Australian authorities charged two Western Australian men on Aug. 26 following a joint investigation into the alleged TeamPCP cybercrime syndicate.

The Australian Federal Police filed a combined 14 charges against 21-year-old Ruben Ian Thomson and 23-year-old Louis Michael Gaebler. Both appeared before Perth Magistrates Court on Aug. 27, according to ABC.

The operation involved the AFP, the FBI and the Western Australia Police Force. Authorities executed warrants at properties in Cottesloe, Hamilton Hill and Mandurah.

Police allege the group compromised more than 1,000 organizations, obtained over 500,000 credentials and removed at least 300 gigabytes of data. The defendants have not been convicted, and the charges remain allegations.

TeamPCP allegedly targeted trusted software components

The joint investigation began in April after several cybersecurity companies supplied intelligence about malicious software distributed through an open-source repository, the AFP said in its official release.

Investigators allege TeamPCP inserted malicious code into legitimate software components used by other developers. Once incorporated into downstream systems, the modified code allegedly gave the group unauthorized access to organizations across government, academia and the private sector.

Software supply-chain attacks can spread beyond the organization hosting the original compromised code. A trusted component may be reused by hundreds of developers, allowing one modification to reach many unrelated systems.

Australian authorities estimated that responding organizations face remediation costs totaling hundreds of millions of dollars. That figure reflects an official estimate rather than a confirmed financial loss suffered by identified victims.

The AFP said infected software enabled the alleged theft of credentials, authentication materials and other sensitive information. However, authorities have not published a complete list of affected organizations or software packages.

Cryptocurrency payments remain under investigation

Police allege the two men were principal participants in the operation and received cryptocurrency for their roles. Authorities said the value of those payments remains under investigation.

The official release did not identify the cryptocurrencies involved. It also did not disclose wallet addresses, transaction hashes, mixers, exchanges or a confirmed laundering total.

Reports claiming that investigators seized large cryptocurrency balances or expensive property go beyond the details contained in the AFP announcement. Authorities said electronic devices and other items were seized, but they did not assign a digital-asset value to those items.

Thomson faces one Australian charge of dealing with money or property worth at least 100,000 Australian dollars that authorities allege represented criminal proceeds. The offence carries a maximum prison sentence of 20 years. That threshold describes the charge and does not establish the final amount involved.

Blockchain transactions can assist investigators when funds move through identifiable services or interact with regulated exchanges. As previously reported, Australian authorities forfeited nearly 25 Bitcoin and other assets tied to a 2013 exchange theft.

U.S. indictment creates a separate federal case

The U.S. Department of Justice separately unsealed a federal indictment against Thomson. Prosecutors charged him with conspiracy to violate the Computer Fraud and Abuse Act and obtaining information from a protected computer.

The American indictment concerns alleged TeamPCP attacks during spring 2026. Prosecutors claim malicious code scanned downstream systems, extracted sensitive information and maintained persistent access.

The Justice Department also alleges TeamPCP used stolen information to make ransom or extortion demands. Members allegedly offered not to publish victims’ data in exchange for payment. These claims have not been proven in court.

Each U.S. offence carries a maximum five-year prison term and a fine of up to $250,000, or twice the alleged gross gain or victim loss. Any sentence would be determined by a federal judge after a conviction.

The U.S. announcement names Thomson but does not announce a corresponding American indictment against Gaebler. Thomson remained in Australian custody when prosecutors disclosed the case.

U.S. agencies have previously targeted infrastructure allegedly used to convert cybercrime proceeds. In related coverage, the FBI seized nine cryptocurrency exchanges accused of laundering ransomware and investment-fraud proceeds.

Forensic examinations could produce further charges

The AFP said investigators are examining a large volume of seized data and electronic devices. That work may help authorities identify additional participants, victims and financial transfers.

Police have not ruled out further arrests or charges. They have also not announced whether the United States will seek Thomson’s extradition or wait for the Australian proceedings to advance.

The investigation’s next phase will involve digital forensics and the examination of cryptocurrency payment records. Prosecutors must separately prove each defendant’s identity, role, intent and connection to the alleged activity.

Potential victims should review software dependencies, rotate exposed credentials and examine authentication logs. Australian organizations can report incidents through Report Cyber, while individuals concerned about identity theft can contact IDCARE.

The case produced no verified cryptocurrency market reaction. It concerns the alleged use of digital assets for payments rather than a vulnerability in a blockchain or cryptocurrency protocol.

Float Protocol has lost about $28,000, or 10.71 ETH, after an attacker used a flash loan to manipulate a Uniswap V3 spot price and exploit how its Hypervisor contracts calculated liquidity provider share values.

SlowMist said on Aug. 31 that the attacker distorted the Uniswap V3 slot0 spot price, causing affected Hypervisor contracts to calculate incorrect LP share values. The blockchain security firm traced the exploit to functions that lacked TWAP or oracle verification and slippage protection.

Using large swaps in the underlying V3 liquidity pool, the attacker manipulated the values returned by currentTick() and getTotalAmounts(). SlowMist said the attacker then repeatedly deposited and withdrew funds while the Hypervisor contracts were working with inflated share values.

The security firm identified the attacker address as 0xaea29218262dc6b0904ca077f6527c49dfd426d9 and the attack contract as 0xb46655eb5b77de277063a75586d1883e951b6c54.

Two vulnerable contracts were listed as 0x85cbed523459b7f6f81c11e710df969703a8a70c and 0xc86b1e7fa86834cac1468937cdd53ba3ccbc1153, while the underlying liquidity pool was identified as 0xe8c2036068fc3b0161ee1def0e8d01df4eac0ac.

Float Protocol exploit relied on Uniswap V3 spot price manipulation

The attack centered on how the affected contracts obtained pricing information from the underlying Uniswap V3 pool. SlowMist said large trades allowed the attacker to distort slot0, which contains the pool’s current price and tick information.

Once the pool price had been moved, the manipulation changed the values returned by currentTick() and getTotalAmounts(). The affected Hypervisor contracts used the altered data to calculate LP share values, which allowed the attacker to interact with the contracts while those shares were incorrectly priced.

Flash loans supplied the temporary capital needed to make the large trades. As crypto.news previously explained, a flash loan allows assets to be borrowed without upfront collateral as long as the loan and fees are repaid within the same blockchain transaction.

If repayment does not occur, the entire transaction reverts. The mechanism allows traders to access large amounts of temporary liquidity for arbitrage, collateral swaps and liquidations, but the same liquidity can be used to exploit vulnerable pricing or smart contract logic.

In its analysis of Float Protocol, SlowMist attributed the loss to the contracts relying on a manipulable spot price without checks that could verify it against a time weighted average price or another oracle. Critical functions lacked slippage protection as well, according to the security firm.

Attacker repeatedly used inflated LP share values

SlowMist said the attacker did not stop after changing the Uniswap V3 pool price. Once slot0 had been distorted, the attacker repeatedly deposited into and withdrew from the affected contracts using the inflated LP share calculations.

The sequence allowed value to be extracted while the contracts were relying on the manipulated pool state. SlowMist estimated the final loss at approximately 10.71 ETH, worth about $28,000 when it published the alert.

Similar methods have been used in other DeFi attacks where large temporary trades distort prices or pool ratios before another contract uses the manipulated values.

In July, Allbridge Core was halted after an attacker used a $1.12 million USDC flash loan from Kamino during an exploit that PeckShield estimated caused about $1.65 million in losses.

Onchain Lens said the Allbridge attacker made rapid USDC and USDT swaps to change the ratio inside a stablecoin pool. The attacker then withdrew liquidity at the distorted rate before repaying the flash loan in the same transaction.

Allbridge said some liquidity pools were left temporarily out of balance after the incident and asked users who had profited from unusual pricing to consider returning the funds. The protocol paused Core while investigators tracked assets that had been moved from Solana to Ethereum.

Price data has remained a target in DeFi attacks

Another July incident showed how manipulated pricing information can be used even when the weakness sits outside a protocol’s smart contracts.

Ostium concluded that its $23.75 million USDC exploit originated from compromised off-chain infrastructure. The decentralized trading protocol said an attacker submitted fraudulent BTC/USD price reports that allowed funds to be drained from its OLP liquidity vault.

Ostium said its smart contracts were not the source of that breach. Automated monitoring detected the attack, trading resumed on July 23, and the protocol reported that user collateral had not been affected.

Float Protocol’s incident involved a different mechanism described by SlowMist. The security firm’s analysis placed the weakness inside the affected Hypervisor contracts, where manipulated Uniswap V3 pool data could influence the calculations used to value LP shares.

Flash-loan capital has featured in other attacks this year. A July attack against Swan Treasury used a PancakeSwap flash loan after a compromised off-chain signer key allowed an attacker to purchase STY tokens at a large discount.

The Swan Treasury exploit caused an estimated $625,000 loss. Security analysis found that forged claim and transfer signatures had been created with the protocol’s compromised signer key, allowing roughly 687,000 STY to be purchased at around a 100 times discount before being sold into the STY/USDT pool.

The flash loan supplied capital for the transaction, while investigators attributed the underlying vulnerability to the leaked signer key instead of the protocol’s signature verification logic.

SlowMist points to missing price checks in Float Protocol contracts

For Float Protocol, SlowMist specifically identified the absence of TWAP or oracle validation as part of the attack path.

A TWAP uses observations collected across a period instead of relying solely on the price available at one moment. Spot prices inside liquidity pools can move when a sufficiently large trade changes the ratio of assets, which was the mechanism SlowMist said the Float Protocol attacker exploited.

Crypto.news’ flash loan guide described price manipulation as one of the common ways temporary liquidity can be used against a vulnerable DeFi application. The report noted that the flash loan provides the capital for an attack while the exploitable weakness can lie in price oracles, governance systems or contract logic.

In Float Protocol’s case, SlowMist said large trades were used to distort the Uniswap V3 pool’s slot0 value, which in turn changed currentTick() and getTotalAmounts(). The attacker repeatedly deposited and withdrew while the affected Hypervisor contracts calculated inflated LP share values, resulting in an estimated loss of 10.71 ETH.

By Ben Caselin, CMO at VALR

When crypto prices surge, market commentary tends to fixate on green candles and central bank policy.

Yet, looking beyond the immediate rally reveals a deeper structural shift taking place on-chain. Robinhood’s CEO, Vlad Tenev, skilfully drew global attention to this shift with the launch of the Robinhood Chain, joining a broader movement of major platforms bringing mainstream retail equity investors directly onto native on-chain execution.

Macroeconomic stress provides background fuel, but technological innovation provides the spark. Beneath the price action, four key trends are defining this cycle and reshaping how global wealth is owned, accessed, and stored.

Trend 1: The Retail Ownership Supercycle

At a recent White House summit, Vlad Tenev summarised his platform’s mission in a single word: ownership. Broad asset ownership is essential to a free and prosperous society, and the Robinhood Chain is putting that principle into practice.

Consider novel mechanics like The Index. Holding this single token automatically drops fractional tokenised equities directly into a user’s wallet. In a few clicks, crypto-native traders gain organic exposure to traditional stock portfolios, opening up meaningful diversification beyond crypto alone.

Crucially, this movement is propelled by retail culture. Memes like Popcat, Pepe, and Doge previously proved mass-market retail appetite on tier-one exchanges. Today, that energy is driving on-chain execution. On the Robinhood Chain, Cashcat has emerged as the primary runner and unofficial mascot. Meanwhile, Coinbase listing Basecat on Base, alongside community-led initiatives building around Cate on Solana, points to a broader, multi-chain “cat season.”

These community movements act as the primary onboarding engine for crypto and tokenised real-world asset ownership.

Trend 2: CeDeFi and Infrastructure Convergence

While the Robinhood Chain reignited retail attention on-chain, another milestone was taking shape at the infrastructure level. In previous cycles, centralised exchanges focused on building isolated, walled-garden blockchains and proprietary wallets. This cycle marks a fundamental pivot toward Centralised-Decentralised Finance (CeDeFi): direct liquidity integration.

We see this clearly in two parallel moves: Robinhood integrating Lighter, and VALR integrating Hyperliquid.

If Robinhood’s mandate is ownership for everyday retail investors, VALR’s mandate is global access. By directly plugging into Hyperliquid’s high-performance order book, VALR instantly gave over two million users across Africa and emerging markets seamless access to more than 200 liquid markets across crypto, equities, stock indices, commodities, precious metals, and foreign exchange. 

Trend 3: The Two-Phase Transformation of Money

This expanding global access lays the foundation for a much larger monetary transition. The evolution of money is unfolding in two distinct phases.

Phase 1 is happening right now through stablecoins. While the distant future of fiat currency looks bleak, stablecoins make storing, transferring, and spending value effortless. They are becoming the pragmatic rails for daily users, global enterprises, and international trade.

However, stablecoins merely digitise fiat; they do not protect against chronic currency debasement. When it becomes obvious to everyone that inflation is indeed not transitory, but long-lasting and ever-worsening, Phase 2 will surely take hold. The transition to sound money will be swift and violent, and stablecoins will provide the off-ramp.

Tokenised gold like XAUt and, fundamentally, Bitcoin are natural destinations for this transfer of capital. We are still early.

Trend 4: Agentic Finance and Human Purpose

Alongside monetary evolution sits the rise of agentic finance. Autonomous AI agents and algorithmic execution will soon handle complex market mechanics, liquidity deployment, and execution strategies.

What AI will do to our economies is still unfolding. Personally, I would rather focus on painting and tending a rose garden, letting the world figure out the question of AI and robots. Optimistically, that is the true promise of technology anyway: outsourcing the mundane to machines so humans can focus on service, kindness, creativity, and contemplation.

Beyond Rotation: The Conviction Cycle

Speculative token-hopping and short-term player-versus-player trading have defined much of recent crypto culture. Yet, set against this culture of endless rotation, a simple phrase is taking root: believe in something.

The platforms, protocols, and participants that endure in this next cycle will not be those chasing fleeting market trends. In addition to ownership and access, this cycle will belong to conviction.

About the author

Ben Caselin is Chief Marketing Officer at VALR.com, Africa’s largest crypto exchange and infrastructure provider by trade volume. Headquartered in Johannesburg, VALR serves over 1900 corporate and institutional clients and more than 1.9 million traders worldwide. Drawing on years of experience in the digital asset space, mostly in Hong Kong, the UAE and now South Africa, Ben focuses primarily on driving the adoption of bitcoin in emerging markets and advocates for an approach to innovation on the basis of spiritual principles. 

Decentralized exchange Hyperliquid and memecoin launchpad Pump.fun reportedly accounted for nearly 90% of the record $638 million in token buybacks carried out by cryptocurrency projects so far in 2026.

Crypto projects spent a record $638 million to repurchase their own cryptocurrencies year-to-date, up from $545 million during the same period in 2025 and $366,000 in 2024, according to Allium Labs data cited by the Financial Times in a Monday report. Of the $638 million, Hyperliquid accounted for roughly $370 million and Pump.fun for nearly $200 million.

Token buybacks are similar to share buybacks by publicly listed companies, which buy back their own stock to support their share prices and increase returns for existing shareholders.

While token buybacks are still rare in the crypto industry, more companies are taking advantage of the move. On Thursday, the Ethena Foundation opened a vote on a fee-switch proposal under which 95% of the net revenue paid to it from Ethena’s core business lines would be used to repurchase Ethena (ENA) tokens. The ENA token rose 10.7% on the day after the proposal.

Crypto project spend on token buybacks, year-to-date leading up to Aug. 25. Source: Allium Labs, Financial Times.

HYPE, PUMP outperform crypto market as buybacks boost token valuations

The Hyperliquid (HYPE) and Pump.fun (PUMP) tokens have outperformed the broader cryptocurrency market decline so far in 2026.

HYPE rose 145% and PUMP rose 109% year-to-date, while Bitcoin’s (BTC) price fell 10% and the total crypto market capitalization declined by 11.9% during the same period, according to TradingView data.

HYPE, PUMP, BTC, Total Crypto Market Cap, year-to-date chart. Source: Cointelegraph/TradingView

Hyperliquid spends about 99% of its revenue on token buybacks. Hyperliquid reported $169 million in second-quarter revenue on Aug. 6 and directed $141 million toward HYPE buybacks. 

Related: Crypto generated about 1% of Webull’s record $198M Q2 revenue

Pump.Fun allocates about 50% of its net protocol revenue for token repurchases. The memecoin launchpad currently boasts $420 million in annualized revenue, based on the average daily revenue of the past 90 days.

Crypto valuations could double in the next two years as protocols increasingly use revenue to fund token buybacks and burns, hence returning more value to investors, said Bitwise chief investment officer Matt Hougan earlier in August.  

Magazine: Why Ray Dalio says Bitcoin can’t replace gold