Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

Ledger rejected claims that it had been hacked after OneKey’s Anzen security team reproduced a transaction replacement flaw against an outdated version of Ledger’s Ethereum application.

OneKey founder Yishi Wang said on Aug. 27 that researchers completed the attack against Ethereum app 1.22.1 in a laboratory. Ledger confirmed the underlying vulnerability but said it had already patched the affected application before OneKey published its demonstration.

Ledger Ethereum flaw broke the trusted display guarantee

The vulnerability involved communication between a Ledger device and its connected host. Ledger applications receive instructions called Application Protocol Data Unit commands, or APDUs, from wallet software, webpages or other interfaces.

An affected application could accept a second APDU command while the user was reviewing an earlier operation on the device screen. The new command could overwrite signing parameters stored in shared memory without updating the displayed information.

Under that scenario, the user could review transaction A and approve it while the application generated a signature covering transaction B. The device would not warn the user that the underlying information had changed.

Ledger classified the issue as a time-of-check to time-of-use race condition. Its bulletin said the flaw defeated the trusted-display protection that hardware wallets use to let customers verify amounts, addresses and contract actions before signing.

The issue did not reveal seed phrases or extract private keys from the secure element. Instead, it could cause the protected key to sign parameters different from those shown to the user.

Exploitation required a compromised connection

An attacker needed control of communications between the Ledger application and its host. Ledger listed malware, a compromised wallet application, or a hostile webpage with WebHID or WebUSB access as possible routes.

The attack could not be performed remotely against an unplugged device. A user also had to approve the transaction while the malicious software manipulated its pending signing context.

Ledger said the defect was located in the input and output handling of its Secure SDK, not the device operating system or firmware. Applications compiled with affected SDK releases depended on their own state checks to reject commands arriving during an active review.

This means exposure was application-specific. An application remained protected if every asynchronous command entry point properly checked its state, even when built using the affected SDK.

Ledger disputes whether the test counts as a hack

Wang described the laboratory result by saying, “we hacked Ledger.” He also said the company fixed the problem in Ethereum app 1.22.3.

Ledger Chief Technology Officer Charles Guillemet disputed that description. He said “reproducing an already-patched bug is not ‘hacking Ledger’” and characterized OneKey’s work as a laboratory exercise against an older application.

The version history supports a more precise timeline. Ethereum app 1.22.2, released Aug. 13, was the first application update containing state checks designed to stop the documented transaction substitution path.

Ledger then released Secure SDK 26.6.1 on Aug. 21. That update blocks interleaved commands before application code receives them. Applications were subsequently rebuilt using the corrected SDK.

Ledger now recommends Ethereum app 1.22.3 or later because the newer release contains the broader SDK protection and addresses another transaction-display flaw. OneKey was therefore correct that 1.22.3 is protected, but the first application-level fix appeared in 1.22.2.

As crypto.news previously reported, Ledger had already said its Ethereum signing vulnerability was fixed before the public disclosure.

Users must update applications through Ledger Live

Ledger said it found no evidence that attackers exploited LSB 023 against customers. No cryptocurrency losses have been publicly linked to this specific issue.

Users should open Ledger Live, install the latest device applications and verify the Ethereum app version on the hardware wallet. Updating firmware alone does not replace applications built with an affected SDK.

Third-party developers must also review their state handling and rebuild applications with Secure SDK 26.6.1 or later. Ledger said the weakness was introduced in August 2025 and affected SDK versions through 26.6.0.

The disclosure follows other hardware wallet security fixes. In related coverage, BitBox patched two flaws affecting firmware installation and Bitcoin address handling, also without reporting confirmed exploitation.

Unstoppable Domains has abandoned plans to seek ICANN recognition for several of its original web3 domain extensions and has begun refunding customers who bought names after the company committed to pursuing the 2026 application round.

Unstoppable Domains founder Matthew Gould said on Aug. 26 that the company did not submit applications for its web3 top-level domains after concluding that ICANN compliance, application and potential bidding costs would exceed the sales it expected from the extensions.

The decision reverses a commitment made only six months earlier. On Feb. 17, Unstoppable said it intended to apply for ICANN recognition for its original .ZIL, .Crypto, .Wallet, .NFT, .Bitcoin and .DAO extensions, which would have allowed approved domains to eventually operate through the conventional Domain Name System.

“The cost of taking web3 domains through icann in both compliance and application and bidding is higher than what we believe we’d recover in sales,” Gould wrote. He said refunding buyers affected by the company’s ICANN plans made more business sense than going through with the applications.

Timing left little room for another change in course. ICANN opened its 2026 new generic top-level domain application window on April 30 and closed submissions at 23:59 UTC on Aug. 12, receiving more than 1,600 primary applications. Evaluation fees were generally due by Aug. 19, while Reveal Day will disclose the strings that passed administrative checks no later than nine weeks after the application window closed.

Unstoppable Domains refunds follow missed ICANN applications

Customers were informed of the decision by email, according to Gould, who said the company had not applied and was issuing refunds under the terms communicated to users over the previous 24 hours.

No complete public list of affected extensions or detailed refund terms accompanied his statement. Some holders said they received information on Aug. 25 identifying domains involved in the process.

The change also follows years in which ICANN compatibility formed part of Unstoppable’s pitch for several web3 naming products. Crypto.news previously reported in June 2024 that Unstoppable and Blockchain.com planned to register the .blockchain extension through ICANN, with the proposed domain designed to work across both conventional websites and blockchain applications if approved.

Under that plan, .blockchain holders would have gained access to standard DNS functions, including website resolution and email, while retaining blockchain-based uses such as human-readable crypto addresses.

Similar plans were attached to other partnerships. Reddit’s r/CryptoCurrency launched .MOON web3 domains with Unstoppable for a community of about 8.8 million users, offering the names as onchain identifiers that could be used with hundreds of blockchain applications and wallets.

Unstoppable had also worked with Brave on blockchain domains. The browser launched .brave onchain domains for its more than 85 million users, with the two companies exploring an ICANN application that could eventually allow .brave addresses to operate across both web browsers and blockchain networks.

Web3 domain sales did not justify the cost

Gould tied the latest decision to demand for web3-only naming products, saying sales data did not support running several generic extensions through the ICANN process.

“I think a lot of people have an inflated sense of the web3 market since the 2021 crypto nft bubble. It is small. It is niche,” he wrote, adding that Unstoppable did not believe the market could support multiple generic TLD applications during the current round.

According to Gould, the company based the decision on its own sales figures instead of expectations about future demand.

Public revenue figures from Ethereum Name Service also show registration income well below levels recorded during the 2021 and 2022 crypto market cycle. ENS generated about $315,000 in registration and renewal fees during the latest 30-day period cited in the source material and roughly $4.04 million over the preceding 12 months. Cumulative fees since 2019 stood at about $112.5 million, while its strongest quarter, in the second quarter of 2022, produced about $20.6 million.

Unstoppable had already been withdrawing several partner extensions from possible ICANN applications before the latest decision. Its support material listed dozens of partner strings whose operators chose not to proceed, resulting in refund periods during September and December 2025 and another window from Feb. 16 to March 2, 2026.

Extensions covered by earlier decisions included .pengu, .pudgy, .sonic and .ltc. Some had originally been promoted with plans for eventual ICANN applications, including .AGI, developed with the 0G Foundation.

The company’s roots in blockchain naming go back years. In 2019, Unstoppable prepared to auction .zil blockchain domains under its early model for user-owned naming assets, before .crypto and a longer list of extensions became part of its product lineup.

Domain holders are seeking wider refunds

Some customers are now disputing which purchases qualify for repayment, arguing that they retained domains because Unstoppable had said it would seek ICANN recognition.

A holder posting under the name 00.x described the reversal as a “complete betrayal of the vision that’s been spoken about for years” and called for refunds across every Unstoppable domain that will not proceed to ICANN. The holder later told Gould that offers for some domains had been rejected because of expectations surrounding the ICANN process.

Jeffrey Peterson separately asked whether buyers who purchased domains as early as 2021 could receive refunds.

Another holder using the name fastfwd.crypto called for repayment on all extensions that Unstoppable had decided not to submit, arguing that customers could not properly assess earlier refund offers before seeing which applications the company ultimately filed.

Gould said the decision does not remove the blockchain-based assets themselves. Existing web3 domains will continue operating onchain and can still be used for crypto transactions under their current functionality.

“The web3 domains will remain as onchain assets for crypto transactions as they have always been,” he wrote.

Unstoppable is still working on ICANN applications for partners

Although its own original extensions are not proceeding, Unstoppable remains involved in the ICANN process as a service provider for other organizations.

On Aug. 18, Gould said the company was working with Telegram on its .gram top-level domain application. Unstoppable had also said in 2024 that it was supporting more than 19 web3 companies preparing for the 2026 round after securing ICANN registrar accreditation.

By March, Gould said conventional DNS domains represented more than 90% of the company’s business, while web3-only domains had been associated heavily with the 2021 crypto boom and had not reached mainstream use.

Changes around the company have become visible elsewhere. Unstoppable’s February page covering web3 refunds now redirects users to a login screen, while unstoppabledomains.com redirects to unstoppable.ai. Its X profile currently describes the business as an “agentic workspace & IDE that keeps your team on the frontier.”

Ethereum Name Service has taken a different route for the 2026 ICANN round. ENS tokenholders approved a restructured ENS Foundation on Aug. 11 with authority to seek recognition and stewardship of the .ens top-level domain.

ENS is not pursuing .eth because ICANN reserves the three-letter string as an ISO 3166-1 alpha-3 country code. ENS Labs has said its .ens application is intended to protect the ENS brand, with any eventual delegation unable to occur before 2028.

The two naming companies have previously contested intellectual property issues in the blockchain domain sector. ENS challenged Unstoppable in 2023 to open patents covering blockchain naming technology, continuing a dispute between two of the industry’s longest-running web3 domain providers.

Charles Schwab says it plans to broaden the set of cryptocurrencies offered on its direct crypto trading platform by adding Solana (SOL), Avalanche (AVAX) and Chainlink (LINK) in the coming months. The update would extend Schwab Crypto’s initial rollout, which focused on Bitcoin (BTC) and Ether (ETH).

Schwab Crypto began bringing direct retail crypto trading to customers in May, with access via Schwab’s website, mobile app and thinkorswim. For now, Schwab has not provided additional details on which other digital assets it may consider beyond the three newly announced tokens, nor has it shared a specific schedule for each addition.

Key takeaways

• Schwab Crypto will add Solana (SOL), Avalanche (AVAX) and Chainlink (LINK) to its direct trading offering in the coming months.
• The expansion builds on Schwab Crypto’s May start, which initially supported direct trading in Bitcoin (BTC) and Ether (ETH).
• Schwab charges 75 basis points (0.75%) of the trade’s dollar value for each crypto transaction.
• Schwab Crypto is available in all US states except New York and Louisiana, and it is not offered in US territories or internationally.

Schwab Crypto grows beyond BTC and ETH

Schwab’s move signals a more multi-asset approach to institutional-style crypto access for retail investors. Schwab Crypto started rolling out direct crypto trading to retail clients in May, pairing crypto positions with traditional investment capabilities through Schwab’s existing platforms.

While Schwab has outlined the addition of SOL, AVAX and LINK, it has kept its longer-term roadmap unclear. The company did not specify what other tokens are under consideration or provide a detailed timeline beyond the three assets it has named.

For market participants, the practical question is how quickly Schwab can operationalize additional assets inside a regulated brokerage framework—especially as demand and product expectations evolve among retail investors used to multi-asset trading interfaces.

Pricing and availability for US customers

Schwab Crypto uses a straightforward fee model: a charge of 75 basis points, or 0.75%, on the dollar value of each crypto trade. The service is offered through Charles Schwab Premier Bank, with Charles Schwab & Co. handling certain operational functions on the bank’s behalf.

Geographic restrictions remain part of the offering. Schwab Crypto is available in all US states except New York and Louisiana, and it is not available in US territories or internationally. That footprint matters for traders and advisers evaluating whether Schwab’s expansion can meaningfully broaden access in the near term, particularly in states where other venues may dominate.

Broader push into new trading products

Schwab’s crypto expansion comes as the firm pursues other trading-product initiatives outside of digital assets. In June, The Wall Street Journal reported that Schwab plans to offer prediction contracts tied to the S&P 500 index in partnership with Cboe Global Markets. Those contracts would let clients bet whether the S&P 500 closes above or below a specified level, according to the report, and were described as expected to launch within months.

Unlike some prediction-market platforms that allow a broader set of event-based outcomes, Schwab’s planned offering—based on the reporting—would begin with index outcomes rather than opening immediately to a wider menu of contracts.

Taken together, Schwab’s actions suggest the brokerage is actively expanding its product suite for retail customers while staying inside tightly defined, exchange-partnered or brokerage-regulated structures. That approach can be relevant to how investors think about legitimacy, operational safeguards and compliance—areas that heavily influence adoption for both crypto trading and adjacent market products.

What Schwab’s scale signals for adoption

Schwab’s capacity to add assets may also be influenced by the size of its customer base. As of July 31, Schwab reported holding $13.04 trillion in client assets across 39.9 million active brokerage accounts. In results reported for the second quarter, Schwab also said it delivered record net revenue of $7.1 billion and net income of $2.8 billion.

While those figures are not direct measures of crypto activity, they provide context for how quickly a brokerage can iterate across product lines once a new offering clears operational hurdles. If Schwab Crypto’s early rollout meets internal performance thresholds, expanding from two benchmark tokens to a broader set of networks and use cases could deepen engagement from investors looking for exposure beyond BTC and ETH.

At the same time, Schwab’s decision to announce three specific additions—without committing to a detailed schedule for further tokens—highlights the balancing act between customer demand and the pace of compliance, custody, trading infrastructure and liquidity management.

What to watch next

Investors should keep an eye on when SOL, AVAX and LINK become available in Schwab’s direct trading menus, and whether Schwab provides additional milestones for any further digital-asset expansion. The next signals will likely come from Schwab’s own platform updates and any follow-on guidance that clarifies timing and the scope of future token listings.

The article has been updated with information provided by Bitfinex Securities.

Bitfinex Securities has completed a record $50 million tokenized capital raise for metals company Alkemya through a security backed by partnership interests tied to an independently valued $1.64 billion nickel asset base.

Bitfinex Securities and Alkemya said in an announcement on Thursday that the fundraising involved ALKN, a tokenized security representing limited partnership interests in Luxembourg-based Alkemya Metacore SCSp.

The partnership owns about 7 million meters of 99.99% pure nickel wire, according to the companies. Its nickel holdings have been independently valued at about $1.64 billion, according to the companies, while ALKN represents limited partnership interests tied to the asset.

For Bitfinex Securities, the $50 million total is the largest capital raise completed on its platform. The company said in the announcement that its previous record stood at $30 million and involved USTBL, a tokenized product linked to short-term U.S. Treasuries.

Bitfinex Securities sets a new $50 million fundraising record

Following the Alkemya transaction, Bitfinex Securities has now completed seven capital raises and listed 16 assets, according to figures provided by the platform.

ALKN is also Alkemya’s first tokenization project, an Alkemya spokesperson said in the announcement. Under the structure, eligible investors receive fractional interests in Alkemya Metacore SCSp in digital form, with the tokens designed to be transferable between eligible holders.

Proceeds from the offering will be used to support the commercialization of high-purity nickel products through Alkemya’s Singapore-based operating subsidiary, Green Transitional Metals Pte Ltd. Proceeds will be used to commercialize high-purity nickel products through its Singapore-based operating subsidiary, Green Transitional Metals Pte Ltd. Planned applications include semiconductors, electromagnetic interference shielding, aerospace and defense, power systems, green hydrogen, and rare and precious metals recovery.

Investors who did not participate in the completed $50 million raise will still have access to additional ALKN tokens. Bitfinex Securities plans to keep the offering open to eligible investors until Oct. 15 as Alkemya proceeds with another fundraising tranche.

Following the initial $50 million capital raise, ALKN tokens are available for trading on Bitfinex Securities for eligible investors. Additional ALKN tokens also remain available as part of the offering.

ALKN gives investors fractional interests in the nickel partnership

The ALKN structure places the legal investment interest in the Luxembourg partnership onchain while the underlying physical asset remains the nickel inventory held through Alkemya Metacore.

Each token represents an interest in the limited partnership instead of direct ownership of individual sections of nickel wire. Alkemya said the digital structure allows those partnership interests to be divided into fractional holdings and transferred electronically among eligible investors.

The transaction also comes as tokenized commodities have expanded beyond precious-metal products. In April, crypto.news reported that the value of tokenized commodities and equities had moved above $7 billion, with gold-backed products accounting for a large part of the market while tokenized oil, gas and agricultural assets were also gaining activity.

The same report cited Bitfinex research that put the tokenized commodity market at roughly $7 billion after an increase of nearly 600% since early 2025. Bitfinex said tokenized commodities were increasingly being used as onchain collateral across centralized platforms and decentralized finance protocols.

Earlier Bitfinex Securities offerings included Treasuries and debt

Before the Alkemya transaction, Bitfinex Securities had used its infrastructure for tokenized government debt exposure, corporate financing and other securities.

Crypto.news previously reported in November 2024 that the platform had launched a tokenized U.S. Treasury offering under El Salvador’s Digital Asset Law. Issued by NexBridge Digital Financial Solutions, USTBL represented shares in the iShares $ Treasury Bond 0-1yr UCITS ETF, which tracks U.S. government debt with maturities of less than one year.

The initial USTBL subscription period targeted a minimum raise of $30 million and accepted Tether’s USDT, with Bitcoin payments planned afterward. Bitfinex Securities said in the announcement in connection with the Alkemya deal that its previous fundraising record was the $30 million USTBL raise.

Earlier tokenized deals on the platform included corporate debt. In April 2024, Bitfinex Securities launched a tokenized debt offering designed to raise $6.25 million for construction of a Hampton by Hilton hotel near El Salvador International Airport. The HILSV security was issued on Liquid Network, a Bitcoin sidechain, and carried a five-year term with a 10% annual return.

Bitfinex Securities had also entered the tokenized bond market in 2023 with ALT2611, a 36-month security denominated in USDT and issued by a Luxembourg-based securitization fund managed by Mikro Kapital. The offering targeted $10 million and carried a 10% coupon, although early subscriptions fell below the original fundraising target.

Bitfinex has built regulated operations around tokenized assets

Bitfinex Securities operates regulated securities platforms in both El Salvador and the Astana International Financial Centre in Kazakhstan. The platform has also listed more than $500 million in tokenized assets, according to the company. In July, Bitfinex completed its Salvadoran license set covering spot trading, derivatives and regulated tokenized securities through separate operations.

In El Salvador, Bitfinex Securities received approval under the country’s Digital Assets Issuance Law before the group completed the rest of its local licensing structure. The National Commission of Digital Assets registry lists the securities entity under PSAD-0001 with an Oct. 24, 2023 registration date, and its permitted business includes issuance and trading infrastructure for tokenized financial products.

The platform’s tokenization work has also extended into distribution and infrastructure agreements. In November 2025, Tether’s Hadron tokenization platform, KraneShares and Bitfinex Securities announced a tokenized capital markets partnership under which Bitfinex Securities would provide regulated infrastructure and support access to secondary-market liquidity for tokenized products.

Additional ALKN tokens remain available to eligible investors through Oct. 15, while ALKN is already available for trading on Bitfinex Securities following the initial capital raise.