Gnosis Pay has revealed that a software flaw dating back to October 2023 enabled the $1.5 million exploit of its card safe infrastructure, while confirming that all affected users have been fully reimbursed.

According to a postmortem published by Gnosis Pay on Friday, the vulnerability was traced to version 3.4.0 of the Zodiac smart contract framework and had remained undiscovered since Oct. 30, 2023.

The company said the weakness was exploited on June 1, allowing attackers to gain control of about $1.5 million in digital assets held across its decentralized self-custodial payment network.

The report states that Gnosis Pay’s monitoring systems, operated by treasury manager NOCA, detected the first unauthorized transfer at 06:17 UTC on June 1. Engineers identified the root cause within two hours of the initial alert, after which the company suspended card services, temporarily halted its bridge to Gnosis Chain, and shared attacker wallet addresses with stablecoin issuers to help trace the stolen funds. Gnosis Pay also notified external projects that could have been exposed to the same vulnerability.

Funds restored after staged recovery

Following the incident, Gnosis Pay restored customer access in several phases. The company said the first affected accounts regained access to their balances and payment cards by the night of June 3 after new card-safe modules had been deployed. Installation continued over the following days, restoring service for 99% of users by June 6, while the remaining accounts were recovered shortly afterward.

Gnosis Pay said it absorbed the financial losses itself, leaving customers with no losses from the exploit. According to the postmortem, the attackers stole mostly GNO, EURe, USDC.e, and several other digital assets. The company added that roughly $300,000 worth of assets had not yet been recovered and recovery efforts remain ongoing.

The report also disclosed that 5,281 wallets holding at least $1 were affected by the exploit. Gnosis Pay published the attacker’s wallet address used during the incident, identifying it as 0x5a7…7a35, while explaining that the exploit targeted two components within its card safe infrastructure, the Delay Module and the Roles Module.

Smart contract exploits continue to pressure crypto platforms

The disclosure comes as security incidents continue to affect crypto infrastructure providers. As crypto.news reported earlier, Humanity Protocol recently confirmed it is repositioning toward enterprise artificial intelligence products after a $36 million exploit accelerated an internal restructuring that had already been under consideration for several months.

During an interview, Humanity Protocol founder Terence Kwok said the company had been reviewing its long-term direction for six to nine months before the breach. He explained that the exploit sped up those plans, while adding that digital identity will remain central because enterprise AI systems will require reliable ways to verify people and credentials.

Meanwhile, concerns over crypto-related cybercrime have also reached government leaders. Earlier, G7 leaders issued a joint statement after their summit in Evian-les-Bains, France, calling for coordinated action against North Korea’s cryptocurrency thefts and cybercrimes.

The statement linked the issue to long-standing concerns that stolen digital assets have helped finance Pyongyang’s nuclear and ballistic missile programs under international sanctions, a claim repeatedly supported by Western governments and blockchain analytics firms.

A pseudonymous defendant has moved to dismiss a New York lawsuit seeking ownership of 39,069 dormant Bitcoin addresses, arguing that Bitcoin addresses are merely data strings that cannot be sued.

The defendant, identifying themselves as “John Doe 33,” filed a notice of appearance and motion to dismiss on Thursday, claiming they control one of the dormant wallets named in the lawsuit.

According to the motion, the lawsuit is legally defective because Bitcoin address strings are neither persons nor legal entities subject to the court’s jurisdiction. The filing argues that a public Bitcoin address cannot itself be “found” under New York’s lost-property law because it has always been publicly visible on the blockchain.

The filing challenges the lawsuit filed in May by plaintiff “Noah Doe” and two Wyoming-based LLCs, ABC Company and XYZ Company. The plaintiffs claim the Bitcoin tied to the listed addresses constitutes abandoned property that they reported to the New York Police Department and claimed under New York lost-property law.

Regardless of how the court rules on ownership, it remains unclear how the plaintiffs could recover any Bitcoin without possessing the private keys needed to access the wallets.

Defendant files a motion to dismiss the case seeking ownership of 39,069 Bitcoin wallets. Source: iapps.court.state.ny.us  

The complaint lists 39,069 Bitcoin addresses, including wallet addresses widely associated with Bitcoin creator Satoshi Nakamoto and the Mt. Gox hacker. The listed wallets collectively hold an estimated 3.7 million BTC (worth about $234 billion), according to Sani, founder of Bitcoin analytics platform Timechain Index.

Related: Bitcoin miner MARA spent $4.3M on CEO security in 2025 as crypto attacks rise 

Defendant appears to control $300 million Bitcoin wallet

Blockchain data suggests that “John Doe 33” controls a wallet holding 5,000 BTC received in April 2014 that has remained untouched for more than 12 years, making it worth more than $300 million at current prices, according to a Friday X post from Galaxy Digital head of research Alex Thorn.

“That’s ~100x the median defendant address. This is a real holder with real standing choosing to fight, not a bystander.”

Source: Alex Thorn

Thorn added that the filing prevented what had been a “near-certain” default judgment and challenged jurisdictional and statutory defects in the plaintiffs’ case.

The supply of Bitcoin has been dormant for the past five and 10 years. Source: Bitbo

There are currently 3.5 million BTC, worth about $215 billion, that have been dormant for the past 10 years and another 6.6 million coins, worth around $406 billion, that have been dormant for over five years, Bitbo data shows.

Magazine: How crypto laws changed in 2025 — and how they’ll change in 2026

TLDR

• European regulator expands MiCA registry with 37 additional crypto service providers.
• Major financial institution Standard Chartered receives EU crypto authorization.
• Total licensed crypto asset service providers in EU reaches 280.
• Cyprus emerges as top contributor with six newly approved CASPs.
• EU regulatory framework transitions from development to active enforcement phase.

Europe’s securities watchdog has expanded its MiCA-compliant crypto registry with 37 additional firms following the conclusion of the transition window. This expansion brings the total number of authorized providers to 280. The development marks a pivotal shift from regulatory development to active market oversight.

European Crypto Registry Receives Significant Update

ESMA released its initial registry revision following the conclusion of MiCA’s transitional window on Wednesday. The Friday announcement included companies that successfully obtained crypto-asset service provider authorization. Consequently, the registry now offers enhanced transparency regarding licensed European Union operators.

ESMA’s previous registry update, issued on June 26, documented 243 crypto-asset service providers. The current revision increased this figure to 280. This expansion means 37 additional companies have entered the European Union’s structured crypto regulatory framework.

Notable additions to the registry include Standard Chartered, FalconX, Sygnum Europe, and Ronin EM. Furthermore, the electronic money token section welcomed Crédit Agricole’s CACEIS division. Notably, ESMA did not document any new asset-referenced token issuers during this update cycle.

Major Bank Secures European Crypto Authorization

Standard Chartered emerged as one of the most prominent additions in ESMA’s recent registry expansion. Luxembourg’s financial authorities granted the banking institution MiCA authorization on June 25. This approval establishes a compliant pathway for the bank’s cryptocurrency operations throughout Europe.

The financial institution simultaneously obtained an Electronic Money Institution license from Luxembourg authorities. This credential enables electronic money issuance and payment processing services. Combined, these authorizations facilitate custody operations, token-related services, and payment-integrated digital asset activities.

Standard Chartered indicated these licenses align with its broader European digital asset strategy. The institution has previously expanded digital asset custody capabilities across Asian and Middle Eastern markets. MiCA provides a unified regulatory structure for comprehensive EU market participation.

Mediterranean Nation Dominates Recent Authorization Cycle

Cyprus emerged as the frontrunner in the latest ESMA registry expansion, contributing six newly authorized crypto-asset service providers. France, Italy, and Malta each contributed five companies. The Czech Republic and Spain registered four providers respectively.

Luxembourg contributed three new registrations, while the Netherlands added two companies. Germany, Liechtenstein, and Latvia each registered one licensed provider. This geographic distribution demonstrates how individual national authorities contribute approvals to the centralized ESMA registry.

Cyprus has now issued 21 MiCA authorizations through its securities regulatory body. Germany maintains the overall leadership position with 58 authorizations under BaFin supervision. Nevertheless, smaller jurisdictions remain competitive by offering streamlined and transparent licensing procedures.

Regulatory Framework Transitions to Enhanced Oversight

The most recent ESMA registry update reveals inconsistent advancement across MiCA’s different categories. The asset-referenced token registry remains without any approved issuers. The non-compliant entities roster stayed static at 162 companies.

This disparity indicates that service provider licensing is advancing more rapidly than certain token issuance approvals. Exchanges, brokers, custodial services, and financial institutions now have established pathways. However, token issuers continue facing more stringent requirements and extended approval processes.

The registry now functions beyond a simple compliance database. It influences market access decisions, counterparty verification processes, and institutional risk assessment procedures. ESMA has transformed MiCA into an operational gateway for European Union crypto market participation.

Meta CEO Mark Zuckerberg has sounded a note of caution on the pace of “agentic” AI development, telling employees that progress on autonomous agents has not accelerated as quickly as expected despite heavy investment by major technology and crypto firms.

Speaking during a company meeting on Thursday, Zuckerberg said the “trajectory of the agentic development over at least the last four months hasn’t really accelerated in the way that we expected,” Reuters reported after reviewing a recording of the call. He added that the broader bet on agent adoption “hasn’t come to fruition yet,” even as leadership pushed harder into agent-focused infrastructure earlier this year.

Key takeaways

• Zuckerberg said Meta’s agentic AI progress has not matched expectations over the past four months, according to Reuters.
• Meta executives accelerated agent-focused infrastructure plans in January due to concerns they were moving too slowly.
• Meta still expects returns from its AI spending within three to six months, Zuckerberg said.
• Meta expanded its Meta Business Agent globally for businesses across Instagram, Messenger, and WhatsApp.
• Blockchain data suggests AI-agent transaction activity remains limited, including only about $2 million in x402-facilitated volume over the last 30 days, per Artemis.

Meta’s AI agents: expectations versus delivery

Zuckerberg’s remarks highlight a growing mismatch between the industry’s timeline for autonomous AI agents and how quickly real-world systems can scale and deliver value. While agentic AI has captured attention from both software giants and crypto-adjacent companies, Zuckerberg indicated that even within a company widely positioned for rapid experimentation, momentum has been slower than planned.

Reuters reported that Zuckerberg pointed to a lack of acceleration in the “last four months,” despite a push intended to close perceived speed gaps. He acknowledged that an aggressive January push into agentic infrastructure was driven by fears that Meta wasn’t advancing “fast enough,” while also framing the current state as not yet reaching the level of adoption leadership expected.

At the same time, Zuckerberg said he believes Meta’s AI investments will start paying off within the next three to six months. That timeframe matters for investors and teams because it signals management still expects near-term results—even if the broader agent ecosystem remains behind schedule.

Business Agent rollout across Meta’s messaging and social apps

Meta’s comments came alongside new product deployment. On Thursday, the company expanded its Meta Business Agent globally, aiming to bring agent capabilities to businesses operating across Instagram, Messenger, and WhatsApp.

According to Meta, the Business Agent is designed to handle customer inquiries, make product recommendations, and close sales without requiring human intervention. For businesses, the appeal is straightforward: agent systems can reduce response times and staffing pressure while enabling commerce flows inside channels where customers already interact.

Zuckerberg also previously said in March that he was building a personal AI agent to support CEO decision-making, reinforcing Meta’s view that agent tooling can move beyond customer-facing automation into internal workflows.

Crypto’s agent payments thesis faces measured on-chain activity

Zuckerberg’s reality check lands amid a crypto industry that has largely embraced the idea that AI agents could become major users of blockchain payments. Executives including Coinbase CEO Brian Armstrong and Circle CEO Jeremy Allaire have previously predicted that AI agents may become dominant users of blockchain-based payment rails in the coming years, as noted in coverage referenced by Cointelegraph.

In support of that narrative, several integrations have been announced in recent months. Cointelegraph previously reported that Amazon Web Services integrated Coinbase’s x402 payments protocol into Amazon Bedrock AgentCore in May, enabling agents to transact using the USDC stablecoin. Other examples cited include a Visa-supported virtual card for AI agents from Oobit launched in April for purchases in USDt (USDT).

However, the gap between “capability” and “usage” is showing up in on-chain volume. Artemis data cited by Cointelegraph suggests that AI-agent transaction activity facilitated through the x402 protocol remains comparatively small: only $2 million in trading volume over the past 30 days.

This matters because the crypto payments story around autonomous agents depends not just on integrations being possible, but on consistent demand emerging from actual agent behavior. Low volume can indicate early-stage adoption, experimentation without sustained deployment, or limitations in how agents currently interact with payment endpoints.

What to watch next for agentic AI and stablecoin payments

Zuckerberg’s comments suggest the industry may need to plan for a slower-than-hoped transition period as agentic systems mature and as businesses learn where automation genuinely outperforms human-led workflows. At the same time, Meta’s investment outlook—expecting payback within three to six months—signals continued pressure to convert AI spending into operational results.

For the blockchain segment, the next checkpoint should be whether on-chain payment volume tied to agent infrastructure increases materially from current levels, and whether new business-facing deployments like Meta Business Agent lead to measurable downstream demand for stablecoin payment rails.

Shielded Labs has raised the possibility of delaying Zcash’s Ironwood network upgrade, warning that ecosystem participants like exchanges, mining pools and wallets may not have enough time to prepare their systems for the planned activation in late July. 

Jason McGee, executive director of Shielded Labs, said in a Zcash community forum post that two major projects are moving forward at the same time. Alongside Ironwood, infrastructure providers are being asked to replace Zcash’s longstanding node and wallet software, zcashd, with a new collection of tools known as the Z3 stack.

The concerns highlight the trade-off between quickly restoring confidence in Zcash’s shielded supply and giving ecosystem participants enough time to deploy and audit the new infrastructure safely. 

Ironwood was proposed after researchers discovered an “infinity” bug in Orchard, Zcash’s main private transaction pool. The flaw could theoretically have allowed an attacker to create an unlimited amount of counterfeit ZEC tokens inside the pool without detection. Developers said there was no evidence that the pool had been exploited. However, Orchard’s privacy features make it impossible to prove that no fake coins were created. 

Source: Zooko Wilcox

Ironwood rollout collides with Zcash software migration

Ironwood would open a replacement private pool and prevent new activity inside the existing Orchard pool. Funds leaving Orchard would have to pass through an accounting checkpoint that prevents more ZEC from exiting than what originally entered. This would allow users to verify that the circulating supply remains within Zcash’s intended limits. 

At the same time, Zcash is retiring zcashd, the software used by many ecosystem participants to connect to the network and process transactions. Its replacement stack includes Zebra for operating a network node, Zaino for supplying blockchain data to applications and Zallet for wallet functions. 

The network’s official guidance documents said operators may need to modify their systems as some zcashd functions will not have direct replacements. 

Related: Why ZEC fell 40% even after Zcash patched a shielded pool bug

McGee said Zallet and Zaino were still under development and not ready for production use. Feedback gathered from infrastructure providers suggested that some expect to be ready by late July, while others need more time, he added.

McGee said no delay has been finalized. 

Zcash founder Zooko Wilcox said security reviews had found no additional serious bugs so far and that developers are also working to verify the new system before Ironwood activates. 

Magazine: Bitcoin decouples from tech stocks, Ether eyes ‘selling wave’: Market Moves

Senator Kirsten Gillibrand has renewed her push for tighter ethics rules around digital assets, proposing that elected officials—and the president and their spouse—be barred from issuing or sponsoring their own tokens. Her latest remarks explicitly referenced President Donald Trump and First Lady Melania Trump’s memecoin activity.

Gillibrand, a New York Democrat involved in negotiations over US digital asset legislation, said in a Friday announcement that Congress should consider measures preventing public officials from using their position to promote or benefit from token launches. The proposal focuses on “issuing or sponsoring” digital assets, and would apply to a president and their spouse; it did not spell out whether similar restrictions should cover the vice president’s office or other relatives.

Key takeaways

• Senator Kirsten Gillibrand proposed banning presidents and elected officials from issuing or sponsoring their own tokens, including memecoins.
• The restriction would clearly cover the president and their spouse, but the scope for vice presidents or other family members was not specified.
• Gillibrand links the idea to concerns about self-dealing, consumer protection, and efforts to curb illicit finance.
• Her comments come amid broader Senate work on digital asset market-structure and stablecoin legislation that has faced ethics-related scrutiny.
• The proposal follows shifting approaches in earlier legislation consideration around Trump-related crypto involvement.

Why Gillibrand is targeting token sponsorship by officials

In her Friday statement, Gillibrand argued that “public officials and their spouses should not be issuing memecoins,” framing the move as basic conflict-of-interest prevention rather than a partisan effort. She said the goal is to stop self-dealing from undermining consumer protections and complicating efforts against illicit finance.

The senator’s remarks emphasize the potential for elected officials to benefit from token-related projects that could be influenced by their access to policymakers, regulators, and legislative timelines. In her view, such concerns are especially urgent in markets that are still developing guardrails for disclosure, investor protections, and anti-manipulation enforcement.

Connection to the CLARITY Act and ethics as a gating issue

Gillibrand is also one of the lawmakers involved in negotiations on the Digital Asset Market Clarity (CLARITY) Act in the Senate. According to prior reporting, progress on the bill has been slowed by worries that extend beyond token rules themselves—particularly concerns about ethics, tokenization practices, and stablecoin reward structures.

Gillibrand previously indicated that the chamber could not move forward without addressing ethics questions, pointing to the risk that elected officials could “get rich” from insider access. In that context, the token-sponsorship proposal aligns with her broader stance that ethics constraints should be treated as foundational, not optional.

The senator’s framing also highlights a recurring legislative tension in the US crypto policy debate: how to extend oversight to new financial products while limiting opportunities for lawmakers to profit from the very markets they help shape.

How stablecoin and memecoin provisions were handled in earlier legislation

During consideration of the Guiding and Establishing National Innovation for US Stablecoins Act (GENIUS Act), Gillibrand said senators had removed provisions that specifically targeted Trump’s ties to the crypto industry, including his memecoin Official Trump. In her account at the time, the memecoin was likely “illegal based on current law,” but she suggested that trying to fully cover Trump-related ethics issues would require a “very long and detailed bill.”

Eventually, Trump signed the GENIUS Act into law in July 2025. Gillibrand’s new proposal suggests that even after that outcome—when lawmakers reportedly narrowed focus on Trump-specific provisions—ethics concerns have not gone away. Instead, she appears to be seeking a more general rule that would constrain future token issuance by officials and their spouses.

Notably, Gillibrand’s proposed memecoin restriction did not appear to be designed as a blanket ban covering all family members. The difference matters politically and legally: it shapes how broadly the rule could reach beyond a president’s spouse, while still addressing the most direct relationship that can be tightly linked to official influence.

Trump’s response and the wider conflict-of-interest debate

Gillibrand’s renewed comments arrive as Trump has continued to dismiss perceived conflicts of interest involving his crypto investments. This week, he reported that he earned about $1.4 billion from crypto ventures in the year he took office, while also holding the power to influence legislation that affects digital assets, including both the GENIUS Act and the CLARITY Act.

According to Trump, there was “nothing illegal” and “nothing wrong” with profiting from investments while serving as president, and he did not directly answer questions about the perceived conflicts. The contrast with Gillibrand’s position is stark: she argues that legality alone does not resolve the underlying ethical risk when public officials’ influence intersects with markets where their own token or sponsorship interests could be monetized.

The broader backdrop also includes criticism of involvement by Trump’s sons in crypto-adjacent ventures, including their connection to World Liberty Financial and a Bitcoin mining company described as American Bitcoin. While Gillibrand’s new proposal does not explicitly extend to those broader family circumstances, it reinforces that lawmakers and watchdog voices remain focused on whether personal ties to crypto create unfair advantages or distort policy incentives.

For investors and builders, the practical significance of Gillibrand’s proposal is straightforward: if adopted, a ban on token issuance or sponsorship by officials (and a president’s spouse) could reduce expectations of politically driven token promotion. It may also shape how exchanges, issuers, and intermediaries approach compliance and disclosure when influential figures are involved.

Still, much remains uncertain. Key questions include how “sponsoring” would be defined in law, whether enforcement would rely on existing securities and commodities frameworks, and—if a rule passes—how much legislative time it would take to harmonize it with the ongoing CLARITY Act process. Readers should watch how ethics language evolves in both the market-structure and stablecoin bills, and whether lawmakers treat conflict-of-interest guardrails as a prerequisite rather than an afterthought.