Iranian hacker collective CyberAv3ngers is the main suspect in a series of cyber attacks that hit 30 different water companies across the state of Minnesota this week.

That’s according to security research firm Tenable, which claims the attacks are consistent with CyberAv3ngers’ past exploits. 

Meanwhile, Minnesota’s state IT agency claimed the disruption was the result of a “coordinated cyberattack.”

Tenable not only believes the attack to be the work of CyberAv3ngers, but also says the timing of the attack is “significant” given a July 22 report from the US Cybersecurity and Infrastructure Security Agency (CISA). 

In it, the CISA warned that Iranian actors were actively targeting internet-connected devices, such as programmable logic controllers, across US water, energy, and government sectors.

Read more: Nobitex hackers threaten to ‘destroy’ pro-Iran institutions

Tenable also warned that the US war with Iran means “Iranian cyber operations have escalated in parallel with kinetic hostilities, with confirmed targeting of U.S. critical infrastructure.”

It’s worth noting that US authorities are yet to attribute the attack. 

Advertisement

Cybersecurity firm Sophos reports that CyberAv3ngers has claimed responsibility for a 2020 Israeli cyber attack that targeted 150 railway system servers and 28 railway stations.

Three years later, the group appeared to try to sell the data stolen from the railway hack for four BTC, worth $108,000 at the time of the data listing.  

In 2025, internal CyberAv3nger documents were leaked that included domain registrations, BTC transactions, and European virtual private server hosting. 

Tenable says these details overlapped with another group called Moses Staff, and revealed CyberAv3ngers’ structure as a “single coordinated effort directed by the state” instead of multiple Iranian individuals. 

Advertisement

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Expanding crypto tax reporting rules are pushing investors to maintain accurate transaction records across exchanges, wallets, staking, and DeFi.

For a long time, many crypto investors treated tax preparation as a year-end export. Download a CSV from an exchange, send it to tax software, and deal with the result before the filing deadline.

That approach can still work for someone who bought a few assets on one platform and never moved them. It becomes unreliable once the portfolio includes self-custody, staking, decentralized finance, NFTs, or transfers among several exchanges. At that point, the hard part is not filling in a tax form. It is rebuilding an accurate transaction history.

The distinction matters more now because broker reporting is expanding. US brokers began reporting gross proceeds from digital asset dispositions on Form 1099-DA for the 2025 tax year. Basis reporting for covered assets starts with 2026 transactions. The IRS will receive more information directly from brokers, but those reports may still show only part of an investor’s financial history.

One wallet can create several tax questions

A centralized exchange records activity inside its own system. It can usually identify a purchase made on the platform and a later sale from the same account. It cannot automatically know what happened before an asset arrived from a hardware wallet, another exchange, or a decentralized application.

Consider an investor who buys ETH on one exchange, transfers it to a wallet, stakes part of it, uses the rest in a liquidity pool, and later sends several tokens to a different exchange to sell. The final exchange sees the deposit and sale. It may not know the original purchase date, acquisition cost, staking history, or what happened inside the liquidity pool.

Those missing details affect more than one number. They can change basis, holding period, income recognition, transaction classification, and the amount of gain or loss. A CSV from the final exchange cannot supply facts the exchange never had.

DeFi records describe mechanics, not tax treatment

On-chain records are public, but public does not mean tax-ready. A block explorer shows contract calls, token movements, and transaction hashes. It does not explain the investor’s intent or label each event for a federal return.

A single DeFi interaction can produce deposits, receipt tokens, reward tokens, fees, and later withdrawals. Some activity may represent a transfer of ownership, while other activity may simply change how an asset is held. The tax analysis depends on the transaction’s substance and the available guidance, not on the number of lines in a wallet export.

Staking adds a separate layer. IRS Revenue Ruling 2023-14 generally treats staking rewards as income when a cash-method taxpayer has dominion and control over them. The fair market value used for income can also establish a basis for a later disposition. If the receipt value is missing, the eventual capital gain calculation can be wrong even when the sale proceeds are correct.

NFT activity creates similar recordkeeping problems. A mint can involve the purchase price, gas paid in crypto, and a later sale on a different marketplace. Royalties and creator income may need different treatment from an investor’s capital transaction. Marketplace exports often cover only the activity inside that marketplace.

Cost basis now has a wallet-level dimension

The final digital asset basis regulations moved taxpayers toward wallet-by-wallet or account-by-account identification beginning in 2025. Revenue Procedure 2024-28 provided a safe harbor for allocating previously unattached basis to wallets or accounts as of January 1, 2025, subject to its requirements.

This change makes portfolio-wide recordkeeping more important, not less. An investor can no longer assume that a universal pool of basis will always produce the correct answer across every location. Records need to show which units and basis lots sit in each wallet or account, then preserve that history when assets move.

Transfers between wallets owned by the same taxpayer generally are not sales. Yet a transfer can still break the data trail if the receiving platform does not receive the acquisition history. Even a network fee paid in crypto can create a small disposition that needs to be considered.

Broker reports are a checkpoint, not a completed return

For 2025 transactions, Form 1099-DA generally reports gross proceeds without cost basis. Gross proceeds are not profit. A trader who repeatedly buys and sells with the same capital can have proceeds far above the amount ever deposited, while the taxable result is based on proceeds minus supported basis.

Beginning with 2026 transactions, brokers report basis for certain covered assets. In general, that means assets acquired after 2025 in a custodial account with the broker and held there until disposition. Crypto transferred in from elsewhere is generally noncovered, so the broker may still report proceeds without basis.

This creates a predictable mismatch. The IRS receives the sale amount, the taxpayer has the purchase history, and the return has to connect the two. If missing basis is treated as zero, gain can be overstated. If proceeds are omitted because a wallet export was incomplete, the return may not match broker reporting.

What specialized review actually adds

The useful work begins before tax preparation. It includes collecting exchange files, wallet addresses, and income records, then building one timeline across the portfolio. Transfers need to be paired so they are not mistaken for sales. Duplicate entries need to be removed. Missing basis must be traced to original acquisitions. DeFi and NFT activity needs transaction-level classification.

Software is valuable for calculation and scale, but its output depends on the inputs and labels it receives. A polished report can still be wrong if imported transfers were treated as income, token swaps were missed, or receipt tokens were counted as new wealth.

Count On Sheep describes its crypto tax accountant work as reconciliation first: human specialists review multi-wallet and multi-chain activity, including staking, DeFi, and NFTs, then produce reports that clients can use with their own CPA or preferred filing platform. That boundary is useful. Reconstruct the data first, then prepare the return from a record that can be explained.

The right time to get help

Complexity is a better trigger than portfolio value. Someone with a modest balance spread across bridges and protocols may have a harder reporting problem than a large holder who bought once and never moved the asset.

Warning signs include unexplained zero basis, negative balances, large proceeds that do not resemble economic gains, missing wallet history, and results that change sharply when one data source is added. Multi-year gaps also deserve attention because an incorrect opening balance can carry forward into every later year. The expanding reporting regime does not mean every broker form will be complete. It means inconsistencies will be easier to spot. For investors with activity beyond a single exchange, careful reconciliation is becoming a normal part of tax.

Secours Populaire Français

Sud Ouest Solidarité

Binance will launch USDT-settled options on gold and silver through its Abu Dhabi-regulated exchange, expanding its lineup of traditional financial products alongside cryptocurrencies.

The contracts will be listed through Nest Exchange Limited, Binance’s Abu Dhabi Global Market-regulated Recognized Investment Exchange (ADGM). The options allow traders to gain exposure to movements in gold and silver prices without taking delivery of the underlying metals. 

Retail users will only be able to buy options, while eligible institutional users and liquidity providers can also write contracts. According to Binance, restricting retail users to buying options limits downside risk to the premium paid, while eligible institutional participants can write options to collect premiums.

The launch builds on Binance’s gold and silver perpetual futures, introduced in January, as the exchange expands regulated access to traditional assets through crypto-native trading products.

Related: Goldman Sachs cuts year-end gold target by $500, doubting rate cuts

Crypto firms expand commodity offerings

Binance’s new options add to a growing range of commodity-linked crypto products. While the exchange is offering derivatives tied to gold and silver prices, companies such as Tether and Paxos have focused on tokenizing physical bullion.

Tether’s XAUt, which represents one troy ounce of gold stored in Swiss vaults, recently received Shariah certification from Amanah Advisors, a move aimed at expanding adoption among Islamic financial institutions.

Earlier this month, ADGM also recognized XAUt as an accepted spot commodity, allowing regulated firms to offer services tied to the tokenized gold asset.

According to RWA.xyz, the tokenized commodities sector has grown to about $4.56 billion in distributed value, with Tether Gold and Paxos Gold accounting for more than 90% of the market.

Tokenized commodities. Source: RWA.xyz

Magazine: The 100x obsession: Fundamentals grow in importance as crypto matures

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Every guide on the subject tells you the same thing: locked liquidity means the team cannot rug you, so the token is safer. That was true when the only exit was draining the pool. On modern launchpads the lock has become the scam’s revenue engine, and the checkmark you are looking for is the thing paying the attacker.

There is a checkbox that appears on token screeners, launchpad interfaces, and every safety checklist written for memecoin traders: liquidity locked. Finding it is presented as one of the essential steps before buying an anonymous token, and the reasoning behind that advice is sound as far as it goes. A liquidity lock genuinely does prevent the single most destructive attack in decentralized finance, the rug pull, in which a token’s creator removes the assets backing the trading pool and leaves holders with something they cannot sell. The guides are unanimous. One says verifying the lock is not optional but essential. Another says it reassures investors the project is safe to engage with. A third says it gives investors a sense of security. All of them are describing a real protection, and all of them are incomplete in a way that has become expensive. Because on the launchpads where most new tokens now originate, the same lock that stops the creator draining the pool also guarantees the creator a cut of every trade in it, forever, and that changes what the checkbox means.

What a liquidity lock actually does

Start with the mechanism, because the protection is real and understanding it precisely is what lets you see the gap.

When a token launches on a decentralized exchange, someone must supply the pool that lets people trade it. That means depositing the new token alongside something valuable, typically a stablecoin or the chain’s native asset, into a pool contract. In exchange, the depositor receives liquidity provider tokens, which are the claim ticket on that deposit. Whoever holds the provider tokens can redeem them and take the pool’s contents back out.

That claim ticket is the entire vulnerability. A creator holding it can wait for buyers to arrive, watch the pool fill with real money, then redeem the tickets, withdraw everything of value, and leave the token with nothing behind it. The price collapses to zero because there is nothing to sell into. That is the rug pull, and it accounted for an enormous share of memecoin losses across several years.

A liquidity lock sends the provider tokens into a separate time-locked contract instead of leaving them in the creator’s wallet. Locker services hold them for a stated period, publish the lock on chain so anyone can verify it, and refuse to release the tokens before the expiry. The creator cannot redeem what they no longer hold. The classic exit is mechanically foreclosed.

Two clarifications that catch people out. A locked pool still trades normally; the lock restricts withdrawal of the pool’s contents, not buying and selling against it. And liquidity locking is different from token locking, which restricts the team’s own supply through a vesting schedule. A project can do one without the other, and the checkbox you are reading usually covers only the first.

What the guides get right

Before the criticism, credit where it is due, because dismissing the lock entirely would be its own error.

The evidence on unlocked pools is genuinely alarming. Analysis of a thousand memecoins on one major chain found that over ninety percent had not locked liquidity, leaving them structurally exposed to exactly the attack described above. Industry estimates put memecoin scam losses in the hundreds of millions of dollars in a single year, with pool draining as a leading method. Against that baseline, a project that locks its liquidity has removed a real and common failure mode, and the difference between a locked and unlocked pool is not cosmetic.

The lock also carries a signalling function that is worth something. A team willing to give up the ability to withdraw the pool is a team accepting a constraint, and constraints accepted voluntarily tend to correlate with intentions that survive contact with a falling price. That correlation is weak, and weak correlations still carry information.

So the guides are not wrong about what a lock does. They are wrong about what a lock implies, and the gap between those two things is where the current generation of scams operates.

The inversion

Here is the change that the safety literature has not absorbed.

Launchpads in the Pump.fun lineage — the machinery underneath — automated token creation and solved the rug pull structurally: when a token graduates from its launch curve to a trading pool, the platform locks the liquidity itself, permanently, in a contract nobody can drain. That is a real improvement, and it is the basis for these platforms describing themselves as rug-resistant.

The same platforms also pay creator fees. A locked pool still generates trading fees on every swap, and those fees are claimable by the address that created the token. The arrangement is defensible on its face: it rewards builders whose tokens sustain real volume, and it gives creators a reason to keep supporting a project rather than dumping and leaving.

Now combine the two properties and follow the incentive. A creator who cannot drain the pool has lost one revenue source. A creator who receives fees on every trade has gained another, and the second one does not require the token to succeed, only to be traded. Volume from panicked selling pays exactly as well as volume from enthusiastic buying. Volume from holders trying to exit a token they now recognize as worthless pays exactly as well as either.

What the lock removed was the exit. What it did not remove was the extraction, and it converted extraction from an event into a subscription.

This is not a theoretical concern. When attackers compromised a prominent executive’s social account and launched a token on the venue where the design ran off the credibility, the operation ran on precisely this design: liquidity permanently locked, trading fees claimed repeatedly within the first hours, and no rug pull at any point, because rugging would have ended a stream the attacker had every reason to keep collecting. The token could not be drained. It also did not need to be. Coverage of the incident put it plainly: locked liquidity let the scam pose as a legitimate token. For the reporting behind this argument, the $VLAD case documented the full extraction sequence.

Why the checkbox now misleads

The practical damage is not that locks are useless. It is that they are load-bearing in a mental model that no longer describes the risk.

A trader running the standard checklist sees liquidity locked, checks the box, and treats one category of danger as resolved. That is correct. But the same trader typically treats the checkmark as a broader legitimacy signal, because that is how every guide frames it, and on a launchpad where locking is automatic and universal it carries no information about the project at all. When every token on a platform has locked liquidity by default, the presence of a lock distinguishes nothing. It is not a filter; it is a floor.

Worse, it inverts the usual scam-detection heuristic. Historically, a suspicious token looked suspicious: no lock, anonymous team, contract with a mint function, supply concentrated in a few wallets. A launchpad token created for the purpose of harvesting fees looks clean by the most-cited measure, because the platform made it clean automatically. The design that makes the attack profitable is the same design that makes the attack pass inspection.

What a lock does not tell you

Five things sit entirely outside what a liquidity lock covers, and each has ended more positions than pool draining has in recent cycles.

Supply concentration. A lock covers the pool, not the tokens held by insiders. A creator holding a large share of supply can sell into the pool continuously, which is a slower rug producing the same outcome for holders. Check the top-holder distribution separately.

Contract permissions. Mint functions, transfer restrictions, blacklists, and modifiable fee parameters live in the token contract, not the pool. A locked pool attached to a contract whose owner can mint unlimited supply is not protected in any meaningful sense.

Lock duration and terms. Locks expire. A thirty-day lock on a token marketed as a long-term project tells you when the risk returns. Read the expiry, and read whether the locker allows early withdrawal under any conditions.

Creator fee arrangements. The subject of this guide. If the platform pays fees to token creators, understand that a flagged, publicly known scam continues earning for its operator every time someone trades it, including when you sell.

Whether anyone will trade it tomorrow. The most common way to lose money on a new token is not a rug at all. It is buying into a pool that becomes illiquid within days, leaving a position that can only be exited at a catastrophic price. No lock addresses this.

The screener’s blind spot

Most traders never read a locker contract. They read a screener, which condenses everything above into icons, and understanding what the screener can and cannot see is more practical than understanding the underlying mechanics.

Screeners are good at what is observable on chain and mechanical to check. Whether liquidity provider tokens sit in a known locker contract, when the lock expires, whether the token contract’s ownership has been renounced, whether a mint function exists, how supply is distributed across the largest holders, and how much liquidity backs the pool. These are facts with definite answers, and a screener that reports them accurately has done its job.

What a screener cannot see is intent and arrangement. It cannot tell you whether the creator is still claiming trading fees, because that is an ordinary contract call indistinguishable from any other in a summary view. It cannot tell you whether the wallet that deployed the token belongs to someone who has done this eleven times before, unless the addresses are linked and someone has labelled them. It cannot tell you that the token’s name and imagery were lifted from a compromised account an hour earlier, because that fact exists off chain entirely.

The gap matters because the current generation of extraction is built precisely in it. Everything the screener checks comes back clean, because the launchpad made it clean by default, and everything that would identify the problem lives in transaction history, social context, and fee-claim patterns that no icon summarises. A trader who treats a clean screener as an all-clear has outsourced a judgment the tool was never built to make.

The practical adjustment is small. Use the screener for what it measures well, which is contract permissions and supply distribution, and treat the liquidity-lock icon as background, not as a verdict. Then spend thirty seconds on the things it cannot see: where the token came from, who is promoting it, and whether anyone has flagged the contract.

How to assess a token properly

Replace the single checkbox with a short sequence. None of this takes more than a few minutes, and it survives the design changes that broke the old heuristic.

Read the holder distribution first, not the lock. If a small number of wallets hold most of the supply, the lock is irrelevant, because the exit does not need the pool.

Check the contract’s permissions. Screeners flag mint authority, ownership status, and transfer restrictions. An unrenounced contract with an active mint function is a larger risk than an unlocked pool.

Assume the lock, then ask what it costs you. On launchpad tokens, locking is standard. The relevant question is not whether liquidity is locked but who receives the trading fees and whether the creator is still claiming them.

Treat flagged tokens as permanently flagged. If an explorer marks a contract as a likely scam, trading it does not merely risk your capital; on fee-paying platforms it pays the operator. There is no version of participating that is neutral.

Size for illiquidity. Ask what exiting a position would cost if volume fell ninety percent tomorrow, because for most new tokens it will.

The uncomfortable summary is that the industry solved one attack extremely well and the attackers moved. Locked liquidity remains a genuine protection against the specific thing it protects against, and treating it as a general safety signal is now the mistake it was designed to prevent.

The pattern this fits

Step back from tokens and the episode illustrates something that recurs across crypto security, which is worth naming because it will happen again.

Security engineering in this industry tends to be adversarial and specific. A particular attack causes enough losses to become notorious, builders design a mechanism that forecloses it precisely, the mechanism becomes standard, and the ecosystem treats the presence of that mechanism as evidence of general safety. Then attackers, who have read the same documentation, design around it. The mechanism keeps working exactly as specified. The safety inference stops holding.

The same sequence produced the audit badge, which certifies that specific code was reviewed and gets read as certifying that a project is legitimate. It produced renounced ownership, which removes an administrator’s ability to alter a contract and gets read as removing risk, while saying nothing about a contract written maliciously in the first place. It produced multisignature custody, which prevents a single compromised key from draining funds and gets read as institutional-grade safety, while saying nothing about who holds the keys. In each case the mechanism is real and valuable, universally adopted, and eventually uninformative — a pattern of mechanism design meeting adversaries that repeats across the industry for exactly the reason it succeeded: once everyone has it, having it distinguishes nobody.

The corollary is practical. Any security signal that becomes a checkbox is on a timer, and the timer runs from the moment the signal becomes standard rather than from the moment an attack defeats it. A checkbox present on every project in a category has stopped being a filter, whatever it still prevents. The useful question is never whether a token has the standard protections but which risks those protections were never designed to touch, and that list is always longer than the checklist.

A closing note on how to think about the lock going forward, because the mechanism is not going away and neither is the design built on top of it.

The right mental model is a lock on a shop door. It stops one specific thing, which is somebody carrying the inventory out at night, and it is genuinely worth having. It tells you nothing about whether the shop sells anything useful, whether the owner is honest, whether the prices are fair, or whether the business will exist next month. Nobody would walk into an unfamiliar shop, observe that the door has a lock, and conclude the merchandise is good. That is roughly the inference the standard token checklist encourages, and the launchpads have made it worse by fitting every door with the same lock automatically.

What changes the assessment is knowing who benefits from you being inside. On a platform where the token’s creator collects a fee from every transaction in the shop, including the transaction where you sell what you regret buying, the lock on the door is not there for you. It is there because it makes the arrangement durable, and durability is what the operator needed. Reading it that way costs nothing and prevents the specific mistake this guide exists to describe.

Frequently asked questions

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Token launches carry substantial risk of total loss, platform mechanics vary and change, and no verification checklist eliminates that risk. Always do your own research. Information is accurate as of July 29, 2026.

“I think we’re going to see a lot of mainstream impact from something tokenized that people can buy that they used to have a hard time getting access to,” Galindo said.

“I think that’ll probably be the first way crypto hits the people that aren’t just in it all the time and thinking about it all the time. It’s going to be some kind of tokenized product.”

Galindo also said wealth management clients are becoming more comfortable with digital assets as investment options continue to expand beyond bitcoin.

“A lot of people just stopped at bitcoin and said, ‘I’ve got that covered. I don’t want to get it more complicated,’” he said. As more exchange-traded funds and tokenized products become available, he expects investors to spend more time deciding how digital assets fit within broader portfolios.

Ali Wallace, Morgan Stanley Investment Management’s global head of capital markets and ETF strategy, said product development is already evolving in response to investor demand. She pointed to growing interest in multi-currency digital asset ETFs as the next stage of innovation.

“There really is an interest for multi-currency, multi-product” ETFs, Wallace said, describing them as the next evolution of digital asset investment products.

Graseck expects the transition to take years rather than months. Still, she believes the direction is clear.