South Korea is preparing to expand its crypto “Travel Rule” so that it applies to virtually all on-chain transfers between registered virtual asset service providers (VASPs), rather than only transactions above a set value. The change removes the current 1 million won threshold (about $700), a step aimed at closing an obvious loophole: users splitting transfers into smaller chunks to stay under reporting and information-sharing requirements.

According to a cabinet decision approving amendments to the Enforcement Decree of South Korea’s Act on Reporting and Using Specified Financial Transaction Information, the updated rules will also add tighter anti-money laundering (AML) obligations around transfers that involve foreign exchanges and personal wallets, where authorities have said existing controls have been exploited.

Key takeaways

• South Korea’s Travel Rule will apply to all transfers between registered crypto VASPs, removing the 1 million won transaction cutoff.
• Receiving platforms must obtain sender and recipient information and can request missing data or reject transfers if required information is unavailable.
• New AML requirements extend to transfers involving overseas crypto exchanges and personal wallets, including risk-based acceptance rules.
• Platforms will need suspicious transaction monitoring for transfers of at least 10 million won involving foreign exchanges or personal wallets.
• The expanded framework starts at staggered timelines: some VASP registration updates take effect Aug. 20, while other transfer-related requirements begin six months after promulgation.

Travel Rule expanded with threshold removed

South Korea’s Financial Intelligence Unit (FIU) said the main driver behind the amendment is the risk that users can circumvent the Travel Rule by breaking up activity into smaller transfers that fall below the prior reporting threshold. The cabinet-approved changes remove the value limit entirely, making information-sharing obligations standard across the board for covered transfers.

The FIU cited an example intended to illustrate how the threshold can be gamed. It described a case where a user purchased Tether USDt (USDT) after depositing roughly 200 million won into a crypto exchange, then executed 216 withdrawals, each valued below 1 million won. By keeping each withdrawal under the cutoff, the user aimed to reduce exposure to the Travel Rule’s information-sharing requirements.

Under the revised framework, the Travel Rule will cover all transfers between registered crypto service providers, regardless of amount. This matters for compliance teams and operational workflows: firms can no longer assume that smaller transfers are “out of scope,” and they will need to ensure their transaction processing can consistently handle sender/recipient information requirements at higher volumes and smaller denominations.

What receiving platforms must do

The amendments specify operational responsibilities for counterparties receiving transfers. Receiving VASPs will be required to obtain sender and recipient information. If required data is incomplete or missing, receiving platforms may request the missing information—or reject the transaction when necessary details cannot be obtained.

For users, this raises the prospect of more frequent transfer friction, particularly around transactions where counterparties fail to provide the expected information. For exchanges and wallet providers, it emphasizes the importance of internal controls and technical readiness—especially where transfers cross different service providers that may vary in how they capture and transmit required details.

The rule change is also designed to standardize accountability across the ecosystem. Instead of relying on a threshold that can be optimized around, the updated approach pushes toward comprehensive compliance for covered counterparties.

Overseas exchanges and personal wallets face new AML controls

Beyond expanding the Travel Rule, the decree introduces new AML requirements for transfers that involve overseas crypto exchanges and personal wallets. Registered local VASPs will need to apply a risk-based approach to decide which transfers they allow based on the risk posed by the counterparty.

In practice, the amendments indicate that transfers to low-risk overseas exchanges will be permitted. However, transfers involving other foreign exchanges and personal wallets are generally allowed only when the sender and recipient are the same person—an effort to reduce anonymity and inter-personal laundering risks.

Where counterparties are assessed as high risk, transactions will be prohibited. This creates a compliance obligation that goes beyond simple eligibility checks: firms will have to maintain and update risk assessments tied to specific counterparties, and ensure those assessments are reflected in transaction controls.

The decree also requires crypto platforms to establish their own suspicious transaction monitoring systems for transfers worth at least 10 million won that involve foreign exchanges or personal wallets. Authorities said suspected money laundering involving overseas exchanges and personal wallets has risen because gaps in existing AML rules for such transfers have been exploited.

Even though the new Travel Rule applies to transfers between registered local providers, the AML changes broaden the compliance perimeter. They are aimed at the points where value can flow into or out of Korea’s regulated rails through foreign venues or self-custody arrangements.

Stronger registration standards and phased implementation

In addition to transaction-specific requirements, the decree strengthens the registration framework for crypto service providers. The amendments include requirements related to financial health, internal controls, staffing, and infrastructure standards, while also expanding scrutiny of major shareholders. This signals an intent to raise baseline operational quality and governance across the sector, not only to improve transaction monitoring.

The VASP registration provisions will take effect Aug. 20. However, existing providers will receive an additional year to comply with some of the financial, staffing, infrastructure, and internal control requirements—suggesting a transition period intended to reduce abrupt compliance shocks for incumbents.

Meanwhile, the expanded Travel Rule and the other transfer-related AML requirements will take effect six months after the decree is promulgated. That timing means exchanges and wallet providers will need to prepare their systems ahead of the compliance start date, including data capture and transfer handling logic required for sender/recipient information, as well as monitoring and risk assessment processes for cross-border and self-custody related activity.

For market participants, the key watch items are how risk assessments for overseas counterparties are implemented and how receiving platforms handle missing information in practice—because those operational details will determine whether the new rules mainly improve traceability or also introduce more frequent transaction rejections for edge cases.

Smart contracts are powerful, but they are also blind. They cannot see prices, read weather data, or verify that a payment arrived in a bank account. Oracles are the infrastructure that connects blockchains to the outside world, and the security of more than $200 billion in DeFi depends on them working correctly.

Most explanations of blockchain oracles start with a definition and stop there. They tell you that an oracle is a bridge between a blockchain and the outside world, which is true but insufficient. It is like saying a power grid is a bridge between a generator and a light switch. Technically correct. Practically useless for understanding why the grid fails, who pays when it does, and why the design of the grid matters more than the design of the switch.

The more useful starting point is the constraint that oracles exist to solve. Smart contracts are deterministic. Every node on the network must execute the same code and arrive at the same result. If a smart contract could query a stock price API directly, different nodes would receive different responses at different times, and consensus would break. The blockchain would fork not because of a governance dispute but because of a rounding error in a price feed.

Oracles exist because blockchains chose determinism over connectivity, and that choice is not negotiable. Every oracle solution is an attempt to bring external data on chain without breaking the property that makes blockchains trustworthy in the first place.

How oracles actually work

The standard oracle architecture has three layers: data sourcing, aggregation, and on chain delivery.

At the sourcing layer, oracle nodes connect to external data providers. For a price feed, this might mean pulling the ETH/USD price from Coinbase, Kraken, Binance, and several other exchanges simultaneously. For a weather oracle, it might mean connecting to multiple meteorological APIs. The principle is the same: no single source is trusted.

At the aggregation layer, the oracle network combines these data points into a single value. The most common method is a weighted median, which discards outliers and produces a result that no single data provider can manipulate. If seven nodes report prices between $2,000 and $2,005 and one node reports $50,000, the median ignores the outlier.

At the delivery layer, the aggregated value is written to a smart contract on chain. This is the point where external data becomes blockchain data, immutable and available to any contract that references it. The on chain contract stores the latest value, and any DeFi protocol can read it.

This three layer model sounds clean in theory. In practice, each layer introduces attack surfaces, latency, and cost. Understanding where oracles fail requires examining each layer separately.

The oracle problem explained

The oracle problem is not a bug. It is a fundamental tension in blockchain design that cannot be fully resolved, only managed.

A blockchain derives its security from decentralization. No single entity controls the ledger. But if every smart contract on that blockchain reads price data from a single oracle controlled by a single company, the entire system security reduces to the security of that one company. The blockchain is decentralized. The data it depends on is not.

This is why the oracle problem is sometimes described as the last mile problem of blockchain security. You can build a perfectly audited smart contract, deploy it on a perfectly decentralized network, and still lose everything if the oracle feeding it data is compromised.

The solutions fall into two categories. Centralized oracles sacrifice decentralization for speed and simplicity. A single entity runs the oracle, and users trust that entity to deliver accurate data. This works for low stakes applications but is unsuitable for DeFi protocols holding billions of dollars.

Decentralized oracle networks address the trust problem by distributing data collection and aggregation across multiple independent nodes. Chainlink pioneered this model, requiring a configurable quorum of nodes to agree on a data point before it is published on chain. The economic incentive structure requires node operators to stake collateral that can be slashed for providing inaccurate data, aligning their financial interest with honest reporting.

Neither approach eliminates the oracle problem entirely. Decentralized oracle networks reduce the probability of manipulation but increase cost and latency. The tradeoff is a design decision, not a design flaw.

Why DeFi cannot exist without oracles

The dependency is arithmetic, not philosophical. Consider a lending protocol like Aave. A user deposits one ETH as collateral and borrows $1,500 in stablecoins. The protocol needs to know the price of ETH continuously to determine whether the collateral covers the loan.

If ETH drops from $2,000 to $1,400, the loan is undercollateralized and must be liquidated. Without an oracle providing the current price, the protocol has no way to trigger liquidation. The stablecoin borrowers would accumulate bad debt, and the protocol would become insolvent.

This is not a hypothetical scenario. Every lending protocol, every perpetual futures exchange, every options platform, and every synthetic asset on every blockchain depends on oracles for the prices that determine solvency. The total value locked in DeFi protocols that rely on oracle price feeds exceeds $200 billion across all chains.

The same dependency extends beyond price feeds. Prediction markets need oracles to report event outcomes. Insurance protocols need weather data. Real world asset platforms need proof that the underlying assets exist and are valued correctly. In each case, the oracle is the single component whose failure would make the entire application meaningless.

Oracle manipulation: how exploits happen

Oracle exploits follow a predictable pattern. The attacker identifies a DeFi protocol that derives its price from a single on chain source, typically a decentralized exchange liquidity pool, rather than from a decentralized oracle network.

The attack proceeds in three steps within a single transaction. First, the attacker takes a flash loan, borrowing millions of dollars with no collateral for the duration of one transaction. Second, the attacker uses the borrowed funds to manipulate the price on the DEX that the target protocol reads as its price source, executing a massive swap that moves the reported price by 50% or more. Third, the attacker interacts with the target protocol at the manipulated price, borrowing against artificially inflated collateral or liquidating positions at artificial prices.

The entire sequence happens atomically. If any step fails, the transaction reverts and the attacker loses nothing but gas fees. If it succeeds, the attacker repays the flash loan and keeps the profit.

This is not a theoretical attack vector. Flash loan oracle manipulations have drained hundreds of millions of dollars from DeFi protocols since 2020. The common thread in every case is a protocol that relied on a manipulable on chain price source instead of an external oracle network. Protocols that use Chainlink or equivalent decentralized oracle networks are not vulnerable to this specific attack because the price feed cannot be manipulated within a single transaction.

The lesson is counterintuitive. The most decentralized price source, an on chain DEX pool, is often the least secure for oracle purposes. The most secure price source for DeFi is an off chain oracle network that aggregates prices from centralized exchanges, precisely because those prices are harder to manipulate atomically.

The scale of these attacks has grown with DeFi itself. In October 2022, Mango Markets on Solana lost $114 million to an oracle manipulation exploit. The attacker used relatively modest capital to move the price of the MNGO token on thin DEX pools that Mango used as its price source, then borrowed against the inflated collateral value across every available asset on the platform. The entire operation took less than 20 minutes.

Euler Finance lost $197 million in March 2023 to a similar vector. BonqDAO, Harvest Finance, and dozens of smaller protocols have suffered the same pattern. In nearly every case, post mortem analysis identified the same root cause: the protocol used an on chain price source that could be moved by a single large transaction rather than an oracle network that aggregated prices from multiple independent external sources.

Types of oracles beyond price feeds

The industry focus on price feeds obscures the breadth of what oracles do in practice.

Verifiable randomness. On chain gaming, NFT minting, and lottery contracts need provably fair random numbers. Blockchains are deterministic by design, which means they cannot generate randomness natively. Oracle networks solve this by generating random numbers off chain using verifiable random functions, then publishing the result along with a cryptographic proof that the number was not tampered with.

Cross chain messaging. When a user bridges assets from Ethereum to Arbitrum, an oracle network verifies that the deposit transaction on the source chain was finalized before releasing assets on the destination chain. Chainlink Cross Chain Interoperability Protocol (CCIP) has become the default infrastructure for protocols like Aave handling cross chain operations, processing billions in transfers.

Proof of reserves. Stablecoins and wrapped tokens need to prove that their reserves match their circulating supply. Oracles that monitor custodian wallets and publish reserve balances on chain provide this assurance. Without proof of reserve oracles, users must trust the issuer self reported audits.

Computation oracles. Some operations are too expensive to perform on chain. Oracle networks can execute complex calculations off chain and deliver only the result on chain, along with a proof that the computation was performed correctly. This pattern is increasingly important for applications that need to process large datasets or run machine learning models while settling results on a blockchain.

The proliferation of oracle types reflects a broader shift in how blockchains interact with the real world. Early blockchain applications were self contained. Bitcoin transfers value between addresses on its own ledger. Ethereum executes logic using data stored in its own state. Neither required external information. The demand for oracles emerged only when builders began creating applications that referenced real world conditions: asset prices, event outcomes, identity claims, physical measurements. Each new category of real world reference creates a new category of oracle requirement, and each new oracle requirement creates a new surface area for the oracle problem to manifest.

The Chainlink dominance question

Chainlink position in the oracle market raises a question that the industry prefers not to examine too closely. If the entire point of decentralized finance is to eliminate single points of dependency, what does it mean that approximately 75% of DeFi total value secured relies on one oracle provider?

The defense is that Chainlink itself is decentralized. Its price feeds are generated by dozens of independent node operators, and no single operator can manipulate a feed. The network has processed trillions of dollars in transaction value without a major exploit of its core price feed infrastructure.

The concern is that decentralization within Chainlink does not address the concentration of the oracle layer in a single protocol. If a vulnerability were discovered in Chainlink EntryPoint contracts, or if a regulatory action targeted Chainlink Labs, the impact would cascade across virtually every major DeFi protocol simultaneously.

Competitors exist. Pyth Network, backed by Jump Crypto, focuses on high frequency price feeds from institutional market makers. API3 takes a first party oracle approach, having data providers run their own oracle nodes rather than relying on third party intermediaries. Chronicle, originally built for MakerDAO, provides oracle infrastructure for the largest decentralized stablecoin.

The market has not converged on a multi oracle standard the way it has converged on multi chain deployment. Most protocols use one oracle provider. Whether this concentration is a systemic risk or simply the natural result of network effects and security track record is an open debate with significant implications for DeFi resilience.

What this does not cover

This article does not cover the token economics of oracle networks in detail. LINK, PYTH, and API3 tokens each have different staking, reward, and governance mechanisms that affect oracle security and incentive alignment. Those mechanisms deserve their own analysis.

This article does not address the emerging category of AI oracles, systems that use machine learning models to generate predictions rather than relay observed data. AI oracles introduce a fundamentally different trust model and are at too early a stage for definitive assessment.

This article does not examine the specific smart contract architecture of any oracle network on chain components. The security of an oracle depends partly on its off chain infrastructure and partly on the correctness of its on chain contracts, and auditing those contracts requires a level of technical depth beyond this article scope.

Practical checks before trusting an oracle

Verify the data source count. A price feed aggregating data from 21 independent sources is more robust than one aggregating from three. Most oracle dashboards publish this information. If the protocol you are using does not disclose its oracle data source count, that is a signal.

Check the update frequency. Some oracle feeds update on every block. Others update only when the price deviates by a threshold, typically 0.5% to 1%. A lending protocol using a feed that updates every hour is exposed to rapid price movements that occur between updates. The deviation threshold and heartbeat interval matter for any protocol where liquidation timing is critical.

Confirm the oracle is external, not on chain. If a DeFi protocol derives its prices from its own liquidity pool or from a single DEX, it is vulnerable to flash loan manipulation regardless of how decentralized the underlying blockchain is. External oracle networks that aggregate off chain data are more resistant to this attack vector.

Look for a fallback mechanism. Well designed protocols implement oracle fallbacks. If the primary oracle feed stops updating, the protocol should have a secondary feed or a circuit breaker that pauses operations rather than operating on stale data. Protocols without fallback mechanisms are one oracle outage away from cascading liquidations based on incorrect prices.

Read the oracle incident history. Every major oracle network has experienced outages, delayed updates, or edge case failures. A network that has never experienced an incident is either too new to have been tested or too small to have been targeted. What matters is how incidents were handled and what architectural changes followed.

Disclaimer: This article is for informational and educational purposes only. It does not constitute financial, investment, or legal advice. Cryptocurrency markets are volatile and carry significant risk. Always conduct your own research before making investment decisions. Published August 11, 2026.

Payments infrastructure provider Decta UK says it is bringing USDC into its internal treasury workflow for cross-border settlement—an integration that highlights how stablecoins are increasingly being used behind the scenes, not necessarily as a customer-facing payment option.

According to an announcement shared with Cointelegraph, Decta will route its own funds through OpenPayd, a regulated financial infrastructure provider, where the company converts fiat into USDC for international operational settlements.

Key takeaways

• Decta plans to use USDC as a settlement instrument for its own treasury movements via OpenPayd, rather than placing stablecoins in its customer payment flows.
• The firm described the rationale as improving the timing and flexibility of internal fund transfers compared with traditional banking rails, including weekend and cut-off constraints.
• OpenPayd will perform the fiat-to-USDC conversion using its over-the-counter capabilities inside a regulated infrastructure setup.
• The move fits a broader industry pattern: stablecoins being adopted for internal liquidity and settlement operations by payments and financial firms.

How Decta plans to use USDC

Decta said Tuesday it will use OpenPayd’s infrastructure to convert company funds into USDC for international settlement. OpenPayd’s role is described as “proprietary treasury use” rather than a customer-facing payments feature.

OpenPayd chief commercial officer Lux Thiagarajah told Cointelegraph that Decta transfers its own funds into OpenPayd’s regulated setup, where those funds are converted into USDC through OpenPayd’s over-the-counter capabilities to support international operational settlements.

From Decta’s perspective, the company framed the upgrade as a practical replacement for certain limitations of traditional banking. Decta UK CEO Scott Dawson said the business routinely shifts funds across banking relationships to fund operations and settle obligations between regulated entities and markets. He noted that these transfers typically face banking cut-off times, weekend closures, and multi-day value dates.

Dawson argued that using OpenPayd’s regulated infrastructure allows Decta to convert fiat into a digital settlement instrument and move value “near-instantly” across markets.

Stablecoins migrating from payments to treasury operations

While stablecoins have often been discussed primarily in the context of end-user payments, Decta’s approach underscores a different entry point: internal treasury management. By limiting USDC to its own operational settlement needs, Decta is effectively treating stablecoin settlement as infrastructure—something that can improve liquidity handling without requiring customers to transact with the asset directly.

This distinction matters for adoption. For payments firms, stablecoins can reduce friction when value must move quickly across borders or between affiliated entities, while still allowing the company to maintain a familiar customer experience built on existing rails. In Decta’s case, the company’s statements emphasize that stablecoins are not being introduced into customer-facing payment services, only into its back-end settlement workflow.

It also places stablecoin use closer to how other treasury tools are deployed: as an internal mechanism for moving and managing funds rather than as a retail product.

Companies behind the integration

Decta, founded in 2015 in London, describes itself as a payments platform providing processing, acquiring, card issuing, banking, and related financial infrastructure for businesses. In its announcement, the company said it operates across 32 countries and serves hundreds of companies.

The company has previously explored stablecoin issuance. In August 2024, Decta Limited and Next Generation—described in a related announcement—said they were exploring a potential euro-pegged stablecoin that Decta could issue under the European Union’s MiCA framework, subject to regulatory approval.

OpenPayd, founded in London in 2018, positions itself as financial infrastructure that connects fiat and digital assets. Cointelegraph reported that OpenPayd secured authorization under MiCA in June, enabling it to provide crypto services across the European Economic Area, including fiat-to-stablecoin on- and off-ramps. The company lists clients including Kraken, eToro, OKX, and B2C2.

Why this matters—and what to watch next

Decta’s integration is notable not only because it uses USDC, but because it frames stablecoins as settlement plumbing within regulated payment ecosystems. If the “near-instantly” claim reflects measurable improvements to operational timing, it could encourage other payments firms to follow a similar path—particularly those with multi-entity structures that must manage internal obligations across jurisdictions.

For investors and market participants, the key question is whether this kind of treasury adoption remains confined to back-end settlement or expands toward broader distribution. Decta has indicated the USDC workflow is “proprietary treasury use” rather than a customer-facing flow, but the longer-term signal will come from whether other firms replicate the model and whether stablecoin settlement volumes outside retail activity continue to grow.

Readers should watch for additional details around how widely Decta will roll out the workflow across routes and entities, and whether OpenPayd’s MiCA-enabled infrastructure catalyzes more integrations from established payments players seeking flexibility in cross-border liquidity management.

The SEC Reg Crypto proposal is heading to an Aug. 14, 2026, open meeting, where the U.S. Securities and Exchange Commission will consider whether to issue proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets. The meeting is scheduled for 10 a.m. ET. If approved, the proposed release would begin the formal public-comment process once published.

Sec Schedules Regulation Crypto Assets for Aug 14

The SEC’s Aug. 10 Sunshine Act notice confirms that the Commission will hold an open meeting on Friday, Aug. 14, at 10 a.m. ET. The meeting will take place at the SEC’s headquarters in Washington, D.C., and will also be available through the agency’s webcast.

The official agenda identifies the matter as “Regulation Crypto Assets.” The Commission will consider whether to issue a release proposing new rules to create a tailored offering regime for certain investment contracts involving crypto assets.

The initiative is commonly referred to as “Reg Crypto,” while the SEC’s official agenda uses the title “Regulation Crypto Assets.” The matter falls under the SEC’s Division of Corporation Finance. The agency lists Jim Moloney, Sebastian Gomez Abero, Valian Afshar, Patrick Faller, John Fieldsend and Irene Paik as staff members for the agenda item.

The SEC’s notice does not announce a final rule. It states that the Commission will consider whether to issue a proposal. If approved and issued, the proposal would move into the public-comment and rulemaking process.

The meeting notice was dated Aug. 10, with the open meeting scheduled four days later. The SEC currently has three sitting commissioners, all Republicans. Their votes will determine whether the SEC issues the proposal for public comment.

Reg Crypto Could Create a Pathway for Crypto Fundraising

The proposed framework could address how certain crypto projects raise capital under a tailored offering regime. The framework could give eligible crypto firms a pathway to raise capital for projects without immediately triggering the SEC’s full registration requirements.

That would potentially give qualifying projects a defined route for fundraising in the United States while operating within a framework established by the agency. For crypto founders and fundraising platforms, the potential change could address uncertainty around how certain digital-asset projects structure offerings in the U.S. market.

Regulatory uncertainty has also encouraged some crypto offerings to seek jurisdictions outside the United States. A tailored U.S. framework could provide qualifying projects with another option for raising capital domestically. The precise scope of the fundraising pathway remains unknown because the SEC’s Aug. 10 notice does not specify registration exemptions, eligibility requirements or other detailed conditions.

The framework would not necessarily create a blanket exemption for token issuers or crypto companies. Its impact would depend on the eligibility requirements, disclosures, investor protections and continuing obligations included in the proposed release.

A Potential Exit Mechanism Could Address Continuing SEC Oversight

The framework could also address what happens after a crypto project is no longer actively managed by its development team. A potential mechanism could allow certain projects to seek relief from continuing SEC oversight once their teams are no longer involved in hands-on management.

The precise legal effect and eligibility conditions remain unknown. That would not mean a project automatically leaves the SEC’s jurisdiction simply because its team stops managing it day to day.

Any relief would depend on the legal mechanism and conditions established in the proposed framework, if such a mechanism is included. The SEC’s official notice does not confirm an exit mechanism.

It only states that the Commission will consider proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets. The proposed release will therefore be critical for determining whether an exit pathway is included, which projects could qualify and what conditions would apply.

Aug 14 Would Begin a Longer Rulemaking Process

The Aug. 14 meeting would be the start of a longer process rather than the completion of a new crypto rule. If the Commission approves the proposal and it is published, the public would have an opportunity to submit comments.

The comment period is expected to last roughly two to three months, after which the SEC could review the responses and revise the proposal before considering a final rule. A final rule would generally provide a more formal and durable framework than informal staff statements or speeches, although it could still be challenged, amended or replaced.

The proposed rule would not immediately create binding requirements for crypto businesses. Instead, the proposal would establish the SEC’s intended regulatory approach and give market participants an opportunity to respond before the agency considers whether to adopt a final rule.

The eligibility requirements, disclosure obligations, investor protections, continuing requirements and any potential exit mechanism would therefore need to be assessed from the proposed release itself.

Clarity Act Consideration Moves Into September

The SEC’s planned action comes as Senate consideration of the Digital Asset Market Clarity Act has moved into September after lawmakers did not complete the relevant procedural step before the August recess.

Senate leaders have scheduled a Sept. 15 cloture vote on the motion to proceed to the legislation. That vote would determine whether the Senate can advance to consideration of the bill; it would not constitute final passage.

The CLARITY Act is intended to provide a broader legal foundation for crypto market rules in the United States. The delay leaves the SEC able to pursue rules within its existing authority while Congress considers whether to establish a broader statutory framework.

SEC Chairman Paul Atkins has said the agency can address many crypto market-structure issues through its existing authority. He has also indicated that congressional legislation would provide clearer, longer-term direction than SEC rulemaking alone.

The two regulatory tracks therefore remain important for crypto businesses. A final SEC rule could establish requirements within the agency’s authority, while legislation could provide broader statutory rules governing the U.S. digital-asset market.

SEC’s Crypto Work Extends Beyond the Aug 14 Proposal

The Regulation Crypto Assets proposal is part of the SEC’s wider work on digital-asset regulation. The SEC has issued an interpretation clarifying the application of federal securities laws to certain crypto assets and transactions.

That interpretation includes a taxonomy covering categories such as digital commodities, digital collectibles, digital tools, stablecoins and digital securities. The proposed offering regime would address another part of the regulatory framework by establishing rules for certain investment contracts involving crypto assets.

The distinction between an interpretation and a final rule is significant. The SEC’s interpretation explains how existing federal securities laws apply to specified crypto assets and transactions, while a final rule adopted through rulemaking would establish regulatory requirements within the agency’s authority.

The Aug. 14 meeting therefore represents the beginning of a proposed rulemaking process rather than the completion of the SEC’s crypto regulatory framework.

What Crypto Businesses Should Watch Next

The immediate question is whether the Commission votes to issue the proposed release. If it does, the document will provide the first detailed view of how the SEC intends to structure the tailored offering regime.

Crypto businesses will need to examine which investment contracts qualify, what conditions apply, what disclosures are required and what investor protections are included. The potential fundraising pathway will also require close attention.

Qualifying projects could potentially receive a route to raise capital without immediately triggering full SEC registration requirements, but the actual proposal will determine the scope and conditions of that route. The potential exit mechanism will require similar scrutiny.

For now, the confirmed development is that the SEC will meet on Aug. 14, 2026, to consider whether to issue proposed rules creating a tailored offering regime for certain investment contracts involving crypto assets.

If approved, the proposed release will determine how the fundraising pathway, eligibility requirements, investor protections, continuing obligations and any potential exit mechanism are structured. Until that document is issued, those details should not be treated as final SEC rules.

Node operators who miss the August 11 cutoff will be disconnected from Pi’s mainnet. With 421,000 nodes, a token trading at $0.08, and Binance still refusing to list, the upgrade is a stress test for a project that claims 60 million users but struggles to prove they matter.

Tomorrow morning, more than 421,000 Pi Network node operators face a choice that sounds routine but carries real consequences. Protocol 26, the ninth mandatory upgrade in recent months, must be installed by August 11 or the node loses its connection to Pi’s mainnet. The update itself takes less than five minutes. The question it raises takes longer to answer: what exactly are these nodes securing, and does it matter?

Pi Network occupies a unique position in crypto. It claims more than 60 million registered users, more than 18 million of whom have completed KYC verification. It has more active nodes than most proof of stake networks. It has been running an open mainnet since February 2025. And yet the token trades at eight cents, the largest exchanges will not list it, and the project’s first year on open mainnet produced more questions than answers.

Protocol 26 is worth examining not because the upgrade itself is dramatic, but because it forces a reckoning with the gap between Pi’s infrastructure ambitions and its market reality.

What Protocol 26 actually changes

The upgrade introduces improvements to contract security, state management, and cryptographic capabilities within Pi’s blockchain. The Core Team has described it as part of a sequential upgrade path, with Protocol 27 designated as the final major protocol change before what the team calls full network maturity.

In practical terms, Protocol 26 tightens the rules for how smart contracts interact with the network’s state layer and adds cryptographic primitives that will be required for Protocol 27’s feature set. The internal data migration involved is modest. Most node operators report less than five minutes of downtime during the process.

The mandatory nature of the upgrade is standard for Pi’s governance model. Unlike Bitcoin, where soft forks are backward compatible and nodes can choose whether to adopt new rules, Pi’s upgrade path is centrally coordinated. The Core Team sets deadlines, and nodes that miss them are disconnected. This is closer to how Solana or Aptos manage protocol upgrades than how Bitcoin or Ethereum operate.

This distinction matters. Pi’s consensus mechanism is derived from the Stellar Consensus Protocol, which relies on trust relationships between validators rather than proof of work or economic staking. The network’s 421,000 nodes participate in transaction validation through a trust graph managed by the Core Team’s selection of supernodes. The question of how decentralized this architecture actually is has been a persistent source of scrutiny from external observers.

The exchange listing problem

The most visible failure of Pi’s first 18 months on open mainnet is its absence from the two largest crypto exchanges in the world.

Binance held a community vote in February 2025 in which 86.8% of participants voted in favor of listing PI. The exchange did not act on the result. No public explanation was offered at the time, but reporting from multiple outlets has since identified three concerns: code transparency, the absence of a comprehensive third party security audit, and questions about the degree of centralization in Pi’s validator infrastructure.

Coinbase has been silent. No public statement regarding a PI listing has been made. The exchange’s general listing standards require projects to meet criteria around security, regulatory compliance, and technical architecture that Pi has not publicly shown it satisfies.

The listings that have materialized tell their own story. Kraken listed PI for spot trading in March 2026, making it the first US regulated exchange to do so. OKX opened US access in May. Bitget, MEXC, and several smaller venues also trade PI. But these exchanges collectively represent a fraction of the liquidity that Binance and Coinbase provide. Without the two largest venues, PI’s trading volume remains thin enough that relatively small sell orders can move the price by several percentage points.

The tokenomics pressure

Pi’s price trajectory since open mainnet launch has been a study in supply overwhelming demand. The token reached an all time high of $2.98 on February 26, 2025, the day it became freely tradeable. It now trades at approximately $0.08, a decline of more than 95%.

The supply schedule is the primary driver. Pi has a maximum supply of 100 billion tokens, of which roughly 9% is currently circulating. The remaining tokens unlock over time as users complete KYC verification, claim mining rewards, and exit lock up periods. Approximately 775 million additional PI are expected to unlock by December 2026 as three year lock up periods expire.

This creates a structural problem. Even if demand for PI increases, the incoming supply acts as a persistent headwind. Every month, tens of millions of new tokens enter circulation from users who mined them for free on their phones and have no cost basis. The rational behavior for these holders is to sell at any price above zero, because every token sold is pure profit.

The comparison to traditional token launches is instructive. Most crypto projects that distribute tokens through airdrops or mining programs experience significant sell pressure in the first year. Pi’s distinction is the scale. With 60 million registered users and a supply schedule that stretches over years, the sell pressure is not a spike that clears. It is a constant flow.

The RoboPay question

On August 4, 2026, the Fabric Foundation announced that Pi Network had joined RoboPay as a payment partner. RoboPay is a payment layer designed to let AI agents discover, hire, and pay robots for physical services through on chain transactions. The announcement described Pi’s PiRC2 smart contracts enabling recurring and automated settlements for robotic services.

The announcement deserves careful scrutiny on two fronts.

First, Pi’s Core Team has not confirmed the partnership. The claim comes from Fabric Foundation, not from Pi Network. Community reaction has been mixed, with some members treating it as a significant utility milestone and others noting the absence of official verification. Until the Core Team confirms, the partnership should be treated as unverified.

Second, even if confirmed, the services described are not live. RoboPay is infrastructure for a future in which autonomous robots provide services and receive payment through blockchain transactions. That future may arrive, but it has not arrived yet. A payment integration with a platform that has no live commercial users does not generate demand for PI tokens in the present.

This pattern, announcements of future utility that do not translate into current demand, has characterized much of Pi’s ecosystem development. The project has announced partnerships and integrations at a steady pace, but the gap between announcement and measurable economic activity remains wide.

The 421,000 node question

Pi’s node count is impressive in isolation. More than 421,000 active nodes place it among the largest validator networks in crypto by raw count. The network has processed more than 526 million verification tasks. Node operators run Pi Node software on desktop computers, contributing computational resources to the network’s consensus process.

The question is what these nodes are actually doing. Pi’s consensus mechanism, derived from the Stellar Consensus Protocol, does not require the computational intensity of proof of work or the economic staking of proof of stake. Nodes participate in a trust graph where supernodes, selected by the Core Team, anchor the consensus process. Regular nodes validate transactions within the trust relationships defined by these supernodes.

Critics argue this architecture is closer to a permissioned network than a truly decentralized one. BeInCrypto reported in early 2026 that concerns over supernode selection transparency had grown within the community, with node operators questioning how supernodes are chosen and whether the process concentrates too much authority in the Core Team.

Defenders counter that 421,000 nodes represent genuine geographic distribution and that the trust graph model is a deliberate design choice, not a centralization compromise. The Stellar Consensus Protocol, they note, was designed specifically to avoid the energy costs of proof of work while maintaining Byzantine fault tolerance.

Both arguments have merit. The relevant question for Protocol 26 is whether the upgrade deadline will reveal how many of those 421,000 nodes are actively maintained versus abandoned. If a significant fraction miss the deadline and are disconnected, the effective validator set shrinks, and the network’s claim to broad decentralization weakens.

What Protocol 27 needs to deliver

The Core Team has positioned Protocol 27 as the final major upgrade. It is expected to include expanded smart contract capabilities, DeFi infrastructure, DEX liquidity mechanisms, and the technical foundations for real world merchant payments.

The stakes for Protocol 27 are existential. Pi’s value proposition has always been future oriented: mine now, use later. The network launched with a mobile mining app that required no hardware investment, no electricity cost, and no technical knowledge. Tens of millions of people participated because the implied promise was that PI would eventually become valuable once the network matured and real use cases emerged.

Protocol 26 is the penultimate step. If Protocol 27 ships and the promised capabilities fail to generate meaningful transaction volume, exchange listings, or developer activity, the project will have exhausted its technical roadmap without resolving the fundamental question of whether anyone needs to use the Pi blockchain for anything that existing networks do not already provide.

The case for Pi

Dismissing Pi Network entirely requires ignoring several facts that competitors cannot replicate. No other crypto project has onboarded 60 million users. No other project has 18 million KYC verified participants. No other project has 421,000 nodes running validation software. These are real numbers representing real human participation, even if the economic value generated by that participation remains close to zero.

The bull case rests on a conversion thesis: if even a small fraction of Pi’s user base begins transacting on chain in meaningful ways, the network effects could be significant. A 60 million user network that achieves 1% active daily usage would have 600,000 daily active users, more than most DeFi protocols.

The question is whether Protocol 26 and Protocol 27 can provide the infrastructure necessary for that conversion. The current ecosystem has not produced a breakout application. The token’s price decline has eroded confidence among early adopters. And the exchange listing gap means that new capital cannot easily enter the PI market.

What would change this analysis

A confirmed Binance listing would transform Pi’s outlook overnight. The liquidity, visibility, and credibility that Binance provides would address the most common objection institutional and retail investors cite. Watch for any change in Binance’s public posture or new listing evaluation announcements.

A sharp reduction in token unlock volume, either through extended lock up incentives or a protocol level change to the emission schedule, would reduce sell pressure and allow demand to influence price. The current unlock schedule makes sustained price appreciation arithmetically difficult.

A breakout dApp that generates real transaction volume on the Pi blockchain would validate the network’s technical capabilities and provide a concrete answer to the question of what Pi is for. No such application exists today.

What to watch

Node connectivity after August 11. The number of nodes that successfully upgrade versus those that are disconnected will reveal the health of Pi’s validator community. A drop below 350,000 active nodes would signal significant operator attrition.

Protocol 27 timeline. The Core Team has not announced a firm date. Any delay beyond Q4 2026 extends the period of technical uncertainty and weakens the “final upgrade” narrative.

Binance listing signals. Monitor Binance’s listing evaluation page, community vote results, and any public statements from Binance leadership regarding PI. The absence of signals is itself informative.

Monthly token unlock volumes. Track the pace of new PI entering circulation against trading volume. If unlocks consistently exceed daily volume, sell pressure will continue to suppress price regardless of other developments.

DApp transaction counts. The Pi browser includes access to Pi ecosystem applications. Weekly active user counts and on chain transaction volumes for these applications are the most direct measure of whether the network is generating real utility.

Disclaimer: This article is for informational and educational purposes only. It does not constitute financial, investment, or legal advice. Cryptocurrency markets are volatile and carry significant risk. Always conduct your own research before making investment decisions. Published August 10, 2026.

BTCPay Server supporters have backed a recovery bounty equal to 10% of funds retrieved from a recent Lightning wallet exploit, with the reward capped at 3 BTC if all stolen assets are recovered.

The BTCPay Server project said on Monday that the bounty is part of its response to a critical security flaw that exposed LND administrator credentials on vulnerable installations, days after users were told to immediately upgrade to version 2.4.2.

The open-source Bitcoin payment processor has not disclosed how much cryptocurrency was stolen or how many servers were compromised. However, several affected users, including Foundation and Citadel21, have reported that funds held in their Lightning nodes were drained.

BTCPay said the vulnerability affected all releases before version 2.4.2, including release candidate versions of 2.4.2. The flaw allowed an attacker to obtain LND admin macaroon credentials from exposed BTCPay instances and then access wallets connected to the affected Lightning nodes.

A macaroon works as an authentication credential for a Lightning node, with an administrator macaroon providing extensive permissions over the associated wallet. Access to those credentials can therefore allow an unauthorized party to control funds held through the affected LND setup.

BTCPay Server exploit was fixed in version 2.4.2

Following the discovery, BTCPay released the final version of 2.4.2 with a fix for the vulnerability and urged operators running older versions to update their servers.

The project said the security issue was specific to LND credentials and did not expose users running other Lightning implementations through the same attack route. Operators who do not use Lightning were also not affected by the LND credential issue, although BTCPay recommended that all users install the latest release.

BTCPay’s onchain wallets were not compromised through the vulnerability, including onchain hot wallets maintained by users of the software, according to the project.

The distinction limits the known attack path to connected LND wallets rather than the full range of Bitcoin funds that can be managed through a BTCPay installation.

Although BTCPay has yet to release figures for the losses, reports from individual users have confirmed that the exploit resulted in stolen funds. The project is preparing a full postmortem that is expected to provide more information about the vulnerability and the response.

BTCPay has also started introducing stronger code-scanning and review procedures with assistance from several external organizations.

The response follows a difficult year for crypto security. In April,crypto.news reported that CertiK had recorded more than $600 million in crypto losses during 2026 at the time, while the security firm warned that AI-assisted attacks and weaknesses in infrastructure were becoming important risks for projects.

Researchers receive 0.42 BTC for finding the flaw

Alongside the recovery bounty, the BTCPay Server Foundation is paying rewards to the researchers who identified the vulnerability before it was publicly disclosed.

The foundation is donating 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund. Raw discovered the security issue and privately reported it to BTCPay, allowing developers to prepare a fix before details of the flaw became public.

Raw later said he had also been affected by the exploit.

Bitcoin Red Team operates as a volunteer security research group whose members include Rob Hamilton, Calle and Evan Kaloudis. The group works on finding and reporting vulnerabilities affecting Bitcoin-related software.

BTCPay’s decision to fund both researchers comes alongside the separate recovery bounty backed by project supporters. Under the proposed terms, 10% of successfully recovered funds can be paid as a bounty, while a complete recovery would carry a maximum reward of 3 BTC.

Recovery incentives have also surfaced after other crypto exploits this year. In July, crypto.news examined efforts to recover roughly 16 million ADA taken from 374 Cardano wallets in a late-June exploit. EMURGO outlined a process to return affected assets while an independent forensic team conducted a separate investigation into the incident.

AI may have helped uncover the BTCPay Server exploit

As part of its initial assessment, BTCPay raised the possibility that artificial intelligence tools could have played a role in finding the vulnerable code.

The project said improving AI models have reduced the time and cost required to inspect large software repositories for weaknesses, changing the capabilities available to both attackers and security researchers.

Bitcoin software presents an attractive target because exploitable weaknesses can provide direct access to assets, BTCPay said, adding that other areas of the software industry could eventually face similar problems as AI-based code analysis becomes more capable.

Concerns over AI-assisted attacks had already surfaced elsewhere in the crypto sector. CertiK reported in June that crypto hacks and exploits caused $68.3 million in losses during May, down nearly 90% from roughly $650 million in April, but the firm also recorded an increase in AI-assisted malware targeting code repositories and coding tools, as previously covered by crypto.news.

A July analysis of AI security also examined how increasingly capable models can identify and exploit software vulnerabilities, with the technology arriving during a year already dominated by large crypto security incidents.

The BTCPay incident differs from attacks based primarily on social engineering or compromised signing devices because the entry point was a software vulnerability that exposed sensitive LND authentication credentials.

Coldcard exploit raised similar AI concerns

The BTCPay attack has followed another major Bitcoin security incident involving Coldcard hardware wallets, where the suspected use of AI to inspect older code was also raised after funds were stolen.

At least $116 million in losses have been confirmed from the Coldcard exploit so far. Coinkite, the company behind Coldcard, said it considered it likely that someone had used AI to examine older publicly available firmware and identify the weakness.

The two incidents have put code review under increased attention at a time when attackers have already moved beyond conventional smart contract vulnerabilities.

In April, crypto.news reported on more than $17 billion lost across 518 documented crypto hacks and exploits over the previous decade, citing DefiLlama data. The report found that private key leaks, credential theft, phishing and attacks against wallets and infrastructure had become major sources of losses alongside flaws in smart contracts.

Chainalysis has separately estimated that attackers stole $36.7 million from unverified, closed-source smart contracts during the first six months of 2026 by decompiling contract bytecode. The blockchain analytics firm assessed that AI was very likely involved in this activity.

For BTCPay users, the immediate remediation remains the official 2.4.2 release. The project has said it will publish a more detailed postmortem on the exploit while its new code-scanning and review procedures are being developed with external organizations.

Easing concerns over the situation in the Strait of Hormuz provided support for risk-sensitive assets. On 8 August, the Iranian side reported progress in talks with Oman over a possible new route through the strait, although the implementation of any agreement remains dependent on additional conditions. Reduced concerns over potential disruptions to energy supplies helped improve investor sentiment, although uncertainty surrounding the region continues to create the potential for increased volatility.

Technical Analysis of Ethereum

The ETH/USD technical picture shows that after peaking around $1,975 in late July, the price formed a pattern resembling a contracting triangle. The breakout occurred on 10 August, when a large red candle broke below both the triangle’s lower boundary and the lower boundary of the current market profile at $1,894, creating the conditions for a downside move out of the pattern. As a result, the price moved into the zone between the lower profile boundary and the green support level at $1,854. Continued selling pressure could pave the way for a test of this area.

If the trend reverses and the price returns to the profile range, market participants should focus on the area comprising the POC at $1,915 and the upper profile boundary at $1,925. Above these levels lies the red resistance level at $1,942. It is also worth noting that the breakout was accompanied by an increase in volume, indicating stronger selling activity at that point. Following the decline, the RSI + MAs indicator shows readings of 32, 52 and 53. The oscillator has moved out of the neutral zone, while the moving averages remain some distance from crossing below its lower boundary.

Summary

Geopolitical developments surrounding the Strait of Hormuz remain one of the key factors influencing sentiment across the cryptocurrency market, while the breakout from the contracting triangle on 10 August pointed to increased selling pressure in the short term. Ethereum’s further performance will depend on how the market responds to the latest news flow.

FXOpen offers the world’s most popular cryptocurrency CFDs*, including Bitcoin and Ethereum. Floating spreads, 1:2 leverage — at your service (additional fees may apply). Open your trading account now or learn more about crypto CFD trading with FXOpen.

*Important: At FXOpen UK, Cryptocurrency trading via CFDs is only available to our Professional clients. They are not available for trading by Retail clients. To find out more information about how this may affect you, please get in touch with our team.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

Ravencoin disclosed on Aug. 11 that a critical consensus vulnerability had been exploited since Aug. 7, allowing vulnerable nodes to accept invalid blocks beginning at height 4,487,776. 

The project warned in its notice that a recovery chain being mined by 2Miners and RavenMiner could trigger a deep reorganization spanning “approximately three days” if it becomes dominant.

The alert followed an emergency software release from 2Miners on Aug. 10. The pool said the flaw sits in KAWPOW block header validation and allows an attacker to bypass the normal memory intensive mining process. Ravencoin advised exchanges to halt RVN deposits and withdrawals and told users to treat confirmations after block 4,487,775 as potentially reversible.

Ravencoin bug allowed cheap invalid blocks

2Miners said the KAWPOW header contains an nHeight field that was not checked against a block’s actual position in the chain. By manipulating that value, an attacker could reach a validation path that skipped full proof of work verification and accepted a supplied mix hash without confirming genuine ProgPoW work.

The emergency release said blocks created through the flaw carried no genuine ProgPoW work and were “orders of magnitude cheaper” to produce than honest blocks at the same difficulty. It also documented two effects seen on mainnet: affected nodes could fail after restarting, while nodes attempting to synchronize could encounter broken header sequences and fail to catch up.

2Miners said exploitation continued from Aug. 7 through its Aug. 10 release. Between heights 4,489,527 and 4,491,615, it identified 96 affected blocks among 2,089 examined. A separate sample covering the period before Aug. 7 found no affected blocks, supporting the identified starting point.

2Miners ships emergency patch as recovery continues

2Miners released version 4.6.1.1-hf1, which rejects blocks whose declared header height differs from their actual chain position starting at 4,487,776. The patch also adds a checkpoint at 4,487,775 and rebuilds chain state when damaged index data prevents a node from continuing normally.

The pool said node operators, exchanges, miners and explorers should upgrade. Its release warns that the first restart can take several hours because the software replays about 4.49 million blocks and 28 million transactions while rebuilding chain state. Operators running several nodes were advised to upgrade them individually.

Ravencoin’s official GitHub notes separately said there was not yet a core version patching both the KAWPOW problem and a different asset transfer quantity overflow bug. Maintainer Hans Schmidt recommended using the 2Miners code for the mining problem until a combined patch becomes available.

Exchanges halt transfers as RVN falls 19%

Upbit suspended Ravencoin deposits and withdrawals on Aug. 10, citing a network issue, before the project’s broader warning. Its notice leaves trading available while transfers remain halted. Bitget also suspended RVN deposits and withdrawals for wallet maintenance beginning Aug. 10.

CoinGecko data showed RVN trading near $0.00288 on Tuesday, down about 19.1% over 24 hours. Its market capitalization had fallen to roughly $47.3 million while 24 hour trading volume approached $11 million.

Ravencoin has experienced a different protocol vulnerability before. In 2020, attackers exploited a flaw to create about 315 million unauthorized RVN, as crypto.news reported in earlier Ravencoin exploit coverage. The earlier incident involved excess token issuance, while the current vulnerability concerns proof of work validation and competing chain histories.

In related block reorganization coverage, an 18 block Monero reorg in 2025 invalidated previously confirmed transactions. The episode illustrates why exchanges often become cautious about transaction finality when proof of work networks develop competing histories.

What happens next for the Ravencoin chain

Ravencoin said 2Miners and RavenMiner controlled a majority of network hash rate and were mining from the last unaffected block while excluding the exploited branch. The project cautioned that if their chain becomes dominant, transactions confirmed after 4,487,775 may disappear from the accepted history. Some could return to mempools and be mined again, but Ravencoin said this is “not guaranteed.”

The next milestones are a stable dominant chain, wider adoption of patched software and a combined upstream Ravencoin release. Until then, the project’s guidance remains for exchanges to suspend transfers and for users not to rely on recent confirmations. Ravencoin also stressed that its warning should not be interpreted as support for a rollback or any particular recovery plan.