Pakistan’s crypto regulator has formally moved from rulemaking to enforcement by opening its licensing portal for virtual asset service providers (VASPs). The Pakistan’s Virtual Assets Regulatory Authority (PVARA) notified regulations for crypto exchanges and a broader set of virtual-asset activities, setting a deadline for firms already operating in the country to apply for a no-objection certificate (NOC).

Under PVARA’s licensing website guidance, companies providing virtual asset services on or before March 5 must submit their NOC applications by Sept. 5; otherwise, continuing operations without an application will be treated as an offense. The regulator says the window is now “officially open,” laying out standards intended to bring consumer protection, governance, and compliance into the open for regulated market participants.

Key takeaways

• PVARA has opened its licensing portal after notifying the regulations that define how crypto services will be authorized in Pakistan.
• Existing operators have until Sept. 5 to apply for an NOC; operating past the deadline without applying can trigger enforcement.
• The framework covers a wide range of VASP activities, including exchanges, custody, broker-dealer services, lending, derivatives, asset management, token issuance, and mining-related services.
• Licensed providers must segregate customer holdings and face restrictions on lending or pledging those assets without written consent.
• Firms can pursue either a sandbox pathway for product testing or an NOC pathway as they prepare for full licensing.

A licensing regime built for enforcement

PVARA’s move is significant because it converts a regulatory framework into an action-oriented process with clear compliance steps for market participants. In a Saturday press release attributed to the Associated Press of Pakistan, PVARA said operating after the relevant deadline without submitting an application will be considered an offense.

In a separate statement on LinkedIn, PVARA described the launch as creating a “clear pathway” for businesses to enter Pakistan’s regulated virtual asset market. The regulator linked the licensing effort to defined expectations around consumer protection, governance, compliance, and market integrity—areas that typically become central when regulators shift from consultations and policy drafting to supervision and licensing decisions.

Which services fall under PVARA’s framework

The notification outlines a broad scope of activities that VASPs must address in their licensing pathway. According to PVARA’s described framework, it includes services such as exchanges and custody, broker-dealer activities, lending and derivatives, asset management, token issuance, and mining-related services.

PVARA also lays out options for how companies can engage with the regulator before they become fully licensed. The regulator states that providers may seek an NOC prior to incorporating locally, or they can enter a regulatory sandbox to test products under PVARA supervision before applying for full authorization.

That two-track design matters for companies trying to scale operations while navigating compliance requirements. The sandbox approach can reduce time-to-learning for new products, while the NOC pathway offers a structured route for firms preparing to establish a Pakistan-based presence.

Operating rules: segregation, cybersecurity, and AML/CTF controls

PVARA says licensed providers will have to meet specific operational and custody-related requirements. One of the most immediate implications for exchanges and custodial platforms is the requirement to keep customer holdings separate from their own assets.

The framework further restricts how those customer holdings can be used. PVARA states that providers cannot lend or pledge customer assets without written consent, a rule designed to reduce the risk of conflicts between customer interests and a platform’s own balance-sheet needs.

Beyond custody, the regulator’s framework also specifies governance and conduct expectations, cybersecurity requirements, operational resilience measures, and anti-money laundering and counter-terrorism financing controls. For operators, these obligations will likely determine not only whether a license is granted, but also how systems are architected—especially around risk monitoring, incident response, and compliance reporting.

From consultation to notified rules—and what it changes now

The licensing push follows a public consultation that ran from June 11 to July 2. PVARA said the final framework provides two routes to licensing: a sandbox for product testing and an NOC pathway for companies preparing to incorporate in Pakistan.

In practice, this turns previously described standards into enforceable requirements with dates attached. Companies that were waiting for the notified regulations to start applying will now need to treat licensing as a near-term priority, particularly because the NOC application deadline is tied to whether a provider was already offering services in the country on or before March 5.

Notably, PVARA has indicated it already issued NOCs to some firms. The regulatory groundwork includes preliminary approvals that allow certain exchanges to establish local subsidiaries and prepare full license applications—progress that now can move faster now that the rules have been formally notified through the portal process. PVARA’s earlier NOC issuances have included Binance and HTX, as previously reported by Cointelegraph.

How Pakistan’s broader crypto framework is taking shape

PVARA’s ability to run a licensing process stems from Pakistan’s legislative shift earlier this year. Cointelegraph previously reported that Pakistan’s parliament passed the Virtual Assets Act in March, establishing PVARA as the statutory regulator for the sector.

Regulatory coordination has also extended to banking access. Cointelegraph has reported that the State Bank of Pakistan allowed banks to provide accounts to licensed VASPs, including segregated client-money accounts. Combined with PVARA’s new requirements around separation of customer holdings, that creates a clearer compliance stack for licensed providers—addressing both operational custody rules and the banking plumbing required for regulated services.

Still, with licensing enforcement now starting in earnest, companies and users should watch how quickly applications are processed and what additional conditions—if any—are imposed as full licenses are granted. The regulations establish the baseline, but the practical effects will depend on PVARA’s implementation, including how sandbox participants are supervised and how quickly NOCs translate into full licensing.

For market participants, the next phase will likely center on whether existing VASPs can meet the Sept. 5 NOC deadline and how rigorously PVARA assesses custody separation, cybersecurity readiness, and AML/CTF controls. That timeline—and the regulator’s approach to granting first full authorizations—could determine how rapidly Pakistan’s regulated crypto market expands.

Pakistan’s Virtual Assets Regulatory Authority (PVARA) has opened its licensing portal after notifying regulations governing crypto exchanges and other virtual asset service providers (VASPs) operating in the country. 

Companies providing virtual asset services on or before March 5 must submit an application for a no-objection certificate (NOC) by Sept. 5 or cease operations, according to the PVARA licensing website. Operating after the deadline without submitting an application will constitute an offense, PVARA said in a Saturday press release published by the Associated Press of Pakistan.

“The licensing window is officially open, creating a clear pathway for businesses to enter Pakistan’s regulated virtual asset market, with defined standards for consumer protection, governance, compliance and market integrity,” PVARA said on LinkedIn. 

The launch moves Pakistan’s crypto framework from legislation into enforcement, requiring domestic and overseas VASPs to enter the formal licensing process or stop serving the market. 

New regulations clear path to full crypto licenses

The framework covers activities including exchanges, custody, broker-dealer services, lending, derivatives, asset management, token issuance and mining-related services. VASPs can pursue an NOC before incorporating locally or enter a regulatory sandbox to test products under PVARA supervision before seeking a full license. 

According to the press release, licensed providers will be required to keep customer holdings separate from their own assets and cannot lend or pledge them without written consent. The framework also requires covering governance, market conduct, cybersecurity, operational resilience and anti-money laundering and counter-terrorism financing controls. 

The rollout followed a public consultation held between June 11 and July 2. PVARA said the final framework provides two routes to licensing. This includes a sandbox pathway for firms testing new products and an NOC pathway for companies preparing to incorporate in Pakistan.

Related: Pakistan crypto chief seeks dialogue after scholar rules against crypto payments

PVARA has already issued NOCs to some firms, including Binance and HTX in December 2025. The preliminary approvals allow the exchanges to establish local subsidiaries and prepare full license applications, a process that can now advance following the notification of the regulations.

Pakistan’s parliament passed the Virtual Assets Act in March, establishing PVARA as the statutory regulator for the sector. The State Bank of Pakistan subsequently allowed banks to provide accounts to licensed VASPs, including segregated client-money accounts.

Magazine: MiCA cracks down on USDT in Europe… but no one else cares

Phantom will end support for the Sui network on Sept. 24, 2026, removing the ability to view, send, swap or interact with Sui assets through its wallet interface.

The transition comes less than 20 months after Phantom introduced native Sui support in January 2025. Phantom has not publicly explained why it is withdrawing the integration.

Users will not lose their assets when support ends, according to Phantom’s official notice. SUI and other tokens remain recorded on the Sui blockchain and controlled by the corresponding recovery phrase or private key.

Phantom will remove every Sui wallet function

After Sept. 24, Phantom will stop displaying Sui balances and remove Sui from its supported network list. Users will also lose access to Sui transactions, swaps and decentralized applications through Phantom.

Connections previously established between Phantom and Sui applications will stop working. Users who move to another compatible wallet must reconnect those applications through the replacement wallet.

The withdrawal reverses an expansion announced in early 2025, when Phantom added native access to Sui assets and applications. Sui was the first blockchain based on the Move programming language supported by Phantom.

At launch, the integration allowed users to manage SUI and other network tokens, perform swaps and connect with applications including Suilend, Bluefin, Navi and Aftermath.

Phantom has not reported a security breach or network failure connected with the withdrawal. Its support notice describes the decision as a product transition and does not provide a technical or commercial reason.

Sui users have two migration options

Users who want to remain inside Phantom can swap their Sui assets into tokens on supported networks before the deadline. Available alternatives include SOL, ETH and USDC.

Phantom has temporarily waived its own fee for cross chain swaps from native SUI into wrapped SUI on Solana. The waiver remains effective through Sept. 24. Network and exchange fees will still apply.

Wrapped SUI is not native SUI. It is a Solana based token representing SUI transferred through cross chain infrastructure. Holders should verify the receiving network and token contract before approving a transaction.

Users who want to retain native Sui assets can import their Phantom recovery phrase into a compatible wallet. Phantom recommends Slush, the wallet associated with the Sui ecosystem.

The same Sui address and assets should appear after the wallet is restored with the correct credentials. Users with additional recovery phrases or separately imported private keys must transfer each set individually.

Migration can take place before or after Sept. 24 because there is no deadline for accessing the underlying assets. However, completing the process early allows users to confirm their balances and wallet access before Phantom removes the network interface.

Migration scams present the immediate security risk

Phantom warned that it will never contact users first, request a recovery phrase or offer to move assets on their behalf. Anyone providing unsolicited migration assistance should be treated as a potential scammer.

The warning is relevant because wallet transitions often create opportunities for phishing campaigns. Scammers can imitate support accounts, distribute fake wallet applications or direct users to websites that capture recovery phrases.

As previously reported, attackers used fraudulent update prompts to steal Phantom recovery phrases. The prompts were designed to resemble legitimate wallet messages and gave attackers full control when users entered their credentials.

Users should obtain the replacement wallet through its official website and confirm the domain independently. Recovery phrases should never be entered into websites, support chats or forms sent through social media.

Importing a recovery phrase into another application grants that software access to the same wallet. Users should therefore verify the application carefully and store the phrase offline after completing the process.

What happens on Sept. 24

Phantom will remove Sui balances, transaction tools and application connections when the transition takes effect. The change will not transfer, delete or convert assets automatically.

Users who take no action can restore access later by importing the correct credentials into a compatible Sui wallet. Phantom has not announced any plan to resume support after the transition.

The main deadline applies to in-app functionality and Phantom’s swap fee waiver, not asset ownership. Holders who want to swap inside Phantom or verify their migration should complete those steps before Sept. 24.

Tether CEO Paolo Ardoino said on Aug. 23 that several developing economies increasingly rely on USDT for domestic commerce, international trade and dollar denominated savings.

“The economies of several developing countries rely heavily on USDT, both for domestic and foreign trade,” Ardoino wrote in a post. He said Tether’s financial inclusion mission was becoming more important.

Ardoino cited Venezuela, Argentina, Bolivia and Turkey as markets where people use the stablecoin in response to inflation, currency depreciation, limited access to dollars and restrictions within conventional financial systems.

His statement describes Tether’s view of adoption. No single public dataset measures how dependent entire national economies are on USDT. Independent blockchain research, central bank data and exchange activity nevertheless support the broader conclusion that dollar stablecoins have gained traction in those markets.

Currency instability is supporting USDT adoption

USDT is designed to track the U.S. dollar, allowing users to obtain digital dollar exposure without holding a U.S. bank account. It can move between compatible wallets and exchanges at any time, although conversion options, costs and regulations vary by country.

The product can appeal to users whose local currencies are losing purchasing power. It also provides an alternative when physical dollars are scarce or cross border bank transfers are expensive and slow.

Turkey continued to face elevated inflation despite progress under its disinflation program. Consumer inflation fell from 49.4% in September 2024 to 30.9% in December 2025, according to an International Monetary Fund review. The IMF projected inflation of 23% at the end of 2026.

Argentina has also continued addressing inflation and foreign exchange pressures. The IMF reported that monthly inflation reached 3.4% in March 2026 following currency depreciation and weaker demand for pesos.

Stablecoin demand extends beyond those two markets. Chainalysis ranked Turkey 14th, Venezuela 18th and Argentina 20th in its 2025 Global Crypto Adoption Index. When adjusted for population, Venezuela ranked ninth worldwide.

Venezuela and Bolivia show commercial use cases

In Venezuela, local businesses reportedly use USDT for retail payments and some import and export settlements. The stablecoin operates alongside bolivars, physical dollars and other digital assets within what local observers describe as a hybrid currency economy.

Chainalysis estimated that Venezuela received $44.6 billion in cryptocurrency value between July 2022 and June 2025. The figure covers all tracked crypto assets and does not represent USDT alone.

Bolivia provides a clearer official signal. The Central Bank of Bolivia publishes a reference USDT exchange rate based on weighted peer to peer activity on Binance. Its published data show how the stablecoin trades at a premium to the country’s official dollar rate.

The bank’s January financial stability report also identified foreign currency restrictions, higher inflation and low international reserves as continuing risks.

As previously reported, Bolivia moved toward recognizing USDT within its national payment system. Local banks already provide some USDT services, while businesses have used crypto for international payments and fuel related transactions.

The government has not completed a national framework making USDT equivalent to legal tender. Any description of formal payment status therefore remains forward looking.

Regional data support the broader trend

Chainalysis measured nearly $1.5 trillion in Latin American crypto activity between July 2022 and June 2025. Argentina accounted for an estimated $93.9 billion, Venezuela $44.6 billion and Bolivia $14.8 billion.

Centralized exchanges processed 64% of regional activity, showing that users generally obtain digital assets through conventional trading platforms rather than decentralized protocols.

In related coverage, dollar stablecoins accounted for 40% of purchases by Bitso users during 2025, compared with 18% for Bitcoin. The exchange operates across several Latin American markets, so those figures should not be treated as Argentina only data.

Tether says its products served more than 570 million people by March 2026. That is a company supplied estimate rather than a count of fully identified individual users because one person can control several blockchain addresses.

The company’s reported USDT supply reached a record $188 billion during 2026, reinforcing its position as the largest dollar stablecoin.

Users still face issuer, regulatory, wallet and network risks. USDT represents a claim supported by Tether’s reserves, not a bank deposit, and availability can change when governments or exchanges introduce new stablecoin rules.

Term Finance’s decentralized lending protocol suffered an estimated $8.5 million loss after an attacker allegedly exploited governance control over its strategy vaults, according to multiple blockchain security monitoring firms. The incident highlights a recurring risk in DeFi: even when a lending protocol’s core markets continue to operate, weaknesses around vault governance and upgrade paths can still lead to large, fast-moving drains.

PeckShield said the attacker drained approximately 2,843 ETH (worth about $6.87 million at the time) and 1.68 million USDC, which was converted into roughly 1.68 million DAI. CertiK reported a similar total, placing the combined losses at around $8.5 million. Term’s vault product held about $12.45 million before the exploit, according to DefiLlama data.

Key takeaways

• Security firms attribute the drain to governance control over Term Finance’s strategy vaults rather than a break of the core protocol markets.
• About 68% of vault assets were reportedly lost, with the attacker converting USDC into DAI after taking funds.
• Term Labs says it has shut down the affected vaults and revoked their DAO governance roles to stop further deposits.
• Yearn V3 infrastructure was involved, but Yearn says the attack used a custom governance wrapper, limiting how much the finding applies to standard Yearn setups.

Loss estimates and what was taken

According to PeckShield, the attacker executed withdrawals that totaled 2,843 ETH and 1.68 million USDC, later swapping the stablecoin into about 1.68 million DAI. CertiK’s assessment aligned with PeckShield’s, suggesting the total loss across the drained assets reached roughly $8.5 million.

These figures matter because they contextualize the scale relative to what was actually exposed. Before the exploit, Term’s vault product reportedly held about $12.45 million (DefiLlama). The security firms’ estimates imply the attacker removed around 68% of that value—during a period in which the vaults included nearly all of Term’s approximately $8.8 million in Ethereum deposits, based on the same DefiLlama data.

Term Labs shuts vaults and changes governance

In a post on X, Term Labs said it had taken emergency steps to limit further damage. The company stated it had irreversibly shut down all Term Meta Vaults and revoked their DAO governance roles, which it said would permanently prevent additional deposits while leaving withdrawals open.

Term Labs also indicated that, based on its investigation so far, the underlying Term protocol and its direct borrowing and lending markets were not affected. Even so, it said it was still verifying the full scope of what was impacted.

Cointelegraph reported it could not reach Term Labs for further comment. The company does not appear to list a public press contact, and its X direct messages were closed at the time of reporting.

How governance may have been compromised

Defimon, an on-chain monitoring service, suggested the attacker likely took control in a governance-related maneuver rather than via a direct exploit of the vault strategies themselves. Defimon claimed the attacker acquired a majority of a sparsely held governance token “cheaply” and then passed proposals that enabled it to seize control of Term’s vaults.

Crucially, Defimon’s statement did not specify the precise mechanism by which the attacker obtained voting control, nor did it clarify which governance functions were used. Term has also not publicly confirmed the path to voting control in the reports summarized by PeckShield, CertiK, or Defimon.

The vault contracts reportedly use Yearn V3 infrastructure, which raised questions about whether a weakness in Yearn itself could have been responsible. Yearn responded that the attack involved a custom governance wrapper and said the vector does not apply to standard Yearn vault setups.

For investors and users, this distinction is significant. It suggests the failure mode may be less about the underlying Yearn components and more about the protocol-specific governance layer built on top of them. That’s a useful takeaway for other teams auditing their own vault governance: even established infrastructure can be rendered vulnerable if the wrapper logic or permissioning is poorly defended.

An incident that echoes earlier governance risk

This exploit arrives against a backdrop of prior Term-related security issues. The incident follows an April 2025 oracle error that reportedly triggered unintended liquidations totaling about 918 ETH. In that earlier event, Term said it recovered about 556 ETH, reducing the final loss to about 362 ETH, and reimbursed affected users, as described in its postmortem at term.finance.

After the oracle incident, Term pledged third-party validation for critical updates and greater governance transparency. The latest reported attack again centers on governance—this time not on oracles, but on the decision-making controls around vault access and management—suggesting that governance hardening remains a core area for DeFi risk management.

Term said it was coordinating with external security teams on asset recovery and remediation, and it stated it would “explore paths to address” any remaining shortfall. While the exact recovery outcome was not detailed in the reports summarized here, the company’s approach indicates it views the event as partially reversible or at least seeks to minimize lasting damage where possible.

Yearn’s clarification also offers a broader lesson for the sector: protocols borrowing widely used components still need to scrutinize the surrounding governance and upgrade wrappers. Standard integrations may be safe, but custom permissioning layers can introduce new attack surfaces—especially when governance token distribution is thin or proposals can be approved by an unexpectedly small voting bloc.

Readers should watch whether Term provides a more complete explanation of how voting control was obtained, whether any portion of the drained assets can be recovered, and what governance safeguards are added or modified before vault functionality is restored in any form.