disputes v1.13.0 security claims

The v1.13.0 release told operators that every node running v1.12.x should upgrade and claimed each release in that series contained unpatched security issues, including a vulnerability allegedly used against Ethereum Classic bootnodes in March.

Classix challenged that description after reviewing seven security issues cited by the release. Five had already been addressed in maintained Core Geth releases between March and August, while the other two did not affect Ethereum Classic’s peer to peer path, according to the report.

CVE-2026-22862 and CVE-2026-26315 were among the vulnerabilities Classix said had been fixed in Aegis v1.12.21. Hermes v1.12.22 subsequently addressed other cryptographic issues, while Argos v1.12.23 incorporated delayed peer to peer message decoding from go-ethereum to address CVE-2026-26313.

Another listed issue, CVE-2026-22868, concerned KZG proof verification. Classix said it did not apply to Ethereum Classic because KZG proofs are associated with blob transactions introduced through Ethereum’s Cancun upgrade, which ETC has not activated. The report said a separate GraphQL query depth issue was not part of the peer to peer or consensus path and required GraphQL to be enabled manually.

Classix said Core Geth maintainer Diego López León reviewed the remaining differences and found no exploitable flaw in Argos that v1.13.0 corrected.

Core Geth changes included MESS and new bootnodes

Beyond its security claims, v1.13.0 changed how participating nodes could select chains and discover peers.

One modification reenabled Modified Exponential Subjective Scoring, or MESS, by removing the configuration that deactivated it at block 19,250,000. Ethereum Classic introduced MESS in 2020 as protection against chain reorganizations before disabling it through ECIP-1110 after Ethereum moved from proof of work to proof of stake.

Classix warned that different consensus clients could behave differently if only Core Geth nodes used MESS. Besu, Nethermind and Getc do not implement the mechanism, according to the report.

Historical reorganizations remain a particularly relevant issue for ETC. A crypto.news review of blockchain reorganization history described how miner consensus and competing chain histories can determine the outcome of reorganizations on proof of work networks.

The disputed client changed node discovery infrastructure as well. A commit replaced a DNS tree signing key maintained by etclabscore contributors since 2020 and hardcoded three new bootnode IP addresses. Two older discovery trees, blockd.info and etcdisco.net, were subsequently removed.

Three replacement domains were hosted through the same Cloudflare account, according to the report, while the repository acknowledged that an issue affecting the single account could remove all three paths. Operators following the migration instructions were not told who controlled the new signing key, Classix said.

The migration guide separately instructed operators to rotate their P2P node keys, citing CVE-2026-26315. Classix said Aegis had already fixed the underlying issue in March. Rotating a key changes a node’s network identity and forces it to rebuild peer connections through discovery infrastructure.

Ethereum Classic operators urged to return to Argos

Classix recommended that operators avoid ethereumclassic/core-geth v1.13.0 and continue running etclabscore/core-geth Argos v1.12.23. Operators that had already migrated were told to move back, restore their previous node key if it had been rotated and check their MESS configuration.

The report said Ethereum Classic operators should consider running different clients instead of concentrating network hash power on Core Geth. Nethermind, Besu and Getc remain available alternatives.

Client diversity has become a recurring security consideration across blockchain networks. Ethereum development, for example, continues to test upgrades across multiple execution and consensus implementations before deployment. Recent Glamsterdam testnet preparations included another private devnet after testing exposed consensus and execution implementation bugs ahead of the planned Sepolia activation.

Classix asked administrators of the ethereumclassic GitHub organization to tighten repository controls, require proposals and reviews before new repositories are created, protect default branches and identify maintainers for repositories distributing software. It separately requested that ethereumclassic/core-geth be removed or archived, or carry a warning explaining that it is not an official client.

Ethereum Classic itself does not designate an official developer, maintainer, website or client, according to the project’s website disclaimer quoted in the report. Classix said the maintained etclabscore repository derives its standing instead from its six year public history, active maintenance and adoption among ETC nodes.

The report is intended to serve as both an initial notification and an interim incident report. Classix said it would update the document if the remaining nodes are verified, organization maintainers respond or other material developments emerge.

In an interview with crypto.news, Selva Ozelli speaks with RoboTech Frontier Hub founder Denis “Dan” Saklakov about the intersection of artificial intelligence, blockchain and finance, and how his AI assisted investment tool Meijin uses an investor’s risk profile to manage exit strategies for assets including cryptocurrencies.

The discussion also covers using blockchain to create verifiable records of AI decisions, permissions and execution history, as well as Saklakov’s work on AI verification, robotics, human machine interfaces and architectures designed to separate machine intelligence from the authority to act.

Denis “Dan” Saklakov is a lawyer, digital asset manager and applied AI scientist whose work includes digital assets, blockchain technology and artificial intelligence. He previously worked with a cryptocurrency exchange and, since 2024, has served as Managing Partner of RoboTech Frontier Hub, where he develops technologies at the intersection of AI, robotics, finance, human-machine interaction and advanced computing.

Tell us about your professional and educational background.

My background crosses law, mathematical statistics, finance, artificial intelligence and technology. I was originally trained as a lawyer and later moved into corporate finance, investment banking, M&A, private equity and asset management. I earned a master’s degree from Northwestern University and more recently completed the MIT Applied AI Science postgraduate program.

Today I live in New York City and serve as Managing Partner of RoboTech Frontier Hub. I describe much of my current work as AI and AGI architecture: how intelligent systems should use information, make decisions and interact with the real world without allowing computational capability to turn automatically into uncontrolled authority.

That question has practical applications in finance, robotics, AI verification, human-machine interfaces and advanced computing.

I describe my broader architecture for safe AGI in my recent book, Before the Machine Chooses for Us: An AGI Architecture for Freedom, Human Survival, and Shared Consciousness.

The central problem of the book is how to make advanced intelligence extraordinarily capable while preventing capability itself from becoming self-authorized power.

Tell us about your journey to form RoboTech Frontier Hub in 2024, an accelerator focused on advancing robotics, automation, and artificial intelligence technologies, particularly your AI-assisted investment tool Meijin.

RoboTech Frontier Hub grew out of a problem I encountered repeatedly while working with scientific and engineering ideas.

A lot of interesting technology never develops properly because inventors are afraid that explaining the scientific principle will allow somebody to steal the product. So everything remains secret. But when the science itself is hidden, other researchers cannot test it, criticize it, identify its limits or connect it with another field.

We decided to use a different model.

At RoboTech, we try to put real scientific work underneath the technology. Where appropriate, we publish enough of the scientific foundation for other researchers to examine, challenge and develop it. At the same time, we currently protect the actual implementation, algorithms and commercial technology.

In simple terms, we do not want to hide the science just to protect the product. We want the scientific idea to survive examination, and then we build technology on top of what remains valid.

Meijin is one example.

The basic observation behind Meijin is very simple. Investors often spend enormous amounts of time deciding what cryptocurrency, stock or ETF to buy, but devote much less disciplined thought to deciding when to sell it.

Meijin does not choose the asset for you.

You choose Bitcoin, Ethereum, Zcash, Moderna stock, an oil contract or another asset. Meijin starts working after you own it.

We first quantify the level of risk the investor is prepared to accept. The system then continuously monitors the position and manages an exit strategy around that risk profile.

It may reduce or sell a position in stages as conditions change.

The purpose is not to promise the exact highest possible selling price. Nobody can honestly guarantee that. The purpose is to make the sell decision systematic rather than emotional.

Crypto makes this particularly useful because the market operates twenty-four hours a day. The investor sleeps. The monitoring system does not have to.

Another important distinction is that the final execution logic is deterministic and auditable. We can use AI for analysis, but we do not want a language model simply improvising the final decision to move somebody’s money.

Meijin is also only one of our projects.

Awareness Runtime deals with another problem created by modern AI: a model can produce a very convincing answer that is not actually supported by evidence. We are developing a verification layer designed to evaluate what is supported before an AI-generated conclusion becomes a professional decision or an external action. That is particularly important for finance professionals and lawyers.

Theta-Star and the Guardrail work address a different question: even if an AI system reaches the correct conclusion, who gave it authority to act? We separate intelligence from authorization so that the system proposing an action cannot simply create its own permission to execute it. This becomes particularly important in the automation of pilots, drivers and other high-stakes professions where decisions may have to be made extremely quickly.

ActionAtlas takes some of our work into robotics. The idea is to provide robots with compact, specialized information packages that can remain locally available when permanent cloud connectivity, GPS or external infrastructure cannot be assumed. Essentially, it could function as a map for your home robot, for example.

NeuroPhase explores another frontier: interfaces between computational systems and human neurological signals. Our longer-term objective is to move the machine interface closer to the natural information processes of the human brain rather than requiring the human body to become progressively more invasive just to communicate efficiently with machines. In other words, the long-term direction is a merger of human and machine, but one in which we try to move the machine closer to the human rather than forcing the human body to become progressively more machine-like.

We are also researching quantum computing in microgravity and orbital environments. The underlying scientific question is whether certain quantum-computing platforms could benefit from combinations of microgravity, low temperatures and mechanical isolation. Longer term, this could become relevant to the training and operation of future quantum-enabled superintelligent systems in distant orbital environments.

Another direction, Critical Systems, applies analytical and optimization methods to physical supply chains, including identifying real bottlenecks in critical industrial and aerospace manufacturing.

These projects look very different, but they come from the same model: identify the underlying scientific problem, determine where the evidence and mathematics actually support the idea, expose enough of that scientific foundation to examination, and then build a protected technology within those boundaries.

Tell us about the intersection of blockchain and AI.

For me, one of the most useful intersections of blockchain and AI is trust in machine decisions.

This becomes very concrete with something like Meijin.

Suppose an AI system analyzes a crypto position and decides that the investor should reduce it.

The important questions are not only: “What did the AI decide?” or “Was the prediction good?”

We also need to know what information the system used, what state it was in, what rules applied and whether the system was actually authorized to execute the decision.

Blockchain can help with that without running the AI itself on-chain.

The computation can remain on conventional hardware. What can be cryptographically anchored to an independent ledger is the relevant state of the system, permissions, decision conditions and execution history.

The important part is that the AI making the decision should not control the record that is later used to prove what happened.

It should not be able to make one decision, rewrite the history and later claim that it made another one.

Blockchain does not magically make an AI model correct. A false statement can be stored perfectly on a blockchain.

What blockchain can provide is provenance and a record that is difficult for the decision-making system itself to rewrite.

For crypto investors, that distinction becomes increasingly important as AI moves from simply providing market commentary to systems that can potentially interact directly with accounts, exchanges and financial infrastructure.

Imagine the same problem in medical care. You may want a nanorobot to clean your arteries, but you absolutely want to prevent it from doing something that could kill you. You therefore need a bulletproof, externally protected record of the rules defining what that nanorobot is and is not permitted to do. This is exactly the kind of problem for which blockchain or another independently secured cryptographic ledger can become extremely useful.

I think we are moving toward a world in which AI provides analysis at machine speed, while cryptographic systems help establish what state existed, what authority was granted and what action actually occurred.

That is much more interesting to me than simply putting another token around an AI product.

AI has been in the forefront of news lately, with the leaders of the largest AI companies suggesting that development of frontier models should slow down. Any thoughts on this?

AI is developing very quickly, and in crypto the consequences will probably become visible particularly fast because digital-asset markets are already digital, global, automated and open twenty-four hours a day.

I do not think the useful question for a trader is simply whether AI development is “too fast” or “too slow.”

The practical question is what happens when increasingly capable AI systems begin analyzing markets, executing strategies and communicating with financial infrastructure faster than a human being can realistically supervise every individual decision.

That is why I think the next stage is not simply better prediction.

We need better verification.

A very powerful AI that produces a trading recommendation in milliseconds is not particularly useful if nobody can determine whether the underlying information was reliable or whether the system had permission to make the resulting transaction.

This is where I see AI and blockchain becoming complementary.

AI can perform increasingly sophisticated analysis.

Blockchain and related cryptographic infrastructure can help establish provenance, permissions and an independently verifiable record.

Deterministic execution systems can then define what the AI is actually allowed to do.

For the retail investor, all of that should ultimately become almost invisible.

The user should not need to understand the internal architecture.

The practical experience should be much simpler: I selected this asset, I defined how much risk I am willing to accept, the system is watching it continuously, and I can later understand why it acted.

That is the direction we are pursuing with Meijin.

I have previously suggested that the development of AI may become difficult to forecast by conventional methods on a relatively short horizon, potentially around the end of this decade. I do not treat 2030 as some scientifically established deadline. It is a forecasting horizon.

But even without reaching anything we would call AGI or technological singularity, AI is already becoming capable enough to change how financial decisions are made.

For crypto, that change is not theoretical.

Markets already operate at machine speed.

The challenge now is making machine-speed intelligence trustworthy enough to use.

How can people reach you?

The easiest way to reach me is by email at [email protected].

RoboTech Frontier Hub:

https://www.robotechfrontierhub.com

My website:

https://www.saklakov.com

LinkedIn:

https://www.linkedin.com/in/denissaklakov

I also publish scientific work on arXiv and Zenodo, and research and commentary through Medium and saklakov.com.

About the Author:
Selva Ozelli Esq, CPA, is an international digital asset legal expert and author of Sustainably Investing in Digital Assets Globally and an award winning artist.  Her writings are translated into 45 languages and republished in over 200 global publications.  She is recognized as an expert media/TV commentator on global AI,  digital asset regulation, tax, and technology matters.