“I believe that tokenization holds the potential to help the securities industry achieve a real-time inventory management, which could drive efficiency, reduce settlement failures, mitigate the risk of abusive naked short selling, with the goal of eliminating that possibility altogether,” Atkins said. “Therefore, I’ve asked the staff to consider what steps can be taken to dovetail a growth-friendly environment with protections against harmful market behavior.”

Moving the U.S. securities markets beyond their weekday, daytime tradition will involve significant adjustments, Atkins and other SEC commissioners admitted, though Commissioner Hester Peirce noted, “Crypto markets certainly don’t sleep.”

Peirce said that firms may be concerned that expanding their trading hours may contribute to wider spreads, increased volatility of prices, less time to deal with technology issues and making sure the transactions are properly monitored.

“These concerns are the real consequences of extending trading into hours when human involvement is limited,” Peirce said, adding that companies may also be worried about overnight drama such as “social media rumors tanking your stock while your corporate office slumbers.”

But the SEC is steaming toward the expansion, and Atkins said that “several needed preparations are already underway or in place.”

The U.K.’s Financial Conduct Authority (FCA) said Thursday that it conducted actions to crack down on three illegal peer-to-peer crypto trading locations in London in a sign the regulator is ramping up enforcement activity as the country’s legal framework for crypto comes closer to implementation.

The financial watchdog, which said the crackdown was a joint effort with HM Revenue & Customs (HMRC) and London’s Metropolitan Police, said it issued cease-and-desist letters at the three premises, requiring traders to stop participating in illegal crypto businesses. Peer-to-peer trading occurs when individuals buy and sell crypto directly with each other, an activity that needs to be legally registered in the U.K.

“There are currently no FCA-registered peer-to-peer crypto businesses operating in the U.K.,” the FCA said. “By operating outside the FCA’s registration regime, they avoid controls designed to detect and prevent money laundering,” the agency said.

The action signals that the era of “light-touch” crypto regulation in the U.K. is ending, said Caroline Black, a consultant at Gherson Solicitors LLP.

BEIJING — The Chinese artificial intelligence startup behind the Kimi model said Thursday that financial industry giants, including investment banks, funds and venture capital firms are using its Kimi models on AI tools.

Among the companies now using Kimi are investment bank CICC and venture capital firms such as Sequoia China, now rebranded as Hong Shan.

It’s part of Beijing-based Moonshot’s announcement Thursday that it was launching Kimi for financial services — a sign of how AI companies are pursuing real-world, commercial applications.

Kimi users can directly access information commonly used for analysis and reports, thanks to a number of industry data partners such as S&P Global Market Intelligence, Crunchbase, Wind, local financial news leaders and business database Tianyancha, according to Moonshot.

The startup said Kimi can also directly access the U.S. Securities and Exchange Commission’s EDGAR system for public companies’ financial filings, the IMF, World Bank and the U.S. Federal Reserve Economic Data site (FRED).

While users don’t have to download a separate interface, a test on Kimi’s mobile app indicated different kinds of data were available to different users depending on subscription tier.

Subscriptions to Kimi start at 49 yuan ($7.31) a month, and can go up to 699 yuan ($104.23).

“The real inflection point really is the combination of stronger AI capabilities with professional expertise,” Samuel Fischer, Beijing branch manager at Deutsche Bank, said in a promotional video published by Moonshot on Thursday. “AI companies that understand real financial workflows and can deliver reliability and data security will be particularly well positioned to contribute to this transformation.”

“AI can now organize and compare this kind of information, identify inconsistencies, and support initial analysis,” he added.

It was not immediately clear whether Deutsche Bank was a client. The bank did not immediately respond to a request for comment.

The Kimi K3 model, released by Moonshot in July, competes with models from leading U.S. companies.

The Chinese startup has reportedly filed confidentially for a Hong Kong IPO. The company, however, has said it does not comment on market rumors or speculation.

Tom Farley, CEO of CoinDesk owner Bullish, also said the bill’s failure is not an insurmountable hurdle.

“Durable legislation would give the digital asset industry greater certainty. But even with legislation, the real work of implementation happens at the agencies, and agencies can move faster,” he said in a post on X. SEC and CFTC rulemaking may prove more consequential in the near term for tokenized securities, including how issuers, transfer agents and issuer-sponsored tokens are treated, he said.

Nilmini Rubin, chief policy officer at Hedera, said the vote does not end the legislative effort. “We’ve seen policymakers put real time and effort into studying the underlying technology, which is a positive step in the right direction,” she said. “I think most of the industry is still as ambitious as ever that we’ll get to where we need to be.”

Still, Rubin said, U.S. competitiveness remains at risk as long as the market lacks clear rules.

“The largest loser is U.S. competitiveness because uncertainty pushes innovation and adoption in the U.S. behind other countries,” she said. “The longer the market lacks clear rules, the more difficult it is to ensure the United States remains at the center of this system, rather than on the margins of it.”

Glamsterdam raised its block gas limit from 60 million to 200 million about an hour after going live on the testnet. Gas measures the computing work required by transactions, so the higher ceiling creates room for more payments, token swaps and other activity in each block.

How that helps Ethereum

A 200 million limit would let Ethereum absorb more activity before users begin outbidding one another for block space, which could make fee spikes less severe when trading surges or a popular token launch clogs the network.

Larger blocks are also harder to check and could leave smaller operators unable to keep up. Glamsterdam is Ethereum’s attempt to gain that extra capacity without making the chain prohibitively expensive to run.

Specialized builders package transactions, while validators check the resulting blocks and secure the chain. Glamsterdam would place that handoff and the accompanying payments inside Ethereum’s own rules, reducing dependence on outside relay services.

The change also extends the time available to spread block data across the network from about two seconds to nine seconds. That gives validators longer to receive and check the larger blocks Glamsterdam is designed to support.

As such, the 200 million limit remains a test setting rather than a commitment for Ethereum’s main network. Devnet-11 was also designed as a controlled rehearsal without deliberate attacks.

State-linked hackers are increasingly using public blockchains as a durable way to “dead drop” malware instructions and infrastructure details, according to a Chainalysis report cited by Cointelegraph. The firm estimates that roughly two-thirds of new quarterly activity involving these techniques is tied to state-aligned operators, while the frequency of such “dead drop” writes has surged dramatically over the past year.

Chainalysis reports that the number of times attackers stored malware-related payload information on public chains rose 420% in the last 12 months. It also highlights cases involving North Korea- and Iran-linked groups, showing how encoded blockchain data can outlast takedowns of domains, servers, or code repositories.

Key takeaways

• Chainalysis attributes about two-thirds of new dead drop blockchain activity per quarter to state-linked threat actors.
• Dead drop payload writes across public blockchains increased 420% year over year, signaling faster scaling of these tactics.
• Chainalysis linked previously unattributed activity across Tron, Aptos, and BNB Smart Chain to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.
• Chainalysis also recorded a 440% rise in malicious blockchain writes since July 2025, coinciding with the emergence of higher-capacity open-source AI models.
• Iran-linked actors are suspected to have used Bitcoin to publish encoded command-and-control routing data that infected devices can periodically check.

More “dead drop” payloads on-chain

Chainalysis frames the technique as a way to make malware campaigns harder to disrupt. Instead of relying on websites, domains, or code hosts that can be seized or shut down, attackers encode instructions and infrastructure pointers directly into transactions on public blockchains. The information persists because blockchain data remains accessible even if off-chain components are removed.

In practical terms, the approach improves campaign durability: malware can continue operating as long as it can retrieve updated instructions from the blockchain. Chainalysis notes that in 2025, North Korean hackers used a similar concept—called EtherHiding—to conceal crypto-stealing code inside smart contracts.

North Korea-linked routing across multiple chains

One of Chainalysis’ detailed findings connects activity that previously lacked clear attribution across Tron, Aptos, and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence.

Chainalysis reports that encoded pointers embedded in Tron and Aptos transactions directed compromised devices to the same BSC transaction. In the workflow described, Tron functioned as an initial route, while Aptos served as a fallback if the first path did not work as intended.

The BSC transaction, according to Chainalysis, included encrypted server addresses and configuration data. Those encrypted details tied infected devices to off-chain infrastructure used for remote access and data theft—meaning the blockchain acted as the resilient “messaging layer” while the operational work moved outside the chain once instructions were retrieved.

For investors and builders, this multi-chain structure matters because it increases the surface area responders must monitor. Instead of focusing on a single chain or a single contract address type, defenders may need to track how attackers chain together multiple networks to improve reliability.

AI tools may be boosting malicious on-chain output

Chainalysis also links a surge in harmful blockchain behavior to developments in AI capabilities. The firm recorded a 440% increase in malicious blockchain writes since July 2025, a period it associates with when high-capacity open-source Chinese AI models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that the company found a “clear point-in-time association.” However, he emphasized that Chainalysis could not definitively prove that the actors responsible for the malicious transactions and contracts were specifically using those models to increase output.

This distinction is important. The data indicates timing alignment, but causality remains unconfirmed. Readers should treat the finding as an early warning about how quickly automated code generation tools could lower the cost of producing and deploying blockchain-based malware—without assuming a direct “AI used” attribution for every case.

Iran-linked actors using Bitcoin as a command channel

Beyond North Korea-linked cases, Chainalysis says it identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain.

Unlike approaches that rely on blockchain activity alone, Chainalysis states its assessment was grounded in a broader set of indicators: the malware family involved, the decoding method, timing patterns, and server infrastructure tied to previously reported Iranian operations.

Chainalysis says attacker-controlled wallets sent small payments to a widely known Bitcoin address with historical ties to Satoshi Nakamoto. The report indicates that this address has no connection to the attackers; rather, it is used as a permanent public location that infected devices could check for updated routing instructions.

According to Chainalysis, the attackers could revise their server infrastructure by publishing another Bitcoin transaction. Once the malware obtained the new instructions, the operation could shift back off-chain, enabling behaviors such as remote access, credential theft, and delivery of additional malware payloads.

From a threat-management perspective, using a familiar and long-lived Bitcoin address complicates takedowns. Even if defenders act against the obvious infrastructure, the blockchain location can remain publicly available and function as a reliable beacon for compromised devices.

Why this trend is likely to keep intensifying

As dead drop techniques spread and as malicious on-chain writes accelerate, the challenge for the ecosystem is not just spotting individual malicious transactions—it’s anticipating how attackers design fallback routes, encrypt payloads, and distribute retrieval logic across chains. The most actionable takeaway for monitoring teams is to focus on behavior patterns around payload writes and encoded routing mechanisms, rather than relying solely on domain or server takedowns.

Going forward, readers should watch whether defenders and analytics firms shift toward cross-chain correlation of encoded instruction flows, and whether future reporting can move beyond “association” to clearer evidence about how AI tooling is operationally integrated into these campaigns.