Peter Stokes, a 19-year-old dual U.S.-Estonian national, has been extradited to the United States over charges tied to Scattered Spider, a hacking group linked to crypto ransom demands. 

The U.S. Department of Justice said in a July 1 statement that Finnish authorities arrested Stokes in April under an Interpol Red Notice.

Stokes appeared in federal court in Chicago after his extradition last week. Prosecutors charged him with conspiracy, cyber intrusion, fraud, and related offenses. The DOJ said the charges remain allegations, and Stokes is presumed innocent unless proven guilty in court.

Jewelry retailer resisted ransom demand

The complaint centers on a May 2025 intrusion at a luxury jewelry retailer. Prosecutors allege Stokes and others used phishing calls to the company’s technology help desk while pretending to be employees who needed password resets. The attackers allegedly compromised employee accounts, including accounts with higher access rights.

The DOJ said the group stole company data and demanded about $8 million in cryptocurrency. The retailer removed the intruders from its network and did not pay, but prosecutors said the company still suffered at least $2 million in losses from business disruption, investigation, and response work.

Scattered Spider tied to wider crypto theft cases

Scattered Spider is also known as Octo Tempest, UNC3944, and 0ktapus. The DOJ said the group has been linked to “over 100 network intrusions” and more than $100 million in ransom payments. Prosecutors say the group uses social engineering, account takeovers, data theft, and crypto extortion against corporate victims.

As previously reported, U.S. prosecutors in 2024 charged five people linked to Scattered Spider in a separate case involving alleged phishing, SIM swapping, and at least $11 million in stolen cryptocurrency. That earlier case involved victims at companies and a crypto exchange, showing how the group’s methods crossed from corporate data theft into direct digital asset theft.

Crypto ransom cases remain under pressure

The Stokes case arrives as ransomware groups keep using crypto for payments, even as more victims refuse to pay. Chainalysis found that ransomware cashouts fell 35% in 2024 as law enforcement actions, sanctions, and stronger recovery plans disrupted criminal networks.

Chainalysis later said in its 2026 ransomware report that ransomware actors received more than $820 million in on-chain payments in 2025, down about 8% from 2024, while claimed attacks rose 50%. That mix shows fewer payments but continued pressure from cyber extortion groups targeting companies.

Law enforcement focuses on tracing funds

The case also shows why blockchain tracing remains central to cybercrime probes. As previously reported, blockchain forensics can help authorities track crypto transactions by linking wallets, exchange records, and transaction flows to real-world activity. Those methods do not stop every ransom demand, but they can help build cases after an attack.

Recent enforcement actions have also targeted laundering networks used by cybercriminals. As crypto.news reported, U.S. prosecutors charged alleged operators of AudiA6, a crypto laundering network accused of processing more than $389 million in transactions. 

The DOJ said the Stokes case is part of Operation Riptide, an FBI effort targeting cybercrime actors, infrastructure, and financial networks. Prosecutors say foreign-based suspects can still face U.S. charges when attacks hit American businesses or their customers. That stance may shape future cybercrime cases.

Alibaba has banned employees from using Anthropic’s Claude Code in workplace environments from July 10 over alleged security concerns involving embedded backdoors, according to a person familiar with the decision.

According to a source familiar with the matter, the restriction will apply across Alibaba’s internal work environments and takes effect on July 10. The person said the company reached the decision because of alleged security risks linked to embedded backdoors in the coding assistant.

As of publication time, Alibaba has not issued an official statement, and no further details about the alleged security concerns or the scope of the restriction were disclosed.

Claude faces another enterprise setback

The latest development comes just weeks after Anthropic’s Claude models lost access to another major enterprise customer group in Hong Kong. In June, the Financial Times reported that JPMorgan had stopped employees in Hong Kong from selecting Claude models from the bank’s approved list of large language models because of Anthropic’s licensing terms governing where the models could be used.

The report said Goldman Sachs had previously introduced a similar restriction after determining that Anthropic’s terms of service excluded use across Greater China, including Hong Kong. Anthropic later told the Financial Times that Claude had never been officially supported in Hong Kong, while JPMorgan declined to comment.

Those restrictions added to concerns among some financial institutions in Hong Kong as advanced AI tools become more deeply integrated into software development, research, and financial services workflows, according to the Financial Times.

Anthropic recently restored its newest models

The Alibaba decision also follows a turbulent few weeks for Anthropic’s latest AI systems. On July 1, the company restored public access to its Claude Fable 5 and Mythos 5 models after U.S. authorities lifted export restrictions that had forced Anthropic to suspend them in June.

Anthropic said it resumed deployment after what it described as productive discussions with U.S. officials and added new classifiers designed to detect and block more cybersecurity-related tasks. The company said the additional safeguards addressed government concerns over possible misuse through jailbreak techniques.

While defending its technology, Anthropic argued that the reported jailbreak involved a limited method rather than a universal bypass of the models’ safety protections. The company also announced expanded cooperation with the U.S. government on model testing, safety evaluations, misuse tracking, and information sharing related to jailbreak risks.

Humanity Protocol has confirmed it is repositioning toward enterprise artificial intelligence products after a $36 million exploit accelerated an internal strategic overhaul that had already been under discussion for months.

During a recent interview, Humanity Protocol founder Terence Kwok said the company had been reconsidering its long-term direction for the past six to nine months and that the June security breach pushed those plans forward sooner than expected.

Enterprise AI takes priority after hack

Rather than continuing to present itself primarily as a blockchain identity platform, Kwok said Humanity Protocol will increasingly focus on building products and services for enterprise AI customers. He explained that digital identity remains an important part of the company’s work because AI systems will require stronger methods of verifying people and credentials.

Kwok said the team has already been testing products designed for AI companies and plans to introduce additional enterprise-focused offerings. Humanity Protocol previously developed a proof-of-personhood blockchain supporting credentials for employment, assets, and credit scoring, including work with Mastercard on proof-of-assets applications. 

According to Kwok, the platform has registered around 10 million users, with a couple of million completing their credentials.

The strategic change follows one of the project’s biggest setbacks. Humanity Protocol lost roughly $36 million after attackers gained access to critical private keys, triggering a sharp collapse in the H token and forcing the project into recovery mode.

Recovery efforts continue as token migration moves ahead

Discussing the aftermath of the attack, Kwok said the chances of recovering the stolen funds are “pretty low,” adding that the team’s attention has instead turned to rebuilding the ecosystem. He compared the situation with Bybit’s unsuccessful efforts to recover approximately $1.4 billion worth of ether stolen in a separate attack last year.

As part of the recovery process, Humanity Protocol has issued a replacement token and distributed it to a range of addresses, including major cryptocurrency exchanges. Kwok said discussions are continuing around snapshot dates, suspended deposits and withdrawals, liquidity pools and custodian arrangements, while investigators work to identify every transaction that took place after the breach before completing compensation claims.

Law enforcement agencies in multiple jurisdictions, beginning with Hong Kong alongside authorities in the United States, have also been contacted as investigations continue, according to Kwok.

Earlier findings released by Humanity Protocol and security firm Quantstamp attributed the exploit to compromised private keys stored on a developer device rather than vulnerabilities in the project’s smart contracts. 

The June investigation concluded that attackers obtained control of production systems after malware infected a developer machine containing backups of several critical keys, allowing them to authorize legitimate-looking transactions that drained about 141 million H tokens from the Ethereum bridge before additional tokens were minted on BNB Smart Chain. Humanity Protocol and Quantstamp said the attack bore characteristics associated with North Korea-linked threat actors.

The breach wiped out most of the H token’s value within hours, with on-chain analysts estimating losses of more than $32 million at the time and the token falling roughly 89% as the attacker minted and sold tokens across multiple chains. Kwok said monitoring systems quickly detected unusual token movements after the compromise, although determining the full extent of the incident required several days of forensic analysis across the project’s infrastructure.

Meta CEO Mark Zuckerberg said AI agent development at the firm is progressing more slowly than expected, even as technology and crypto firms continue pouring resources into the nascent technology.

In a company meeting on Thursday, Zuckerberg said the “trajectory of the agentic development over at least the last four months hasn’t really accelerated in the way that we expected,” according to Reuters, which reviewed a recording of the call.

The bet on agent adoption hasn’t “come to fruition yet,” Zuckerberg said, adding that executives made an aggressive push into agentic infrastructure in January in part because of fears they weren’t moving “fast enough.” 

Despite the slower progress, Zuckerberg said he expects the firm’s AI investments to start paying off within the next three to six months.

Zuckerberg’s comments offer a reality check for technology and crypto firms betting that autonomous agents will soon become major users of blockchain payments. Meta, along with several crypto firms, has bet big on agentic AI, with many pivoting their business models to cater to autonomous AI agents. 

In May, Meta cut roughly 10% of its workforce and reassigned about 7,000 employees to AI-focused teams — a restructuring Zuckerberg acknowledged was not as clean as it could have been, with executives miscalculating the timing. 

Meta expands AI agent feature on three platforms

Zuckerberg’s concerns come as Meta expanded its Meta Business Agent globally for businesses on Instagram, Messenger and WhatsApp on Thursday.

The Business Agent can respond to customer inquiries, make product recommendations and close sales without human intervention, Meta said.

Zuckerberg also revealed in March that he was building a personal AI agent designed to support his decision-making as CEO.

The crypto industry has been a keen adopter of the technology, with Coinbase CEO Brian Armstrong and Circle CEO Jeremy Allaire among the executives predicting that AI agents will become the dominant users of blockchain-based payments in the coming years.

Several notable integrations advancing AI agent-driven stablecoin spending have emerged in recent months, including one by Amazon Web Services in May, when it integrated Coinbase’s x402 payments protocol into Amazon Bedrock AgentCore, allowing agents to transact in the USDC (USDC) stablecoin.

Related: OKX launches AI marketplace for autonomous agent economy 

In April, crypto wallet startup Oobit launched a Visa-supported virtual card for AI agents to make online purchases in USDt (USDT) on behalf of businesses.

AI agent payments adoption lagging

Despite the integrations, data shows that AI-agent transaction activity on the blockchain remains relatively small, with Artemis data showing that only $2 million in trading volume has been facilitated through the AI agent-supported x402 protocol over the past 30 days.

Monthly change in x402 transaction volume over the past 12 months. Source: Artemis

Magazine: The end of anonymity? AI could unmask crypto’s hidden identities

A teenager suspected of involvement with the “Scattered Spider” hacking group has been extradited to the US over his alleged role in an $8 million crypto ransom.

The US Justice Department said on Wednesday that Peter Stokes, a 19-year-old dual US-Estonian national, was arrested in Finland in April on an Interpol Red Notice and extradited to the US last week to appear in a Chicago federal court on Tuesday.

A criminal complaint unsealed in court accused Stokes and others of breaching a luxury jewelry retailer’s computer system in May 2025 to steal data and demand a ransom payment of $8 million in crypto. The retailer managed to evict them from the network and did not pay the ransom, but suffered $2 million in disruption damages, according to the complaint.

Stokes is one of the few arrests that authorities have tied to Scattered Spider, which often uses crypto ransoms. Ransomware actors received more than $820 million in payments last year, an 8% decline from 2024, even as attacks rose by 50%.

An image the FBI took from Stokes’ Snapchat account shows him wearing a necklace that says “Hack the Planet,” a quote from the 1995 cult film “Hackers.” Source: US Department of Justice

Alleged hack started with phishing call

According to the complaint, the hack against the jewelry retailer started with several phishing calls to the company’s technology help desk, with Stokes and others allegedly pretending to be employees requesting a reset of login credentials.

Authorities alleged the hackers managed to compromise three employee accounts in as little as two hours, two of which belonged to company IT administrators, who had access to higher-privilege accounts that were also breached and used to access the company’s systems, 

After a few days, Stokes and others allegedly sent a ransom note from a compromised company email account to demand funds or they would publish credit card and payment information.

However, the complaint said the company repelled the intrusion and that the intruders later contacted the company separately to demand $8 million, which the company did not pay.

Stokes allegedly involved in “numerous intrusions”

The complaint accused Stokes, who uses the online nicknames “Bouquet” and “Jordan,” of being a “Scattered Spider member who has engaged in numerous intrusions, or assisted in them” on multiple unnamed companies.

Authorities claimed that a search of a storage device allegedly linked to Stokes showed it contained downloads from a virtual private server that Microsoft had identified as being used to carry out intrusions on companies.

The complaint alleged that it also “contained exfiltrated records from multiple victim-companies.”

Related: Taiko reopens bridge after $1.7M exploit, says users made whole

The complaint claimed that Stokes’ Snapchat account shows “substantial wealth for a person his age” and alleged that he used the account to boast “about his international travel and wealth, and sent media regarding apprehended Scattered Spider members.”

The Justice Department said that Scattered Spider, also known as “Octo Tempest,” “UNC3944,” and “0ktapus,” has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions of dollars in damages.

Stokes was charged with six counts related to hacking, cyber extortion, fraud and conspiracy.

Magazine: Crypto scammers face death, Aussie CGT makes Asian hubs attractive: Asia Express

Roughly 10.83 million BTC are currently held at a loss, meaning their holders paid more than today’s price, against 9.22 million still in profit, according to Glassnode data. It is the first time loss-making supply has overtaken profitable supply since the current cycle began and reflects how deep the correction from bitcoin’s $109,000 January peak has cut.

Historically, these crossovers have landed near periods of peak financial stress and capitulation among newer buyers. They have also marked the point at which coins migrate from weaker hands to stronger ones, since only holders with high conviction tend to sit on losses rather than sell. Long-term holder accumulation and rising wallet-cohort balances across several size brackets have run alongside this latest deterioration in profitability.

Bitcoin traded at $61,361 on Thursday, up 0.7% on the day and 2.5% on the week, still roughly 44% below January’s all-time high, per CoinDesk data. Ether added 4.2% to $1,702, and Solana led the majors at 18.6% on the week to $80.44, with volume running above $3.6 billion.

Whether the supply crossover marks a bottom depends on what follows. In 2018-19 and 2022, similar readings preceded months of basing before a sustained recovery. The chart does not resolve on its own. ETF flows returning and macro pressure easing are what convert the accumulation signal into a price signal.

Japanese investment firm Metaplanet continued its corporate Bitcoin buildout in the second quarter, adding 2,823 BTC at an average price of about 12.71 million yen (roughly $78,850 at current exchange rates). The purchase pushed the company’s total holdings above 43,000 Bitcoin, while slightly lowering its average acquisition cost.

Separately, the story also highlights a contrasting trend among some smaller treasury-focused companies. South Korean firm K Wave Media exited its Bitcoin treasury strategy after selling its remaining BTC to address debt, while France-based Sequans Communications previously said it would monetize its remaining holdings over time.

Key takeaways

• Metaplanet bought 2,823 BTC in Q2, bringing its total to more than 43,000 BTC and reducing its average cost per coin.
• The latest tranche was acquired at an average price of about 12.71 million yen per BTC, lowering Metaplanet’s average acquisition cost to roughly $95,117.
• Metaplanet reported about $10.95 million in quarterly revenue linked to Bitcoin income-generation strategies involving options premiums and related yield methods.
• K Wave Media sold its last 88 BTC to repay debt, ending its Bitcoin treasury approach after earlier plans to expand holdings.
• Not every corporate treasury is expanding: Sequans Communications previously signaled that it would monetize its remaining Bitcoin holdings over time.

Metaplanet expands holdings and refines its cost base

According to a Thursday announcement from Metaplanet, the company acquired 2,823 Bitcoin during the second quarter at an average price of about 12.71 million yen per BTC. That figure matters because it was below Metaplanet’s prior average purchase price, enabling the firm to reduce its blended cost basis.

The acquisition lowered Metaplanet’s average acquisition cost to about $95,117 per BTC, down from approximately $96,258 previously. Metaplanet’s total Bitcoin holdings now stand at 43,000 BTC acquired for an aggregate value of about $4.1 billion, based on the figures in the company’s announcement.

Beyond accumulation, Metaplanet also disclosed quarterly performance tied to its Bitcoin income strategy. The company reported around $10.95 million in revenue from Bitcoin-related activities during the quarter. The approach, as described in the announcement, centers on earning premiums by selling cash-secured options and deploying other Bitcoin yield tactics.

For investors, the combination of spot purchases and options-based income generation is a key part of how treasury-style Bitcoin companies attempt to justify their equity valuations. When Bitcoin’s price is volatile, these revenue mechanisms can, in theory, partially offset drawdowns—though the net effect depends on execution, market conditions, and counterparty or strategy risks (none of which are detailed in this particular excerpt).

Shares move, but the broader performance picture remains uneven

Metaplanet’s equity performance reflected modest market optimism around the filing. The company’s shares closed Thursday up 3.5%, though the stock remains down about 48% year-to-date, according to the linked market page cited in the source text.

That underperformance also stands out against Bitcoin itself, which the source notes fell 31% over the same year-to-date period. The contrast underscores a persistent reality for corporate Bitcoin holders: even when a company keeps buying and building a large BTC position, investors may still reprice the stock due to factors like equity dilution risk, funding costs, valuation assumptions, or the market’s perception of how sustainable treasury income is.

The Metaplanet update comes during an ongoing push by several corporate buyers—yet the story is not purely one-directional, as other firms are trimming exposure.

Treasury strategies: K Wave Media exits after selling remaining BTC

While Metaplanet added Bitcoin, K Wave Media—an Nasdaq-listed company in South Korea—went in the opposite direction. The company sold its remaining 88 BTC to repay $6 million in debt, exiting its Bitcoin treasury strategy, according to a Tuesday filing with the U.S. Securities and Exchange Commission.

The SEC filing indicates a sharper reversal than what the company had previously communicated. Earlier coverage referenced in the source text describes K Wave Media’s July 2025 announcement that it secured $1 billion in capital capacity to drive its Bitcoin treasury strategy and aimed to expand holdings to 10,000 BTC. Exiting after holding only 88 BTC suggests the original plan ran into constraints—whether financial, operational, or strategic—though the excerpted material does not specify the reasons.

This kind of turnaround is important for readers because it highlights a mismatch risk that can exist in treasury models: plans premised on sustained capital access, favorable volatility, and consistent BTC purchase economics may not survive changing market conditions or debt obligations.

Other companies continue to monetize rather than accumulate

The source also points to Sequans Communications, a France-based semiconductor company that said in May it would monetize its remaining Bitcoin holdings over time. At the time of that announcement, Sequans reported holding 658 BTC, and its shares reportedly rose about 14.5% after the disclosure.

Taken together with K Wave Media’s decision to exit, the broader takeaway is that corporate Bitcoin strategies are diverging. Some companies are doubling down through additional spot buying and structured income strategies, while others are winding down exposure, using Bitcoin holdings to address liabilities, or planning to gradually convert BTC into cash.

Even within the same sector, these choices can produce very different investor outcomes depending on each firm’s balance sheet, debt profile, and how its equity market values the “BTC treasury” thesis.

Looking ahead, investors should watch whether Metaplanet can sustain its Bitcoin income-generation revenue while continuing to manage its cost basis, and whether other treasury-focused firms follow K Wave Media and Sequans toward monetization or debt reduction. The key uncertainty across all these cases remains whether corporate models that rely on both holding BTC and generating yield can hold up as market conditions and financing access evolve.