Connect with us
DAPA Banner

Crypto World

Brazil Central Bank Mandates Daily Crypto Asset Reports

Published

on

Nexo Partners with Bakkt for US Crypto Exchange and Yield Programs

TLDR

  • Brazil’s central bank will require licensed crypto exchanges to prove asset sufficiency daily starting Jan. 1, 2027.
  • The new framework aligns crypto trading platforms with commercial banking standards on capital and reporting.
  • Exchanges must fully separate company funds from customer fiat and cryptocurrency holdings.
  • Platforms must follow a specialized accounting manual for recording and valuing digital assets.
  • The rules impose stricter data protection and confidentiality obligations on crypto intermediaries.

Brazil’s central bank will require licensed crypto exchanges to prove asset sufficiency daily from Jan. 1, 2027. The authority published the framework on March 3 through official market communications. The rules align crypto intermediaries with commercial banking standards on capital, accounting, and data controls.

Brazil Tightens Oversight With Daily Reserve Reporting

The central bank said exchanges must submit daily attestations of asset sufficiency starting in 2027. Supervisors will review reports to confirm that platforms hold adequate fiat and crypto reserves. The authority said exchanges must cover operational, liquidity, and cyber risks. It stated that daily reporting will reduce sudden shortfalls and customer losses.

The framework requires strict segregation of client and company assets. Exchanges must separate their own accounts from customer fiat and crypto holdings. The bank said segregation will prevent commingling and misuse of client funds. It added that regulators will gain clearer views of assets attributable to users.

Exchanges Must Follow Bank-style Accounting and Data Rules

The central bank ordered exchanges to record crypto assets under a specialized accounting manual. Platforms must follow standardized rules on classification, valuation, and impairment of digital assets. Officials said consistent accounting will improve comparability across regulated entities. The bank stated that financial statements must reflect crypto exposures clearly.

The authority also imposed bank-level data protection and confidentiality standards. Exchanges must implement strict controls over customer records and internal communications. The central bank said firms must limit unauthorized access and data leaks. It added that platforms must maintain detailed documentation for supervisory audits.

Advertisement

Cross-border Crypto Transfers Face Enhanced Scrutiny

The framework expands oversight of cross-border crypto transfers handled by domestic exchanges. Platforms must report origin, destination, and on-chain pathways of international transactions. Supervisors will use blockchain analytics to monitor transaction traceability. The bank said enhanced audits will address money laundering and tax evasion risks.

Authorities will coordinate with tax agencies and financial intelligence units on reporting standards. Exchanges must integrate compliance systems that flag suspicious cross-border flows in near real time. The central bank stated that firms must retain sufficient records for inspections. The rules will apply to all licensed trading venues operating in Brazil.

The central bank said larger exchanges may rely on existing compliance infrastructure. Smaller platforms must upgrade custody, reporting, and monitoring systems before 2027. Officials confirmed that the rules apply regardless of the token type traded. BTC and ETH traded lower on the announcement date, according to market data.

The authority stated that the framework targets operational resilience and customer fund protection. It confirmed that licensed exchanges must comply by Jan. 1, 2027. Supervisors will issue further technical guidance before implementation. The central bank published the measures through official communications on March 3.

Advertisement

Source link

Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Published

on

Friday’s eth.limo Hijack Caused by Social Engineering on EasyDNS

Ethereum Name Service gateway eth.limo has revealed that the domain hijacking on Friday was caused by a social engineering attack directed against EasyDNS, its domain name service provider. 

According to a postmortem published by eth.limo on Saturday, an attacker impersonated one of its team members to initiate an account recovery process with easyDNS, granting access to the eth.limo account and allowing them to alter domain settings.

“The NS records were changed and directed to Cloudflare… Once we understood that a DNS hijack had taken place, we immediately notified the community as well as Vitalik Buterin and others. We then began contacting EasyDNS in an attempt to respond to the incident,” the company said.

Eth.limo serves as a Web2 bridge, providing access to around 2 million decentralized websites using the .eth domain name. Hijacking the service could allow an attacker to redirect users to malicious websites. Ethereum co-founder Vitalik Buterin warned users Friday to avoid his blog until the incident was resolved.

Advertisement

Mark Jeftovic, CEO of easyDNS, has publicly accepted responsibility for the incident in its own postmortem report. 

“We screwed up and we own it,” said Jeftovic on Saturday. 

“This would mark the first successful social engineering attack against an easyDNS client in our 28-year history. There have been countless attempts.”  

Both companies have pointed to the Domain Name System Security Extension (DNSSEC) in thwarting the hacker’s attempts to do further damage. 

The attacker couldn’t produce valid cryptographic signatures, so Domain Name System resolvers rejected the attacker’s forged DNS responses, causing users to see error messages instead of being redirected to malicious sites. 

Advertisement

“DNSSEC was enabled for their domain when the attackers attempted to flip their nameservers, presumably to effect some manner of phishing or malware injection attack, DNSSEC-aware resolvers, which most are these days, began dropping queries,” Jeftovic said. 

Source: eth.limo

In its postmortem, eth.limo noted that because the attacker lacked the signing keys, they were unable to bypass the safeguards, which likely “reduced the blast radius of the hijack. We are not aware of any user impact at this time. We will provide updates if that changes.”

easyDNS makes changes since the attack

Jeftovic described the social engineering attack as “highly sophisticated,” and said easyDNS is still conducting a post-mortem on how the breach occurred, and has already begun rolling out changes to prevent a recurrence.

Source: easyDNS

“In eth.limo’s case, we will be migrating them to Domainsure, which has a security posture more suited toward enterprise and high-value fintech domains, TLDR there is no mechanism for an account recovery on Domainsure, it’s not a thing,” he added.

“On behalf of everyone here, I apologize to the eth.limo team and the wider Ethereum community. ENS has always had a special place in our heart as the first registrar to enable ENS linking to web2 domains and we’ve been involved in the space since 2017.”

Related: RaveDAO denies manipulation as Binance, Bitget probe RAVE trading activity

Advertisement

The eth.limo incident is the latest in a series of domain hijackings targeting crypto projects. Days earlier, decentralized exchange aggregator CoW Swap lost control of its website after an unknown party hijacked its domain. 

Steakhouse Financial, a DeFi advisory and research firm, similarly disclosed at the end of March that it had lost control of its domain to an attacker.

Magazine: Will the CLARITY Act be good — or bad — for DeFi?