Australian authorities charged two Western Australian men on Aug. 26 following a joint investigation into the alleged TeamPCP cybercrime syndicate.

The Australian Federal Police filed a combined 14 charges against 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler. Both appeared before Perth Magistrates Court on Aug. 27, according to ABC.

The operation involved the AFP, the FBI and the Western Australia Police Force. Authorities executed warrants at properties in Cottesloe, Hamilton Hill and Mandurah.

Police allege the group compromised more than 1,000 organizations, obtained over 500,000 credentials and removed at least 300 gigabytes of data. The defendants have not been convicted, and the charges remain allegations.

TeamPCP allegedly targeted trusted software components

The joint investigation began in April after several cybersecurity companies supplied intelligence about malicious software distributed through an open-source repository, the AFP said in its official release.

Investigators allege TeamPCP inserted malicious code into legitimate software components used by other developers. Once incorporated into downstream systems, the modified code allegedly gave the group unauthorized access to organizations across government, academia and the private sector.

Software supply-chain attacks can spread beyond the organization hosting the original compromised code. A trusted component may be reused by hundreds of developers, allowing one modification to reach many unrelated systems.

Australian authorities estimated that responding organizations face remediation costs totaling hundreds of millions of dollars. That figure reflects an official estimate rather than a confirmed financial loss suffered by identified victims.

The AFP said infected software enabled the alleged theft of credentials, authentication materials and other sensitive information. However, authorities have not published a complete list of affected organizations or software packages.

Cryptocurrency payments remain under investigation

Police allege the two men were principal participants in the operation and received cryptocurrency for their roles. Authorities said the value of those payments remains under investigation.

The official release did not identify the cryptocurrencies involved. It also did not disclose wallet addresses, transaction hashes, mixers, exchanges or a confirmed laundering total.

Reports claiming that investigators seized large cryptocurrency balances or expensive property go beyond the details contained in the AFP announcement. Authorities said electronic devices and other items were seized, but they did not assign a digital-asset value to those items.

Thomson faces one Australian charge of dealing with money or property worth at least 100,000 Australian dollars that authorities allege represented criminal proceeds. The offence carries a maximum prison sentence of 20 years. That threshold describes the charge and does not establish the final amount involved.

Blockchain transactions can assist investigators when funds move through identifiable services or interact with regulated exchanges. As previously reported, Australian authorities forfeited nearly 25 Bitcoin and other assets tied to a 2013 exchange theft.

U.S. indictment creates a separate federal case

The U.S. Department of Justice separately unsealed a federal indictment against Thomson. Prosecutors charged him with conspiracy to violate the Computer Fraud and Abuse Act and obtaining information from a protected computer.

The American indictment concerns alleged TeamPCP attacks during spring 2026. Prosecutors claim malicious code scanned downstream systems, extracted sensitive information and maintained persistent access.

The Justice Department also alleges TeamPCP used stolen information to make ransom or extortion demands. Members allegedly offered not to publish victims’ data in exchange for payment. These claims have not been proven in court.

Each U.S. offence carries a maximum five-year prison term and a fine of up to $250,000, or twice the alleged gross gain or victim loss. Any sentence would be determined by a federal judge after a conviction.

The U.S. announcement names Thomson but does not announce a corresponding American indictment against Gaebler. Thomson remained in Australian custody when prosecutors disclosed the case.

U.S. agencies have previously targeted infrastructure allegedly used to convert cybercrime proceeds. In related coverage, the FBI seized nine cryptocurrency exchanges accused of laundering ransomware and investment-fraud proceeds.

Forensic examinations could produce further charges

The AFP said investigators are examining a large volume of seized data and electronic devices. That work may help authorities identify additional participants, victims and financial transfers.

Police have not ruled out further arrests or charges. They have also not announced whether the United States will seek Thomson’s extradition or wait for the Australian proceedings to advance.

The investigation’s next phase will involve digital forensics and the examination of cryptocurrency payment records. Prosecutors must separately prove each defendant’s identity, role, intent and connection to the alleged activity.

Potential victims should review software dependencies, rotate exposed credentials and examine authentication logs. Australian organizations can report incidents through Report Cyber, while individuals concerned about identity theft can contact IDCARE.

The case produced no verified cryptocurrency market reaction. It concerns the alleged use of digital assets for payments rather than a vulnerability in a blockchain or cryptocurrency protocol.

Float Protocol has lost about $28,000, or 10.71 ETH, after an attacker used a flash loan to manipulate a Uniswap V3 spot price and exploit how its Hypervisor contracts calculated liquidity provider share values.

SlowMist said on Aug. 31 that the attacker distorted the Uniswap V3 slot0 spot price, causing affected Hypervisor contracts to calculate incorrect LP share values. The blockchain security firm traced the exploit to functions that lacked TWAP or oracle verification and slippage protection.

Using large swaps in the underlying V3 liquidity pool, the attacker manipulated the values returned by currentTick() and getTotalAmounts(). SlowMist said the attacker then repeatedly deposited and withdrew funds while the Hypervisor contracts were working with inflated share values.

The security firm identified the attacker address as 0xaea29218262dc6b0904ca077f6527c49dfd426d9 and the attack contract as 0xb46655eb5b77de277063a75586d1883e951b6c54.

Two vulnerable contracts were listed as 0x85cbed523459b7f6f81c11e710df969703a8a70c and 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153, while the underlying liquidity pool was identified as 0xe8c2036068fc3b0161ee1def0e8d01df4eac0ac.

Float Protocol exploit relied on Uniswap V3 spot price manipulation

The attack centered on how the affected contracts obtained pricing information from the underlying Uniswap V3 pool. SlowMist said large trades allowed the attacker to distort slot0, which contains the pool’s current price and tick information.

Once the pool price had been moved, the manipulation changed the values returned by currentTick() and getTotalAmounts(). The affected Hypervisor contracts used the altered data to calculate LP share values, which allowed the attacker to interact with the contracts while those shares were incorrectly priced.

Flash loans supplied the temporary capital needed to make the large trades. As crypto.news previously explained, a flash loan allows assets to be borrowed without upfront collateral as long as the loan and fees are repaid within the same blockchain transaction.

If repayment does not occur, the entire transaction reverts. The mechanism allows traders to access large amounts of temporary liquidity for arbitrage, collateral swaps and liquidations, but the same liquidity can be used to exploit vulnerable pricing or smart contract logic.

In its analysis of Float Protocol, SlowMist attributed the loss to the contracts relying on a manipulable spot price without checks that could verify it against a time weighted average price or another oracle. Critical functions lacked slippage protection as well, according to the security firm.

Attacker repeatedly used inflated LP share values

SlowMist said the attacker did not stop after changing the Uniswap V3 pool price. Once slot0 had been distorted, the attacker repeatedly deposited into and withdrew from the affected contracts using the inflated LP share calculations.

The sequence allowed value to be extracted while the contracts were relying on the manipulated pool state. SlowMist estimated the final loss at approximately 10.71 ETH, worth about $28,000 when it published the alert.

Similar methods have been used in other DeFi attacks where large temporary trades distort prices or pool ratios before another contract uses the manipulated values.

In July, Allbridge Core was halted after an attacker used a $1.12 million USDC flash loan from Kamino during an exploit that PeckShield estimated caused about $1.65 million in losses.

Onchain Lens said the Allbridge attacker made rapid USDC and USDT swaps to change the ratio inside a stablecoin pool. The attacker then withdrew liquidity at the distorted rate before repaying the flash loan in the same transaction.

Allbridge said some liquidity pools were left temporarily out of balance after the incident and asked users who had profited from unusual pricing to consider returning the funds. The protocol paused Core while investigators tracked assets that had been moved from Solana to Ethereum.

Price data has remained a target in DeFi attacks

Another July incident showed how manipulated pricing information can be used even when the weakness sits outside a protocol’s smart contracts.

Ostium concluded that its $23.75 million USDC exploit originated from compromised off-chain infrastructure. The decentralized trading protocol said an attacker submitted fraudulent BTC/USD price reports that allowed funds to be drained from its OLP liquidity vault.

Ostium said its smart contracts were not the source of that breach. Automated monitoring detected the attack, trading resumed on July 23, and the protocol reported that user collateral had not been affected.

Float Protocol’s incident involved a different mechanism described by SlowMist. The security firm’s analysis placed the weakness inside the affected Hypervisor contracts, where manipulated Uniswap V3 pool data could influence the calculations used to value LP shares.

Flash-loan capital has featured in other attacks this year. A July attack against Swan Treasury used a PancakeSwap flash loan after a compromised off-chain signer key allowed an attacker to purchase STY tokens at a large discount.

The Swan Treasury exploit caused an estimated $625,000 loss. Security analysis found that forged claim and transfer signatures had been created with the protocol’s compromised signer key, allowing roughly 687,000 STY to be purchased at around a 100 times discount before being sold into the STY/USDT pool.

The flash loan supplied capital for the transaction, while investigators attributed the underlying vulnerability to the leaked signer key instead of the protocol’s signature verification logic.

SlowMist points to missing price checks in Float Protocol contracts

For Float Protocol, SlowMist specifically identified the absence of TWAP or oracle validation as part of the attack path.

A TWAP uses observations collected across a period instead of relying solely on the price available at one moment. Spot prices inside liquidity pools can move when a sufficiently large trade changes the ratio of assets, which was the mechanism SlowMist said the Float Protocol attacker exploited.

Crypto.news’ flash loan guide described price manipulation as one of the common ways temporary liquidity can be used against a vulnerable DeFi application. The report noted that the flash loan provides the capital for an attack while the exploitable weakness can lie in price oracles, governance systems or contract logic.

In Float Protocol’s case, SlowMist said large trades were used to distort the Uniswap V3 pool’s slot0 value, which in turn changed currentTick() and getTotalAmounts(). The attacker repeatedly deposited and withdrew while the affected Hypervisor contracts calculated inflated LP share values, resulting in an estimated loss of 10.71 ETH.

Decentralized exchange Hyperliquid and memecoin launchpad Pump.fun reportedly accounted for nearly 90% of the record $638 million in token buybacks carried out by cryptocurrency projects so far in 2026.

Crypto projects spent a record $638 million to repurchase their own cryptocurrencies year-to-date, up from $545 million during the same period in 2025 and $366,000 in 2024, according to Allium Labs data cited by the Financial Times in a Monday report. Of the $638 million, Hyperliquid accounted for roughly $370 million and Pump.fun for nearly $200 million.

Token buybacks are similar to share buybacks by publicly listed companies, which buy back their own stock to support their share prices and increase returns for existing shareholders.

While token buybacks are still rare in the crypto industry, more companies are taking advantage of the move. On Thursday, the Ethena Foundation opened a vote on a fee-switch proposal under which 95% of the net revenue paid to it from Ethena’s core business lines would be used to repurchase Ethena (ENA) tokens. The ENA token rose 10.7% on the day after the proposal.

Crypto project spend on token buybacks, year-to-date leading up to Aug. 25. Source: Allium Labs, Financial Times.

HYPE, PUMP outperform crypto market as buybacks boost token valuations

The Hyperliquid (HYPE) and Pump.fun (PUMP) tokens have outperformed the broader cryptocurrency market decline so far in 2026.

HYPE rose 145% and PUMP rose 109% year-to-date, while Bitcoin’s (BTC) price fell 10% and the total crypto market capitalization declined by 11.9% during the same period, according to TradingView data.

HYPE, PUMP, BTC, Total Crypto Market Cap, year-to-date chart. Source: Cointelegraph/TradingView

Hyperliquid spends about 99% of its revenue on token buybacks. Hyperliquid reported $169 million in second-quarter revenue on Aug. 6 and directed $141 million toward HYPE buybacks. 

Related: Crypto generated about 1% of Webull’s record $198M Q2 revenue

Pump.Fun allocates about 50% of its net protocol revenue for token repurchases. The memecoin launchpad currently boasts $420 million in annualized revenue, based on the average daily revenue of the past 90 days.

Crypto valuations could double in the next two years as protocols increasingly use revenue to fund token buybacks and burns, hence returning more value to investors, said Bitwise chief investment officer Matt Hougan earlier in August.  

Magazine: Why Ray Dalio says Bitcoin can’t replace gold

Bitcoin (BTC) heads into September still battling key resistance as markets flip hawkish on Federal Reserve policy.

Key points:

• Markets see a 60% chance of the Fed hiking interest rates in September, with jobs data due this week.
• Oil has experienced renewed volatility amid fresh US strikes on Iran and an unprecedented US-Venezuela oil-supply deal.
• Bitcoin remains under a crucial patch of resistance below $86,000 heading into the August monthly candle close.

September rate hike bets return after Jackson Hole

The coming week will bring the release of multiple US employment indexes, each likely to shape expectations for policy changes from the Federal Reserve.

The Fed is already in the spotlight after last week’s Jackson Hole economic symposium, which featured its first keynote speech from new chair Kevin Warsh. Warsh remained characteristically tight-lipped on policy cues, describing forward guidance — a fixture of Fed PR for decades — as having “overstayed its welcome.”

On inflation, Warsh described current data as too high, despite July’s lower-than-expected results for the Consumer Price Index (CPI) and Personal Consumption Expenditures (PCE) index.

“Each of these broad inflation measures have fallen significantly from their highs of a few years ago, but progress through the past couple of years has been more modest, and while this summer’s PCE and CPI readings were better than expected, they do not tell me that underlying trends have meaningfully improved,” he said.

Markets responded with increased expectations of interest-rate hikes, reverting to majority odds for a 0.25% hike at the Fed’s September meeting, per data from CME Group’s FedWatch Tool. At the time of writing, these odds stand at just below 60%, up from 41.4% last week.

Fed target-rate probability comparison for September FOMC meeting (screenshot). Source: CME Group

Rates expectations could be tempered, however, by labor-market numbers. Friday will see August nonfarm payrolls data released. The economy is expected to have added 50,000 jobs last month, compared to a loss of 23,000 in June.

Private-sector employment numbers will precede nonfarm payrolls on Wednesday, followed by initial jobless claims on Thursday. 

“All eyes are on the labor market,” trading resource The Kobeissi Letter summarized in commentary on X, noting that this would form the last slew of jobs data before the September rate decision.

Kobeissi flagged major downward revisions to employment numbers, with weak labor-market conditions forming a potential hurdle to Fed policy tightening. Citing data from the Bureau of Labor Statistics (BLS), it reported another 79,000 jobs removed in the 12 months through March this year.

“This follows last year’s record -911,000 revision and marks the 4th consecutive annual downward adjustment, matching the streak that ended in 2010 after the 2008 Financial Crisis,” it added, describing the labor market as being “weaker than initially reported for years.”

US employment data revisions. Source: The Kobeissi Letter on X.com

Oil spikes on US-Iran escalation

Oil markets are at the forefront of macro volatility as the week begins thanks to a combination of geopolitical catalysts.

Renewed US strikes on Iran sent Brent crude back above $90 per barrel on Monday, nearing its highest levels in a week. US WTI crude passed $85 per barrel, and was up 2.5% on the day at the time of writing.

CFDs on Brent crude oil one-day chart. Source: Cointelegraph/TradingView

European stocks came under pressure as a result of the events, with Germany’s DAX down 0.7%. US president Donald Trump implied that Iran’s Kharg Island oil hub was once more a target. In a post on Truth Social, Trump uploaded an AI-generated video that appeared to show the bombing of oil infrastructure, describing the island as “being blown to smithereens.”

DAX one-day chart. Source: Cointelegraph/TradingView

The strikes followed news of a major energy deal granting the US significant control of Venezuela’s oil reserves. Numbers from Venezuela’s interim president Delcy Rodriguez quoted by CNBC and others referenced a daily oil-output target of 1.5 million barrels, with total reserves involved at 65 billion barrels, currently worth around $5.4 trillion.

In a Truth Social post, Trump described the takeover as the “biggest oil deal in history.”

Bitcoin battles multiple 50-week trend lines

Bitcoin saw late sell pressure into Sunday’s weekly close, with a brief trip below its 50-week exponential moving average (EMA) at $77,269, per data from TradingView. 

Price defended the trend line, which we had previously flagged as important support, for a second consecutive week. In the wake of its recent rally, BTC had managed to reclaim the moving average with a weekly close for the first time since November 2025.

BTC/USD one-week chart with 50 EMA. Source: Cointelegraph/TradingView

In his latest market observations on X, Rafael Schultze-Kraft, cofounder of crypto analytics platform Glassnode, drew attention to the equivalent simple moving average (SMA) at $80,307. Here, BTC/USD still lacks a reclaim on the weekly time frame — something which has preceded additional price upside in the past, he showed.

BTC/USD chart with periods above and below 50-week SMA. Source: Rafael Schultze-Kraft on X.com

Monthly close faces stiff resistance

Heading into the August monthly close, Bitcoin bulls face a key test as monthly gains for BTC/USD hover near 25%.

BTC/USD monthly returns (screenshot). Source: CoinGlass

Despite the biggest crypto short liquidation event ever recorded, buyers have so far failed to reclaim key resistance above $80,000, analysis warns. 

“Bitcoin is still hovering beneath the Macro Downtrending resistance, having upside wicked briefly beyond it,” trader and analyst Rekt Capital summarized about the current status quo in his latest analysis on X. 

“Still the pivotal resistance and by staying below it, Bitcoin continues its series of Macro Lower Highs.”

BTC/USD one-month chart. Source: Rekt Capital on X.com

Rekt Capital argued that a breakout above this resistance would have major implications for the four-year BTC price cycle, as it would mean that its latest bear market would be shorter than those before it.

Beyond the trend line, however, additional resistance has already formed thanks to thickening ask liquidity on exchange order books. As Cointelegraph reported, this extends to $86,000, thus requiring even more buy-side momentum to effect a lasting breakout.

“Every overhead structure we track now sits between $81K and $86K; that band is where the recovery’s demand meets its test,” Glassnode wrote in research last week.

Larger buyers seen as pivotal to BTC price upside 

Glassnode calculated that 1.05 million BTC owned by long-term holders have a cost basis between $83,000 and $86,000. Long-term holders refer to wallets holding a given amount of BTC without selling for six months or more.

Related: Supply absorption ‘key question’ as Bitcoin fails to reclaim $80K: Analysis

BTC supply distribution by wallet cohort. Source: Glassnode

In additional findings this week, onchain analytics platform CryptoQuant drew attention to the potential impact of large-volume investors going into September. These entities, its data showed, were behind buyer appetite this month, while smaller investors took profit or exited the market after their holdings returned to breakeven.

“From 1–30 August, wallets with 100+ BTC added about 60,000 BTC. Wallets with 1–100 BTC sold about 33,000. Wallets under 1 BTC sold about 14,000,” it wrote in a blog post on Monday. 

“That split is the month. Large holders absorbed the breakout. Smaller holders used the rally as an exit.”

Bitcoin accumulation data by wallet cohort (screenshot). Source: CryptoQuant

CryptoQuant added that the view of large-investor accumulation would require reassessment should those entities start selling recently acquired supply below $80,000.