The exchange filed a civil lawsuit in a US federal court against North Korea, its intelligence agency, and the Lazarus Group over the $1.5 billion hack of February 2025. A judge has already frozen stolen assets. The case tests whether civil law can do what criminal enforcement has not.

On August 7, 2026, Bybit announced it had filed a civil lawsuit in the US District Court for the District of Columbia against the Democratic People’s Republic of Korea, its Reconnaissance General Bureau intelligence agency, and the Lazarus Group. The complaint concerns the February 21, 2025, breach that drained more than 400,000 Ether and staked Ether from the Dubai based exchange, an incident valued at approximately $1.5 billion at the time and still the largest recorded cryptocurrency theft.

The filing is unusual in almost every dimension. A private company is suing a sovereign nation in a US court. The defendants include a state intelligence agency and a hacking group that operates under its direction. The stolen assets have been laundered across thousands of wallets, converted between blockchains, and run through mixing services designed to break the transaction trail. And yet a federal judge granted a preliminary injunction, meaning a court has already determined that there is enough evidence and legal basis to freeze identifiable stolen assets while the case proceeds.

The question is not whether the lawsuit is symbolically important. It clearly is. The question is whether it can produce a practical outcome: the recovery of stolen funds, the creation of legal precedent for future cases, or both. The case arrives at a moment when the crypto industry is searching for institutional tools to complement its technical defenses. Blockchain tracing, exchange cooperation, and bug bounties have been the primary recovery mechanisms after major hacks. A civil lawsuit backed by a federal court order introduces a legal instrument that has not been widely tested in the crypto context but has deep precedent in traditional asset recovery litigation.

What the lawsuit actually claims

The complaint names three defendants. The Democratic People’s Republic of Korea is named as a sovereign state that directed the theft through its intelligence apparatus. The Reconnaissance General Bureau, North Korea’s primary foreign intelligence organization, is named as the agency that oversaw the operation. The Lazarus Group is named as the threat actor that carried out the technical execution.

The case is filed under theories of civil liability that do not require the defendants to appear in court. Bybit is pursuing the claim through the legal mechanisms available against sovereign states and their agents when those states are accused of sponsoring acts that cause financial harm to private parties. The Foreign Sovereign Immunities Act typically shields foreign governments from lawsuits in US courts, but exceptions exist for state sponsored terrorism and certain commercial activities.

Alongside the complaint, Bybit secured a preliminary injunction targeting John Doe defendants, unidentified individuals and entities that hold assets traced to the theft. The injunction bars them from transferring, selling, or otherwise disposing of the identified assets. A preliminary injunction is not a final ruling. It preserves property during litigation. But securing one requires demonstrating to a judge that the plaintiff is likely to succeed on the merits and that the assets would be at risk of dissipation without the order.

Bybit CEO Ben Zhou framed the filing in terms that emphasized accountability over financial recovery. “Our focus has never changed: protect our users first, recover what we can, and make sure the people behind these attacks are held accountable,” Zhou said in a statement.

How the February 2025 hack unfolded

The breach occurred on February 21, 2025, when attackers compromised Bybit’s security infrastructure and drained more than 400,000 ETH and stETH from the exchange. The assets were valued at approximately $1.5 billion at the time, making it the single largest cryptocurrency theft ever recorded.

The FBI attributed the attack to North Korean actors within days. The bureau identified the perpetrators under the operational name TraderTraitor and urged exchanges, validators, and blockchain firms to block transactions connected to addresses identified in the laundering operation. The speed of the attribution was notable. US intelligence agencies had been tracking Lazarus Group operations for years, and the on chain signatures of the attack matched patterns from previous North Korean campaigns.

The attackers moved quickly to launder the stolen funds. Within the first week, a significant portion of the ETH was converted to Bitcoin through cross chain bridges. The Bitcoin was then dispersed across thousands of wallets in a pattern designed to overwhelm tracing tools. By March 2025, Bybit’s CEO reported that 88.87 percent of the stolen funds remained traceable, while 7.59 percent had gone dark through crypto mixers and 3.54 percent had been frozen.

The legal architecture of the complaint reflects a calculated strategy for navigating the unusual challenge of suing a sovereign nation and its intelligence apparatus. By filing in the District of Columbia, Bybit places the case in a jurisdiction where federal courts routinely handle matters involving foreign states and international sanctions. The FSIA exception for state sponsored terrorism is well established in this courthouse, with decades of precedent from cases against Iran, Syria, and Libya providing a roadmap for how plaintiffs can pursue claims against sovereign defendants who refuse to appear. The preliminary injunction freezing stolen assets demonstrates that the court is willing to exercise jurisdiction and issue enforceable orders even before the defendants respond, which in a case against North Korea may never happen.

The traceable share declined over the following months. By April 2025, Zhou disclosed that 27.6 percent of the stolen funds could no longer be tracked. The attackers used a combination of cross chain protocols, mixing services, and decentralized exchanges to obscure the trail. Each hop between chains and each pass through a mixer made the remaining funds harder to follow.

Bybit covered the immediate shortfall through ETH purchases, loans, and deposits from industry counterparties. The exchange continued processing customer withdrawals throughout the crisis, avoiding the liquidity collapse that has followed other major exchange hacks. The operational response was widely credited as one of the more effective post hack recoveries in the industry’s history.

The scale of the laundering operation reveals the sophistication of the North Korean apparatus. The attackers did not simply send the stolen ETH to a single mixer and wait. They ran a multi-stage pipeline. First, the ETH was swapped for other tokens through decentralized exchanges to break the direct link to the Bybit wallets. Then the tokens were bridged to other chains, primarily Bitcoin, through cross chain protocols. The Bitcoin was then split across thousands of newly created wallets in a pattern called “peel chain” laundering, where each wallet sends a small portion to a destination and forwards the remainder to the next wallet in the chain. Each stage added a layer of obfuscation, and the entire process was automated using scripts that executed faster than human analysts could follow in real time.

Why a civil lawsuit and why now

The timing of the filing raises an obvious question: why wait 18 months? The answer involves both legal strategy and the evolution of the available evidence.

Criminal investigations into the hack are ongoing. US law enforcement agencies, including the FBI, are pursuing their own cases against the North Korean actors. Bybit’s civil lawsuit is explicitly separate from those criminal proceedings. The exchange is not dependent on prosecutors’ timelines or priorities.

The laundering infrastructure that the Lazarus Group employed after the Bybit breach illustrates how state backed hackers have professionalized their operations to exploit the structural gaps in cryptocurrency compliance. Within hours of the theft, the stolen Ether moved through a cascade of intermediary wallets designed to break the chain of provenance. The funds then flowed through decentralized exchanges, cross chain bridges, and mixing services that do not perform know your customer checks. By the time law enforcement agencies began coordinating their response, a significant portion of the stolen assets had already been converted into bitcoin and routed through additional obfuscation layers. This rapid dispersal is a signature of North Korean crypto operations, refined through years of practice across multiple high profile thefts.

A civil lawsuit offers several advantages that criminal prosecution does not. First, the burden of proof is lower. Criminal cases require proof beyond a reasonable doubt. Civil cases require a preponderance of the evidence. Second, a civil plaintiff controls its own case. Bybit can pursue recovery on its own schedule rather than waiting for a criminal prosecution that may take years to culminate in a judgment.

Third, and most practically, a civil lawsuit with a preliminary injunction gives Bybit a legal instrument that exchanges and custodians must respect. When Bybit identifies stolen funds on a platform, it can now point to a court order rather than relying on voluntary cooperation. Exchanges that refuse to freeze assets covered by a federal court order face legal exposure of their own.

The 18 month gap also allowed the blockchain tracing to mature. The initial weeks after a major hack are chaotic. Funds move rapidly across chains and through mixers. Over time, some of that movement stops. Funds sit in wallets. They end up on exchanges where withdrawal requires interaction with regulated entities. The preliminary injunction targets those resting points, the wallets and accounts where traceable stolen funds currently sit.

Can you actually sue North Korea and collect

This is the question that makes the case unusual. Suing a sovereign nation in a foreign court is not standard practice, and collecting a judgment against a country that does not participate in the international financial system presents obvious challenges.

The legal framework for suing foreign governments in US courts is governed by the Foreign Sovereign Immunities Act. Under normal circumstances, foreign states are immune from suit in US courts. But exceptions exist. The terrorism exception, added after the 1996 amendments, allows claims against states designated as sponsors of terrorism. North Korea has been on the State Department’s state sponsor of terrorism list since 2017.

Whether the cryptocurrency theft qualifies under the terrorism exception is a legal question that the court will need to address. Previous cases under this exception have involved acts of physical violence, hostage taking, and material support for terrorist organizations. A cryptocurrency hack committed for financial gain rather than political violence may test the boundaries of the statute.

Even if Bybit obtains a default judgment (North Korea is unlikely to send lawyers to defend the case), collecting on that judgment against a state that operates outside the conventional financial system is a separate challenge. The practical value of the lawsuit lies not in extracting payment from Pyongyang but in the ancillary effects: the preliminary injunction that freezes assets, the legal precedent that future victims can cite, and the signal to exchanges and custodians that frozen assets have a court order behind them.

The John Doe component of the lawsuit is potentially more actionable. If the identities of individuals or entities holding the stolen funds are discovered during the litigation, they can be added to the case and subjected to enforcement actions. Unlike North Korea itself, individuals who hold stolen crypto and fail to comply with a federal court order face consequences that can be enforced.

The broader pattern of North Korean crypto theft

The Bybit hack was not an isolated incident. It was the largest single event in a sustained campaign of cryptocurrency theft that US intelligence agencies attribute to the North Korean state.

North Korean groups stole an estimated $2.02 billion in cryptocurrency during 2025, according to Chainalysis data. The Bybit attack accounted for most of that total. Cumulatively, North Korea linked groups have stolen approximately $6.75 billion in digital assets across multiple years of operations.

The threat continued into 2026. In April, Lazarus linked attacks allegedly drained $577 million from Drift Protocol and KelpDAO in two separate incidents. The attacks used different technical methods but shared the same operational playbook: identify a vulnerability in a DeFi protocol or exchange, exploit it rapidly, and move the stolen funds through a pre planned laundering chain that crosses multiple blockchains within hours.

The scale of the theft has geopolitical implications. US and South Korean intelligence agencies have assessed that North Korea channels crypto theft proceeds into its weapons programs, including nuclear and missile development. This assessment is one reason the FBI attributed the Bybit attack so quickly and why US authorities have been unusually active in coordinating with exchanges to freeze funds. The scale of the February 2025 breach, exceeding all prior incidents by a factor of three, forced the industry to confront the inadequacy of its existing response mechanisms and consider whether civil litigation might fill the enforcement gap that criminal prosecution has left open.

For the crypto industry, the North Korean threat has become a baseline security assumption rather than an exceptional risk. Exchanges, DeFi protocols, and bridge operators now design their security models with state sponsored attackers as a primary threat scenario. The Bybit lawsuit adds a legal dimension to what has primarily been a technical and operational response.

The pattern of North Korean attacks also reveals a preference for targeting infrastructure points where large amounts of value are concentrated in a single signing operation. The Bybit attack compromised the process by which the exchange moved funds between cold and warm wallets. The Ronin bridge attack targeted the validator set that controlled cross chain transfers. In both cases, the attackers identified the moment when a single compromised action could move the maximum amount of value. This targeting pattern has forced exchanges to rethink how they structure high value transactions, adding multi party computation, hardware security modules, and time delayed execution to what were previously routine operations.

What the case means for future hack recoveries

The Bybit lawsuit could create a template for how exchanges and other victims pursue stolen funds through civil courts. Previous major hacks, including the Ronin bridge theft in 2022 and the Wormhole exploit in the same year, relied primarily on law enforcement cooperation, voluntary freezes by industry participants, and bounty programs.

A civil lawsuit with a preliminary injunction adds a layer that voluntary cooperation cannot provide: compulsion. When a court orders assets frozen, the custodian holding them has a legal obligation to comply. The order converts a request into a requirement, and non compliance carries legal consequences.

The dual track approach, civil and criminal running simultaneously, also matters. Criminal cases move on prosecutors’ timelines and serve public enforcement objectives. Civil cases move on the plaintiff’s timeline and serve the plaintiff’s recovery objectives. When both tracks operate in parallel, the stolen funds face pressure from multiple legal directions.

For smaller victims who lack Bybit’s resources, the precedent matters more than the specific case. If the lawsuit succeeds in freezing and eventually recovering stolen assets, it creates a roadmap that other victims can follow. If it produces published court opinions on the jurisdictional and immunity questions, those opinions become tools that future plaintiffs can use to streamline their own cases.

The case also tests the crypto industry’s willingness to cooperate with civil court orders. Exchanges that receive freeze requests backed by a federal court injunction face a different calculus than exchanges that receive informal requests from a hack victim. The legal formalization of the recovery process could accelerate compliance across the exchange ecosystem.

There is also a deterrence argument, though its force against a state actor is debatable. Most criminal hackers weigh the expected profit against the expected penalty. For a state intelligence agency that channels theft proceeds into weapons programs, the calculus is different. But the lawsuit creates costs at the laundering stage. Every exchange that freezes assets in response to the court order reduces the amount that reaches its intended destination. If the civil lawsuit makes laundering 5 or 10 percent harder, that translates to hundreds of millions of dollars in stolen value that cannot be converted to cash. Over multiple operations, incremental friction at the laundering stage compounds into a meaningful reduction in the program’s effectiveness.

What to watch

Compliance with the preliminary injunction. The order is only as effective as the willingness of custodians and exchanges to enforce it. Watch for reports of exchanges freezing funds in response to the order, or for disputes where custodians challenge the scope of the injunction.

Additional defendants added to the case. The John Doe structure allows Bybit to add identified individuals and entities as discovery progresses. If blockchain tracing leads to specific custodians, exchanges, or OTC desks that processed stolen funds, they could become parties to the lawsuit.

North Korea’s response or non response. Sovereign defendants in US courts typically either invoke immunity and challenge jurisdiction or simply ignore the proceedings. North Korea’s approach will determine whether the case proceeds by default judgment or through contested litigation on the jurisdictional questions.

Recovery rate compared to criminal track. Bybit has been working with law enforcement since February 2025. The civil lawsuit now runs in parallel. Comparing the amounts recovered through each track will indicate whether civil litigation adds meaningful recovery capacity beyond what criminal enforcement achieves alone.

Follow on lawsuits from other hack victims. If the Bybit case survives jurisdictional challenges and produces asset recovery, other victims of state sponsored hacks may file similar civil complaints. Watch for cases from victims of the Drift Protocol and KelpDAO attacks, which are also attributed to Lazarus Group.

International coordination on asset freezing. The US court order applies to entities within US jurisdiction, but stolen crypto moves globally. Watch for parallel legal actions in jurisdictions like Singapore, the UK, and the EU, where exchanges and custodians may hold portions of the laundered funds. A coordinated multi-jurisdictional freeze would be significantly more effective than a single country order.

North Korean adaptation to the legal pressure. State sponsored hacking groups adapt their laundering techniques in response to enforcement actions. If the civil lawsuit makes conventional exchange-based laundering more difficult, the attackers may shift to peer-to-peer trading, decentralized exchanges without KYC, or privacy chains. The speed and nature of this adaptation will indicate how much friction the legal approach creates.

Frequently asked questions

The largest crypto liquidity provider registered with FINRA on August 6. The move signals something larger than one firm’s expansion: the infrastructure that runs crypto markets is migrating onto Wall Street rails.

On August 6, 2026, Wintermute announced that its affiliate Wintermute USA LLC had registered as a broker dealer with the Securities and Exchange Commission and joined the Financial Industry Regulatory Authority. The registration allows the firm to trade traditional equities and equity options, act as an authorized participant for exchange traded products including crypto ETPs, and self clear digital asset securities transactions. The filing is narrow in scope. The implications are not.

Wintermute is not the first crypto firm to obtain a broker dealer license. Crypto.com acquired Watchdog Capital in 2024. Coinbase has held a broker dealer registration through its institutional arm for years. But Wintermute’s registration is different in kind because Wintermute is not an exchange or a consumer platform. It is a market maker. Its business is providing liquidity, and its advantage is speed, capital efficiency, and infrastructure that operates across dozens of venues simultaneously. Bringing that infrastructure inside the regulatory perimeter of U.S. securities law is not an incremental compliance exercise. It is a positioning move for a market structure that does not fully exist yet but is being built in pieces.

What the registration actually allows

Wintermute USA LLC’s broker dealer registration covers three specific activities, each with distinct strategic significance.

First, the firm can trade traditional equities and equity options on U.S. national securities exchanges. This means Wintermute’s algorithmic trading infrastructure, built to provide liquidity on crypto exchanges, can now operate on the NYSE, Nasdaq, and options exchanges. The technology is different in implementation but similar in concept: market making is the business of quoting bid and ask prices, managing inventory, and profiting from the spread. Wintermute has been doing this on Binance, Coinbase, Uniswap, and over 60 other venues. Doing it on the NYSE is an extension of the same capability into a regulated venue with stricter rules but more stable counterparties.

Second, the firm can act as an authorized participant for exchange traded products. An AP is one of a limited number of entities that can create and redeem ETF shares directly with the fund issuer. When a Bitcoin ETF’s market price rises above its net asset value, APs create new shares by delivering bitcoin to the fund and selling the newly created shares on the exchange, pushing the price back down. When the market price falls below NAV, APs redeem shares for bitcoin and sell the bitcoin, pushing the ETF price back up. This arbitrage mechanism is what keeps ETFs trading near their fair value.

Being an AP for crypto ETPs is strategically valuable because it places Wintermute at the intersection of crypto spot markets, where it already operates, and the regulated ETF market, where institutional capital flows. The firm can now arbitrage between the two markets from a single balance sheet, capturing the spread that exists when ETF prices deviate from spot. The AP role also gives Wintermute visibility into real time ETF demand patterns, which provides information about institutional positioning that is not available through crypto exchange order books alone. This information asymmetry, while legal and standard among APs, is one of the competitive advantages that makes the registration valuable beyond the direct revenue it generates.

Third, the firm can self clear digital asset securities transactions. Self clearing means Wintermute does not need to route its trades through an external clearing firm, reducing costs and operational dependencies. For a proprietary trading firm that may eventually trade tokenized securities, self clearing is a prerequisite for efficient settlement.

The broader pattern: crypto firms buying Wall Street licenses

Wintermute’s registration is part of a pattern that has accelerated since 2024. Crypto native firms are systematically acquiring or building the regulatory infrastructure needed to operate in traditional markets, rather than waiting for traditional firms to build crypto capabilities.

Crypto.com acquired Watchdog Capital, an SEC registered broker dealer, in 2024. The acquisition gave Crypto.com the ability to offer securities trading to its users and to participate in the regulated securities market. In March 2026, the SEC approved a Nasdaq rule change that enables tokenized share trading on the exchange, creating a new venue where digital representations of traditional securities can trade alongside their conventional counterparts.

These moves reflect a strategic calculation. The firms that can provide liquidity across both crypto and traditional venues will have a structural advantage as the boundary between the two markets blurs. Tokenized equities, which represent ownership of traditional stocks on a blockchain, already trade on platforms like Kraken’s xStocks. As regulatory frameworks like the CLARITY Act define the rules for digital assets, the infrastructure for trading tokenized securities will need market makers who understand both the crypto settlement layer and the traditional securities regulatory framework.

Wintermute’s CEO, Evgeny Gaevoy, framed the registration in these terms: “Digital assets and traditional finance will continue to develop in parallel, intersect in new ways, and ultimately integrate more deeply. As the landscape evolves, the firms that succeed will be those that have technical and operational know how to operate in both.”

Why market makers matter more than exchanges

The public conversation about crypto’s integration with traditional finance has focused on exchanges: Coinbase’s IPO, Robinhood’s crypto trading, Kraken’s xStocks. But exchanges are marketplaces. They set the rules and collect the tolls. Market makers are the firms that actually provide the liquidity that makes trading possible.

On a crypto exchange, when you submit a buy order and it fills instantly, it fills because a market maker had a sell order sitting at that price. The market maker does not care about the direction of the trade. It makes money by buying at the bid price and selling at the ask price, capturing the spread between the two. The spread is narrow because multiple market makers compete for order flow.

Wintermute’s advantage in crypto is infrastructure. The firm’s systems can quote prices across 60 plus venues simultaneously, manage inventory across chains and exchanges, and adjust prices in milliseconds as market conditions change. This infrastructure is expensive to build and difficult to replicate, which is why the market making business is concentrated among a handful of firms: Wintermute, Jump Crypto (now Jump Trading), Cumberland DRW, and a few others.

Bringing this infrastructure to traditional equities is a competitive move against incumbent market makers like Citadel Securities, Virtu Financial, and Susquehanna. These firms dominate equities market making but have been slower to build crypto native capabilities. Wintermute is approaching from the other direction: it has the crypto infrastructure and is now adding the equities license.

The competitive dynamics are unclear. Traditional market makers have decades of experience with SEC regulations, exchange connectivity, and risk management frameworks that crypto firms lack. Wintermute has speed and cross venue capabilities that traditional firms are still building. The winner will likely be determined not by which side is better at its home game but by which side adapts faster to the integrated market that is emerging.

The cross venue advantage extends beyond simple price comparison. When Wintermute quotes a bid price on Coinbase and an ask price on Binance, it is effectively creating a private bridge between two liquidity pools that do not otherwise interact. This bridging function reduces fragmentation across the crypto market, which is structurally more fragmented than equities because it operates across hundreds of independent venues with no centralized national best bid and offer (NBBO) system. In traditional equities, the NBBO requires all exchanges to route orders to the venue displaying the best price. In crypto, no such requirement exists. Market makers like Wintermute serve as informal NBBO providers, arbitraging price differences across venues and in the process making prices more consistent for all traders. Extending this capability to equities gives Wintermute a perspective on market microstructure that spans both regulated and unregulated venues, an informational advantage that no purely traditional or purely crypto market maker currently possesses.

There is also a personnel dimension. Wintermute has been hiring compliance and operations staff with traditional finance backgrounds throughout 2025 and 2026. Building a broker dealer is not just a licensing exercise; it requires risk officers, compliance surveillance systems, trade reporting infrastructure, and relationships with clearing houses. The firm’s ability to recruit people who know these systems while retaining the engineers who built its crypto infrastructure will determine whether it can operate effectively across both worlds or becomes bogged down trying to manage two distinct operational cultures under one roof.

The capital requirements are also worth noting. Broker dealers must maintain minimum net capital under SEC Rule 15c3-1. For a proprietary trading firm, the requirement scales with the size and risk profile of its positions. Wintermute’s existing capital base, built from years of profitable crypto market making, gives it a head start. But operating in equities means deploying capital into markets where the competition is better capitalized, the margins are thinner, and the regulatory penalties for errors are steeper. The firm is entering a game where the incumbents have been playing for decades.

The personnel challenge is compounded by compensation dynamics. Traditional finance compliance officers and risk managers command high salaries, and they typically expect the stability and predictability of established financial institutions. Convincing these professionals to join a firm whose primary revenue comes from crypto market making requires both competitive pay and a credible narrative about the firm’s long term trajectory. Wintermute’s registration provides that narrative, but retaining traditional finance hires through the inevitable volatility of crypto revenue cycles will test the firm’s organizational culture in ways that a regulatory filing alone cannot address.

The AP arbitrage opportunity

The authorized participant role for crypto ETPs is arguably the most immediately valuable component of Wintermute’s registration. Bitcoin and Ethereum ETFs hold billions of dollars in assets, and the AP mechanism is the primary tool for keeping those ETFs trading at prices that reflect their underlying holdings.

When Bitcoin’s price moves sharply, the ETF price and the spot price can diverge temporarily. APs profit from closing this gap. If the ETF trades at a 0.5 percent premium to spot, an AP can buy bitcoin at spot, deliver it to the ETF issuer to create new shares, and sell those shares at the premium. The profit is the 0.5 percent spread minus transaction costs.

For Wintermute, this trade is especially attractive because the firm already holds bitcoin and ETH inventory across dozens of venues. It can source the underlying asset at the best available price across its venue network and deliver it to the ETF issuer at a lower effective cost than an AP that trades only on one or two exchanges. The cross venue sourcing advantage is the same edge that makes Wintermute effective in crypto market making, applied to a new product.

The creation and redemption process also introduces a timing dimension that favors firms with existing crypto market infrastructure. When an AP creates new ETF shares, it must deliver the underlying asset, whether bitcoin or ether, to the fund custodian within a specified settlement window. Sourcing that asset quickly and at a predictable price requires access to deep liquidity pools across multiple venues. A market maker that already maintains inventory on dozens of exchanges can fill this requirement faster and at a lower cost than an AP that must first purchase the asset on a single exchange and then transfer it to the custodian. The settlement timing advantage compounds during periods of high volatility, when ETF premiums and discounts are widest and the arbitrage opportunity is most profitable. During the March 2025 bitcoin correction, for example, Bitcoin ETF discounts briefly exceeded 1.5 percent, creating an arbitrage window that APs with fast crypto settlement infrastructure could exploit within minutes while others waited for next day delivery.

The volume opportunity is significant. Bitcoin ETF trading volumes have averaged billions of dollars per day since the January 2024 launch. Each trade represents a potential AP opportunity when the ETF price deviates from NAV. Wintermute’s registration gives it access to this revenue stream alongside established APs like Jane Street, Virtu, and Goldman Sachs.

The tokenized securities bet

The long term strategic logic behind Wintermute’s registration extends beyond current products to a market that is still being built: tokenized securities.

Tokenized securities are digital representations of traditional financial instruments, stocks, bonds, ETFs, issued on a blockchain. They trade using crypto settlement infrastructure (24/7, near instant settlement, programmable) but are subject to securities regulation (registration, disclosure, investor protection). The market is small today but growing. The SEC’s approval of Nasdaq’s tokenized share trading rule in March 2026 was a significant regulatory milestone.

For tokenized securities to achieve meaningful trading volume, they need market makers who can provide liquidity on both the tokenized venue and the traditional venue where the underlying security trades. An investor buying tokenized Apple stock needs to receive a price that is competitive with the price on Nasdaq. That price alignment requires a market maker that can trade on both venues and arbitrage any price differences.

Wintermute’s broker dealer registration positions it to be that market maker. The firm can trade traditional Apple stock on Nasdaq through its broker dealer and tokenized Apple stock on a blockchain based venue through its existing crypto infrastructure. The ability to operate on both rails simultaneously is the competitive moat.

This is a five year bet, not a quarter to quarter revenue play. Tokenized securities volumes are still a fraction of traditional market volumes. But the infrastructure investment required to be ready when the market scales is substantial, and Wintermute is making it now.

The tokenized securities thesis also has a settlement advantage that is easy to overlook. Traditional equities settle on a T+1 basis, meaning the buyer does not receive the shares and the seller does not receive cash until the next business day. Tokenized securities on a blockchain can settle in minutes or seconds. For a market maker, faster settlement means lower capital requirements. Every dollar tied up waiting for settlement is a dollar that cannot be deployed elsewhere. If tokenized securities achieve significant volume, the market maker that can settle both the tokenized and traditional versions simultaneously will have a capital efficiency advantage that compounds across thousands of daily trades.

What this does not resolve

The registration does not make Wintermute a retail broker. The firm trades exclusively for its own proprietary account. It cannot accept customer deposits, manage customer accounts, or provide investment advice. Users will not interact with Wintermute USA directly. They will interact with it indirectly through tighter spreads on the venues where it provides liquidity.

The registration also does not resolve the broader regulatory uncertainty facing digital asset securities. The CLARITY Act, if passed, would define which digital assets are securities and which are commodities. Until that framework exists, trading in digital asset securities carries compliance risk that even a broker dealer registration does not fully mitigate.

Finally, the registration does not eliminate the conflicts of interest inherent in market making. Market makers profit from the spread, which is a cost to traders. They have information advantages from seeing order flow across multiple venues. And their automated systems can react faster than any human trader. These dynamics exist in traditional equities and are well understood by regulators. How they apply to a market maker that operates across both crypto and traditional venues simultaneously is a newer question.

The cross venue information flow is particularly sensitive. A market maker that sees order flow on both Binance and the NYSE possesses information about demand in two markets that are increasingly correlated. If bitcoin’s price moves sharply on Binance, Wintermute’s systems could theoretically adjust equity quotes on Bitcoin ETFs before other market participants process the same information. This is the same type of latency arbitrage that high frequency trading firms have exploited in equities for years, but applied across a market boundary that regulators are only beginning to monitor. FINRA and the SEC will be watching how Wintermute manages information barriers between its crypto and equities desks.

What to watch

Wintermute’s equities and options trading volume. The firm’s performance in traditional markets will signal whether crypto native market makers can compete with incumbents. Initial volumes will be small, but the trajectory matters more than the starting point.

Additional crypto firms seeking broker dealer status. If other major crypto market makers (Jump, Cumberland, Amber Group) pursue similar registrations, it confirms that the industry views traditional market access as a competitive necessity rather than an optional expansion.

Tokenized securities volume growth. Wintermute’s long term thesis depends on tokenized securities becoming a meaningful asset class. Tracking volume on platforms like Kraken’s xStocks and Nasdaq’s tokenized trading framework will indicate whether this bet is paying off.

SEC rulemaking on digital asset securities. The regulatory framework for trading digital asset securities is still being built. SEC guidance on custody, settlement, and disclosure requirements for tokenized securities will shape the market that Wintermute is positioning to serve.

AP market share for crypto ETPs. Wintermute’s share of the creation and redemption flow for Bitcoin and Ethereum ETFs will be an early indicator of the firm’s ability to compete with established APs in a regulated market.

Regulatory scrutiny of cross market information flows. As Wintermute begins trading equities while maintaining its crypto operations, FINRA and the SEC will monitor how the firm manages information barriers between its trading desks. Any enforcement action related to cross market information use would signal that regulators view the convergence of crypto and equities market making as a systemic risk requiring new supervisory frameworks.

Hiring patterns at competing crypto market makers. If Jump Trading, Cumberland, and Amber Group pursue similar registrations and begin hiring traditional finance compliance and trading staff, it confirms that the industry views Wintermute’s move as setting a competitive standard rather than pursuing a niche strategy. The pace of these hires will indicate how quickly the broader crypto market making industry expects the integrated market to materialize.

DATUM moves that decision back to the individual miner. An operator can build its own block using its own bitcoin software while still contributing computing power to Ocean and sharing in the pool’s payouts.

Simple Mining used that control to leave the BIP-110 signal out of block 961,634.

“We chose not to signal and the chain extended on our block,” the company said.

That also explains why Ocean has appeared on both sides of the weekend split.

A miner using Ocean produced the first block accepted by the BIP-110 branch on Saturday, according to fork tracker Mempool. Simple Mining then used the same pool and made the opposite choice, producing a block for the dominant bitcoin chain.

Computers running BIP-110 software began rejecting blocks that did not carry its signal at block 961,632, after miner support peaked at about 2.6%, far below the 55% the proposal needed.

The minority branch has struggled since. It produced blocks 961,632 and 961,633 before stalling, while bitcoin kept producing blocks roughly every ten minutes.

By Monday a live monitor showed the main chain at 961,725, putting the BIP-110 branch more than 200 blocks behind.

The U.K. Financial Conduct Authority is discussing standards for tokenized gold with major banks and other market participants, according to an Aug. 10 Financial Times report. 

The discussions are examining how digital representations of physical gold could operate in wholesale markets, including as collateral.

The talks have not yet produced a standalone FCA rulebook specifically for tokenized gold. They build on a May 18 joint policy paper from the FCA and Bank of England, including the Prudential Regulation Authority, which explicitly identified tokenized gold as a possible form of collateral for uncleared over the counter derivatives.

FCA tokenized gold plan builds on May roadmap

The May paper says the FCA and PRA are reviewing tokenized collateral eligibility and recognize potential benefits from tokenized money market funds and tokenized gold. Any use would be subject to standards developed with industry. Regulators also plan further policy later this year explaining how tokenized collateral can operate under the existing regulatory framework.

That points toward adapting existing wholesale market rules rather than automatically creating a separate regulatory category for each tokenized asset. The PRA has also said tokenized traditional assets should generally receive the same prudential treatment as conventional equivalents when their legal rights and underlying risks are comparable.

As crypto.news reported in earlier UK regulatory coverage, the broader initiative covers issuance, trading, settlement, collateral and the infrastructure needed to move tokenized finance beyond pilot projects.

Tokenized gold could enter wholesale collateral markets

The Bank of England plans to consider how tokenized versions of assets already accepted as regulatory collateral could qualify at central counterparties under UK EMIR. The FCA and PRA are separately examining tokenized gold for uncleared derivatives collateral.

There is already a precedent involving funds. An April FCA policy statement confirmed that a range of money market funds, including tokenized versions, can qualify as collateral for uncleared trades under UK EMIR. The same statement said authorized U.K. funds are not prevented from investing in tokenized forms of otherwise eligible assets.

The regulatory work therefore centers not only on whether an asset is digital, but whether its legal rights, custody arrangements and risks remain comparable with the conventional asset it represents.

London’s bullion position gives the project added weight

The Financial Times reported that London accounts for roughly 70% of global gold trading volume. It said the regulatory discussions come as London faces stronger competition from Asian financial centers seeking a larger role in bullion trading.

The size of the existing London market is substantial. LBMA data show London vaults held 9,339 tonnes of gold valued at about $1.384 trillion at the end of March. LBMA describes London as the center of the international bullion market.

The World Gold Council is also developing a wholesale digital gold structure known as Pooled Gold Interests. Its proposed model combines physical ownership with digital transfer and is aimed primarily at institutional and wholesale participants.

What happens next for UK tokenization rules

The FCA and Bank of England closed their broader tokenization consultation on July 3. Their published timetable calls for industry workshops, a response statement during the summer and a full cross authority roadmap later in 2026. The Financial Times now reports that an announcement on developing tokenized gold standards is expected within the next few months, citing a person familiar with the FCA’s plans.

Infrastructure work is advancing alongside those rules. Sixteen firms are working through the Digital Securities Sandbox, while the Bank of England plans upgrades to its securities and collateral system in 2027. It is also targeting 2028 for a synchronization service connecting digital asset ledgers with sterling central bank money.

In related coverage, crypto.news reported on the UK digital gilt rollout, which is targeting its first transaction by the end of Q1 2027 using HSBC’s Orion platform.

The next step for gold is therefore regulatory detail. Authorities still need to determine standards covering eligibility, legal ownership, custody and risk before tokenized gold can become a routine source of collateral across U.K. wholesale markets.

Bitcoin pushed above $65,000 during early trading on Aug. 10 before slipping back below the level, extending its recovery as investors reassessed the U.S. interest rate outlook. 

BTC was trading near $64,955 at the time of writing, up 0.3% over 24 hours and 3.4% over seven days. Its intraday high reached $65,363.

The move leaves traders with a clear macro event ahead. The Bureau of Labor Statistics will release July consumer inflation data at 8:30 a.m. ET on Wednesday, Aug. 12. The report follows Friday’s unexpectedly weak employment numbers, which reduced expectations that the Federal Reserve would need to raise rates again soon.

Bitcoin gets relief from weaker U.S. jobs data

The U.S. economy lost 23,000 nonfarm payroll jobs in July, while unemployment held near 4.1%, according to official BLS data. May payroll growth was revised down by 66,000 and June by 37,000, removing 103,000 jobs from the two previous estimates combined. Average hourly earnings rose 3.2% from a year earlier.

Bitcoin moved above $65,000 after the report as rate expectations shifted. As crypto.news reported in Friday’s payroll reaction, BTC initially gained almost 2% as investors interpreted weaker hiring as reducing pressure on the Fed to tighten policy. The move has since held, although $65,000 has not yet become firm support.

The policy backdrop remains divided. The Federal Reserve held its target range at 3.50% to 3.75% on July 29, but three voting officials preferred a 25 basis point increase, according to its statement. The central bank also said inflation remained above its 2% goal, partly because of energy related supply pressures.

Bitcoin ETF demand strengthened throughout last week

Institutional demand also improved as Bitcoin approached resistance. SoSoValue reported $854 million in net inflows into U.S. spot Bitcoin ETFs from Aug. 3 through Aug. 7, with BlackRock’s IBIT accounting for about $694 million. The figure marked a reversal from the weaker fund flows seen around the end of July.

There is a small difference between ETF datasets. Farside’s current flows show daily totals of $170.1 million, $211.5 million, $244.4 million, $137.6 million and $101.7 million over the same five sessions, which sum to about $865.3 million. For that reason, the $854 million weekly total is best attributed specifically to SoSoValue rather than treated as a universal figure.

The demand followed several sessions in which ETF buying failed to produce an immediate breakout. In earlier ETF flow coverage, Bitcoin remained near $64,200 on Aug. 7 even after funds recorded four consecutive positive sessions. Friday’s additional inflows extended that streak while BTC continued challenging the same resistance area.

$65,800 remains a closely watched Bitcoin barrier

The price structure has improved since Bitcoin traded near $62,500 at the beginning of last week, but the market has repeatedly struggled between $65,000 and $66,000. Crypto.news previously identified the same area in recent resistance analysis, where $65,000 to $65,500 also contained a concentration of liquidation liquidity.

The Relative Strength Index stood at 55.07, above its moving average of 50.44 and the neutral 50 level. The reading points to moderate bullish momentum, with buyers holding a slight advantage. However, RSI remains well below overbought territory, suggesting momentum has strengthened without becoming stretched.

The Awesome Oscillator was positive at about 664.19, supporting the improving momentum picture. Its histogram bars remained relatively small compared with those recorded during stronger directional moves, so the indicator points to improving momentum rather than confirming a major breakout.

Analyst Michaël van de Poppe has placed the next level slightly higher. In an Aug. 9 post, he called $65,800 the “critical level” and said BTC was “ready for a breakout to at least $73,700.” 

He also cited bullish divergence in longer duration RSI and MACD readings. Those figures are his technical targets, not confirmed price objectives, and Bitcoin still needs to clear the resistance he identified.

What happens next as U.S. inflation takes focus

Wednesday’s CPI report is now the nearest scheduled U.S. catalyst. June consumer prices fell 0.4% from May while rising 3.5% from a year earlier. Core CPI was unchanged during June and rose 2.6% annually. Economists surveyed by Reuters expect July headline inflation to ease to 3.4% annually and core inflation to slow to 2.5%.

The market is also dealing with renewed energy pressure. Brent crude rose 1% to $84.40 on Monday as uncertainty around shipping through the Strait of Hormuz continued. Meanwhile, the U.S. 10 year Treasury yield traded near 4.66%. Futures markets put the probability of a September Fed rate increase near 44%, down from 67% one week earlier.

A hotter CPI reading could rebuild expectations for another increase and put renewed pressure on risk assets. A softer reading could reinforce the interpretation traders drew from Friday’s weak employment report, but it would not guarantee a Bitcoin breakout. The Fed’s next scheduled policy meeting runs Sept. 15 to Sept. 16, leaving policymakers with several more economic releases before deciding whether rates should change.

For Bitcoin, the immediate test therefore remains narrow: holding the recovery around $65,000 while attempting to clear the $65,800 area. Wednesday’s inflation numbers will provide the next evidence on whether the U.S. macro environment supports that move or sends traders back toward the lower end of Bitcoin’s recent range.