A macOS information-stealing malware can compromise Telegram Desktop sessions and, from there, target both software and hardware cryptocurrency wallets, according to blockchain security firm SlowMist. The report describes an attack chain that harvests credentials and wallet data from multiple macOS sources, then leverages that access to swap or drain funds through techniques that do not rely on breaking Telegram’s two-step verification in the usual way.

SlowMist says the malware extracts secrets from macOS Keychain, Safari cookies, Apple Notes, Telegram Desktop and database files tied to more than a dozen cryptocurrency wallets. After collecting passwords and authenticated session data, it copies Telegram Desktop session information along with wallet databases and browser wallet extension data, enabling follow-on account takeover attempts.

Key takeaways

• SlowMist reports malware can hijack existing Telegram Desktop sessions on macOS by reusing authenticated local data rather than forcing a new login.
• In addition to stealing passwords, the malware targets wallet databases and application data for both popular software wallets and hardware wallet managers.
• Telegram two-step verification may not block the attack because the malware avoids the need to pass verification challenges.
• SlowMist outlines two follow-up strategies: offline wallet database decryption using harvested passwords, or replacing wallet apps (e.g., Ledger/Trezor software) with decoys to capture recovery phrases.

How Telegram Desktop becomes the entry point

SlowMist’s core warning is that Telegram Desktop accounts on macOS may be compromised even when users have enabled two-step verification. The reason, the firm says, is architectural: instead of creating a fresh login that requires verification, the malware reuses an already authenticated local session stored on the device.

In its tests, SlowMist restored stolen Telegram Desktop session data on another Mac without requiring the user to enter a phone number, verification code, or two-step verification password. That distinction matters for users because two-step verification is designed to protect logins, while this method targets session material that can be carried over to a new environment.

The practical takeaway is that Telegram Desktop should be treated as a high-value target when credentials and session files are accessible to malware. If an attacker can move a session to another machine, subsequent steps—such as obtaining access to linked accounts, exchanging information, or guiding victims toward risky actions—can proceed without triggering the protections that apply to new authentication.

Wallet data theft spans software wallets, hardware managers, and node databases

SlowMist says the malware is not limited to Telegram. It also harvests wallet-related data from a wide range of sources, including wallet applications and full-node clients.

On the wallet side, SlowMist names software wallets such as Exodus, Atomic, Electrum, Wasabi and Monero. It also points to targeting hardware wallet software interfaces, including Ledger Live and Trezor Suite—software layers that manage hardware devices and frequently coordinate how users view balances and initiate transactions.

Beyond standalone wallets, the report says the malware searches for wallet data stored by full-node clients, listing Bitcoin Core, Litecoin Core, Dash Core and Dogecoin Core among those affected. For investors and traders, the implication is straightforward: wallet information does not only live in wallet apps. If malware can reach local storage associated with node software, it may uncover additional material that helps attackers attempt to access or reproduce wallet capabilities.

SlowMist also describes collecting data beyond wallet databases, including Safari cookies and Apple Notes. Those components can increase an attacker’s ability to persist access, understand user behavior, or extract sensitive information that is not stored in one dedicated wallet folder.

Offline cracking and fake recovery flows

After harvesting passwords and authenticated session data, SlowMist says attackers can attempt to decrypt stolen wallet databases offline. The attacker would use passwords taken from the infected device, reducing the need for repeated online attempts that might trigger rate limits or other defenses.

SlowMist also describes a second approach: replacing legitimate Ledger and Trezor applications with fake versions. In this scenario, victims could be tricked into entering recovery phrases into the counterfeit software—an especially dangerous outcome because recovery phrases are effectively “master keys” for accessing funds.

SlowMist states it reproduced the attack chain in an isolated environment, supporting its claim that the described steps can be executed together rather than as unrelated capabilities.

For users, the key risk is that wallet compromise can be multi-stage. Even if attackers initially acquire Telegram session access, the malware’s broader collection of wallet databases and application data can enable direct attempts to extract value or pivot to social engineering that captures recovery credentials.

Why Telegram’s usual protections may not be enough

SlowMist’s findings highlight a recurring theme in account takeover incidents: security features sometimes assume a specific threat model. Telegram two-step verification helps protect new logins, but the malware’s method—carrying over an authenticated local session—changes the conditions.

Instead of challenging the user during sign-in, the attacker operates with session data that the device has already established. That makes “I turned on 2FA” less reassuring when malware is already present and can read session-related files.

SlowMist also recommends immediate operational steps for anyone who suspects compromise. It urges users to terminate existing Telegram sessions, create a new trusted login, and update both the Telegram two-step verification password and the Telegram Desktop Passcode. Those steps aim to invalidate the hijacked session material and force Telegram to re-establish trust through a fresh authentication flow.

The firm further advises generating a new recovery phrase on a clean device and moving assets to new addresses. The goal is to break the link between the compromised wallet state and the assets that need protection. If wallet apps or recovery material were exposed, reusing the same recovery phrase after a compromise can leave funds vulnerable to attackers who already have enough information to regain access.

SlowMist’s report serves as a reminder that cryptocurrency security is not only about securing keys on paper or enabling 2FA on messaging apps. When malware can access both session data and wallet databases locally, protections must extend to device hygiene and rapid incident response. Users should watch closely for signs of compromise, verify which Telegram sessions remain active, and be prepared to move funds to fresh addresses after any suspected infection.

Everyone is watching a bill that may not pass. Meanwhile, the agency that spent seven years suing this industry has quietly scheduled a rule that would let startups sell tokens without registering them, and it does not need a single vote in Congress.

The entire crypto policy conversation for the past month has been about a bill. Whether the Senate schedules CLARITY, whether seven Democrats can be found, whether the ethics provision survives, whether three working weeks is enough. It is a good story and it may end badly. It has also completely obscured the fact that while Congress argues, the Securities and Exchange Commission has scheduled something that would accomplish a large portion of what the bill promises, requires nobody’s vote, and is sitting at the White House right now awaiting review. It is called Regulation Crypto, it is slotted for July, and it would do the one thing the industry has wanted since 2018: let a startup sell a token in America without first registering it as a security.

What the rule would actually do

Chairman Paul Atkins first sketched the framework in remarks on March 17, 2026, the same day the SEC and CFTC published their joint token taxonomy. That timing was not coincidental. The taxonomy answered what a crypto asset is. Regulation Crypto answers what you may do with one.

Three components carry the weight.

A startup exemption. A time-limited registration exemption for offerings of investment contracts involving certain crypto assets, lasting up to four years, giving developers a regulatory runway while they work toward maturity. Atkins framed the eligibility around early-stage projects, with figures discussed around startups valued under $5 million in their first four years, able to raise up to $5 million during that period. Critically, the exemption would be non-exclusive, meaning every other capital-raising exemption under the federal securities laws would remain available alongside it.

A fundraising exemption. For projects past the earliest stage, a larger allowance: entrepreneurs could raise up to $75 million during any 12-month period while retaining the ability to rely on other registration exemptions. Reporting on the agency’s agenda indicates this would come with conditions, including audited balance sheets and statements regarding the issuer’s financial condition, plus notices to the Commission when relying on the exemption and when exiting it.

A safe harbor for decentralization. This is the most consequential piece. The proposal would create a definitive safe harbor for issuers who complete or transition away from centralized management efforts over their networks, allowing a token to exit securities classification once managerial effort ceases. That is the decentralization off-ramp the industry has been asking for since the Hinman speech, and it would apply an objective standard to secondary markets where those tokens trade.

Beyond those three, the proposal reaches into tokenized securities, and DeFi is named explicitly as an area where qualifying companies would receive protection from enforcement action. The agency has acknowledged, in effect, what practitioners have said for years: traditional securities registration is incompatible with decentralized protocols and automated smart contract systems. Separately, the SEC has opened a comment request reviewing spot crypto ETF approval procedures and proposing a confidential filing process for initial applications, after the Division of Investment Management’s director conceded the agency had mishandled the simultaneous launch of spot crypto funds.

Why this is bigger than it looks

Here is the argument nobody is making loudly enough, and it inverts the entire CLARITY frame.

The American crypto industry currently operates on administrative action. The March 17 joint interpretation classifying 16 named assets as digital commodities is a Commission-level interpretive release. It is binding on the SEC and CFTC, which makes it far stronger than the staff guidance that preceded it, and it is already cited in fund registration statements. But it is not a rule and it is not a law. A future Commission can issue a different interpretation without notice, without comment, and without Congress.

A formal rule is a different animal. Rules go through notice and comment. They generate a record. Reversing a final rule generally requires another full rulemaking with a reasoned explanation capable of surviving judicial review, and agencies that try to shortcut that process lose in court. Bankless put the point precisely: the SEC has leaned on staff guidance and its taxonomy so far, but formal rules are far harder for a future commission to unwind.

So there is a ladder of durability, and it is worth being explicit about where each thing sits.

Staff guidance binds nobody. A Commission interpretation binds the agencies and can be replaced by another interpretation. A formal rule binds until another rulemaking undoes it. A statute binds until Congress acts. The industry has spent a year fighting for the top rung and has largely ignored that the agency is quietly building the third.

Which produces an awkward question worth asking directly: if Regulation Crypto publishes and survives comment, how much of CLARITY does it deliver anyway? Not all of it. The rule cannot divide jurisdiction between the SEC and CFTC, because only Congress can rewrite agency mandates. It cannot bind a future Congress. But the registration exemption, the fundraising allowance, and the decentralization off-ramp are the provisions most builders actually care about, and the agency can deliver those alone.

There is a further irony worth naming. “Reg Crypto” is also the informal name for a capital-raising exemption in the Senate’s version of the CLARITY Act, at Section 103, which would create a new exemption under the Securities Act of 1933. The bill and the rule are converging on the same mechanism from two directions. If both landed, they would overlap. If only one lands, the industry may not notice much difference in the near term.

Why the agency route is worse than a law

The skeptical case is real and deserves its full weight, because the enthusiasm around this proposal has been running ahead of the document, which has not published yet.

Start with the obvious. If CLARITY dies, the burden of defining the rules of American crypto falls almost entirely on one agency and one set of proposed exemptions. That is a fragile foundation for a multitrillion-dollar asset class. It also concentrates enormous discretion in a single Commission whose composition changes with administrations, which is the precise problem the industry claims to be solving. Trading a hostile SEC for a friendly SEC is not the same as trading regulatory uncertainty for regulatory certainty.

The thresholds are the second problem, and they will be the fight. A $5 million startup ceiling and a $75 million annual raise sound generous until you notice they will face intense scrutiny the moment they publish. Consumer advocates will argue that a registration exemption for token sales is a re-run of the 2017 ICO boom with a compliance veneer, and they will have a decade of fraud data to cite. The exemption thresholds and the decentralization off-ramp are exactly the provisions most likely to be narrowed during the comment period, and a rule that publishes at $75 million may finalize somewhere considerably smaller.

The safe harbor is also narrower than the celebration suggests. It functions as an off-ramp, not an amnesty. Issuers remain liable for any misstatements made during the offering period, which means the exemption relieves the registration burden without relieving the antifraud exposure. And the decentralization test is inherently fact-dependent: determining that managerial efforts have genuinely ceased is a judgment call, and a judgment call made by an agency is a judgment call that a different agency can make differently.

Then there is timing. Atkins initially said Regulation Crypto would roll out in January. It is now July. The proposal sits at OIRA, and White House regulatory review is not a rubber stamp. After it publishes, a public comment period follows, then a final rule, then compliance dates. The realistic distance between the July slot and an operative rule is measured in quarters, not weeks. Anyone treating this as imminent relief has not watched a rulemaking before.

And the whole enterprise rests on institutional continuity that crypto has no reason to expect. Atkins tied the initiative directly to the President’s ambition to make America the crypto capital of the world. That is a political framing, and political framings expire.

The ghost of 2017

Any honest treatment of this proposal has to deal with the objection that will define its comment period, because it is not a bad-faith objection and the industry keeps pretending it is.

In 2017 and 2018, roughly the same idea ran without a safe harbor and without conditions. Projects sold tokens to the public on the theory that a sufficiently technical white paper made an investment contract into something else. The result was one of the largest concentrations of retail fraud in modern financial history. The SEC’s enforcement posture over the following seven years, the one the industry spent a decade complaining about, was the response to that period. Regulation Crypto proposes to permit the activity that caused it, under conditions, and the burden of showing the conditions are load-bearing sits with the agency.

The steelman for the proposal is that the conditions are meaningfully different, and they are. The 2017 model had no disclosure requirement; the fundraising exemption contemplates audited balance sheets and statements on the issuer’s financial condition. It had no notice obligation; this contemplates notices to the Commission on entry and exit. It had no time limit; the startup exemption runs up to four years and then the runway ends. It had no antifraud discipline in practice; the safe harbor explicitly preserves issuer liability for misstatements during the offering period. And it had no exit test at all, whereas the decentralization off-ramp requires the issuer to actually surrender managerial control to leave securities status, which is the opposite of the 2017 pattern where founders kept control and claimed decentralization anyway.

That last point is the strongest thing in the proposal and it deserves more attention than the dollar figures getting quoted. An objective standard for when managerial effort has ceased does two jobs at once. It gives honest projects a defined path to maturity. And it makes the dishonest claim harder, because a project that wants the off-ramp has to give up the control that made the token valuable to insiders in the first place. Structured well, the safe harbor is not a loophole. It is a filter.

Structured badly, it is a loophole. Everything depends on where the standard lands, how it is tested, and who reviews the claim, and none of those are knowable from an agenda entry. A decentralization test that a project can satisfy by dissolving a foundation and keeping the multisig is worse than no test, because it converts a factual question into a paperwork exercise and gives the resulting token a federal blessing.

Which is why the comment period is the story, not the announcement. Consumer advocates will arrive with the fraud data and argue the thresholds are too high. The industry will arrive and argue they are too low. The final rule lands somewhere between, and the number that matters is not $5 million or $75 million. It is how much control an issuer must genuinely surrender to reach the off-ramp. Watch that clause. Everything else is negotiable in a way it is not.

What the timing tells you

The most revealing thing about Regulation Crypto is not its contents. It is its position on the calendar.

The SEC scheduled its first major crypto rulemaking for the exact month in which CLARITY either passes or dies. The proposal’s scope and timing are, by several accounts, partly tied to the bill’s fate. Read that as the agency hedging. If Congress delivers, the rule harmonizes with the statute and fills gaps. If Congress fails, the rule becomes the framework, and the SEC will have spent the interval building it instead of waiting.

That is competent institutional behavior and it is also a quiet verdict on the odds. Agencies do not schedule contingency frameworks for legislation they expect to pass. Prediction markets have CLARITY’s 2026 passage in the mid-20s to upper-30s percent range. The SEC’s rulemaking calendar appears to agree with the traders.

For anyone actually trying to build in this market, the practical guidance inverts the usual advice. The bill is the loud story and the low-probability one. The rule is the quiet story and the likelier one. Watch whether the proposal clears OIRA and publishes in July as scheduled. Watch whether the decentralization off-ramp survives with an objective standard intact, because that provision does more work than any other. Watch whether the raise thresholds hold through comment. And watch the naming collision between the agency’s Reg Crypto and CLARITY’s Section 103, because if both survive, someone will spend a year reconciling them.

Seven years ago the SEC’s position was that most tokens were unregistered securities and the appropriate response was enforcement. The same agency now proposes to let founders sell them without registering. Nothing in the underlying law changed. What changed was who runs the building, which is either the strongest argument for passing CLARITY or the clearest evidence that the industry does not need it. It cannot be both, and the next three weeks decide which.

There is one more reading available, and it may be the correct one. Perhaps the choice was never between the bill and the rule. The taxonomy classified the assets in March. Regulation Crypto would govern how they are sold. CLARITY would divide who supervises the market and put both of the first two beyond the reach of the next Commission. Those are three different jobs, and only the third requires Congress. An industry that got two of them inside four months, from an agency it spent a decade litigating against, has done considerably better than its own rhetoric admits, and the remaining gap is narrower than a year of vote-counting coverage suggests.

The gap is also the only part that lasts. Rules and interpretations are the crypto industry renting its legal status from whoever holds the chairs. The rent is cheap right now and the landlord is friendly. That is a fine arrangement until it is not, and the entire argument for the bill reduces to whether anyone believes the lease gets renewed. On the evidence of the past decade, that is not a bet a serious allocator makes with someone else’s capital, which is why the quiet rulemaking and the loud bill are not substitutes at all. One of them is a good year. The other is a floor.

Disclaimer: This article is for information and educational purposes only and does not constitute financial, investment, or legal advice. It describes a proposed rulemaking that has not yet published, and proposal terms, thresholds, and timing can change materially through White House review and public comment. Nothing here is a recommendation to buy or sell any asset or to rely on any exemption. Always do your own research. Information is accurate as of July 17, 2026.

Frequently Asked Questions

Airbnb CEO Brian Chesky said his X account was hacked, and the attacker posted a thread promoting tokenized real-world assets (RWAs) that was criticized as being heavily AI-assisted.

The now-deleted posts argued that tokenization could make buildings, bonds and funds easier to divide, trade and settle. The thread referenced trading platform Robinhood’s push into tokenized assets.

The posts did not mention a token sale, wallet or token address or investment link, making the compromise less obvious than a typical crypto account takeover.

“To the person who hacked my account earlier this week: thanks for all the new crypto followers,” Chesky wrote after regaining access. “To my new crypto followers: I’m going to be a very disappointing follow.”

Airbnb reported the incident to X, which secured the account. It isn’t clear how the attacker gained access or who was responsible.

Taiwan has sentenced the alleged mastermind behind the BitShine crypto exchange to 22 years in prison after finding he led a fraud and money laundering operation that prosecutors said caused more than NT$1.27 billion ($39 million) in losses to over 1,500 victims.

Taiwan’s semi-official Central News Agency (CNA) reported that the Shilin District Court convicted the defendant, identified by the surname Shih, of illegally operating virtual asset services while orchestrating fraud and money laundering through the BitShine platform.

Court findings said Shih led a criminal organization that used BitShine, a crypto exchange previously registered with Taiwan’s Financial Supervisory Commission (FSC), to disguise illegal activities behind what appeared to be a legitimate business.

Prosecutors said the group worked with fraud syndicates and members linked to the Thento Union, one of Taiwan’s largest organized crime groups. Victims’ cash was allegedly converted into Tether’s USDT before being transferred overseas.

Investigators estimated the operation laundered more than NT$2.3 billion ($71 million) between January 2024 and April 2025. Prosecutors identified 1,539 victims who together lost more than NT$1.27 billion ($39 million), according to CNA.

Local newspaper UDN reported that Shih recruited compliance personnel who were unaware of the alleged scheme to develop know-your-customer (KYC) procedures for the exchange. Prosecutors said intermediaries later coached fraud ring members on how to answer KYC verification questions so victims could successfully complete onboarding and purchase cryptocurrency through the platform.

Authorities indicted 14 suspects, including Shih, in August 2025. Prosecutors had sought a 25-year prison sentence for the alleged ringleader before the court handed down a 22-year term.

Taiwan tightens crypto oversight

The ruling comes weeks after Taiwan approved a new legal framework for virtual asset businesses.

On June 30, Taiwan’s Legislative Yuan passed the Virtual Asset Service Act, replacing the country’s previous anti-money laundering registration system with a licensing regime covering crypto exchanges, trading platforms, custodians, transfer firms, lending providers and other virtual asset service providers.

Under the new law, crypto businesses must obtain approval from the FSC before operating. Existing firms that completed anti-money laundering registration before the law takes effect will have 12 months to apply for regulatory approval and up to 21 months to secure a license, with a one-time three-month extension available in limited cases.

The legislation also introduces rules covering cybersecurity, customer asset segregation, internal controls, financial reporting, and asset listing reviews. Stablecoin issuers must receive approval from both Taiwan’s central bank and the FSC while maintaining fully backed reserves held in trust, alongside regular audits and public disclosures.

The law also establishes criminal penalties for unlicensed crypto operations and market abuse. Illegal virtual asset services or stablecoin issuance can result in prison terms of up to seven years and fines reaching NT$100 million, while fraud and market manipulation offenses carry penalties of three to 10 years in prison and fines of up to NT$200 million.

Balaji Srinivasan, the founder of Network School—an in-person tech community in Malaysia—says he is seeking an official memorandum of understanding (MoU) with Malaysia after authorities opened an investigation into allegations that the community was sheltering Israeli citizens using second passports.

Malaysia’s Home Affairs Ministry said it is checking the Forest City project in Johor after reports claimed Israelis were present in violation of immigration rules. The ministry said initial checks found that all 266 foreign nationals linked to the community were holding valid travel documents, while the investigation continues.

Key takeaways

• Malaysia is investigating Network School after claims that it included Israelis who would be in breach of immigration requirements.
• The Home Affairs Ministry reported that preliminary document checks for 266 foreign residents showed valid paperwork.
• Srinivasan is requesting an MoU to provide “legal certainty” for future investment and operations in Malaysia.
• He has paused planned expansion spending in Malaysia pending assurance that the allegations will not repeat.
• The case underscores how “crypto utopias” and digital-native communities still rely on conventional state frameworks for legality.

An MoU aimed at legal certainty

Srinivasan framed the request for a formal agreement as a solution to uncertainty around the legal standing of Network School’s residents and investors. He said that without a document clarifying that the community is welcome, Network School could shift its capital elsewhere.

In a video directed to Malaysian Prime Minister Anwar Ibrahim, Srinivasan said he wants something more concrete than broad assurances that “tech is welcome,” arguing that the community needs personal confirmation that it is legally and politically accepted. He did not detail the final structure of the agreement, but suggested it could take the form of a memorandum of understanding or involve an adjustment to a special economic zone provision.

According to Srinivasan, the MoU is also intended to ensure that additional capital commitments do not become hostage to future immigration disputes. He said he is putting further investments in Malaysia, including a $122 million expansion plan for the community, on hold until he receives “sufficient assurance” that the situation will not recur.

Malaysia’s investigation: initial checks show valid documents

Malaysia’s Home Affairs Ministry said Tuesday that it is investigating the Network School project in Johor following allegations that the community included Israelis in a way that would violate immigration law. The ministry reported that its initial checks reviewed documents for 266 foreign nationals connected to the effort and found that they were all in possession of valid travel documents.

While the preliminary findings suggest paperwork compliance at least on the documentation front, the fact that a probe has been initiated indicates that authorities are still looking beyond the mere existence of valid travel documents—particularly in relation to nationality-specific entry requirements and the underlying claims prompting the scrutiny.

How the allegations surfaced

The claims appear to have originated from social media. The article reports that the allegations were traced back to a post on Instagram from the activist group “Malaysian Protest 4 Palestine,” which accused Network School of operating as a “gathering place for Israeli entrepreneurs.”

Under Malaysia’s rules, Israeli passport holders are reportedly not allowed to enter without written permission from the Malaysian Ministry of Home Affairs, and Malaysia does not recognize Israel or maintain diplomatic relations with the country. This policy forms the basis for why the allegations—if true—would raise legal concerns.

It also highlights a recurring challenge for projects that present themselves as international or border-agnostic communities: even when members hold valid documents, eligibility and entry permissions can still hinge on a broader framework of state policy.

The broader tension for border-dependent “crypto utopias”

Network School is marketed as a physical community for tech builders and founders, and Srinivasan has previously positioned it as part of a more ambitious vision for technology-driven institutions. The current dispute reflects a tension many similar communities face: they may want to create digital-native ecosystems—complete with their own norms, networks, and economic activity—yet their continued operation ultimately depends on conventional government permission and legal clarity.

The episode is therefore more than a single-country immigration story. It raises questions about how quickly digital communities can institutionalize without first securing stable legal frameworks for their participants—particularly when public allegations or geopolitical sensitivities intersect with immigration rules.

In Srinivasan’s account, the need for an MoU is not about asking for special treatment, but about reducing uncertainty that can immediately affect capital plans. That dynamic is a practical issue for builders and investors alike: expansion timelines, residence planning, and onboarding of international participants can all become difficult if the legal status of the community or its membership composition remains in dispute.

While Malaysia’s ministry has stated that initial document checks found valid papers for the 266 foreign nationals involved, the investigation’s outcome—and whether an MoU will satisfy the “assurance” Srinivasan is demanding—will determine whether Network School can proceed without further interruptions.

Readers should watch next for the scope of Malaysia’s continuing review and whether Srinivasan’s requested agreement clarifies how immigration requirements will be applied to Network School residents going forward.

Ether (ETH) fell twice as hard as bitcoin on Friday and hyperliquid’s HYPE fell more than five times as hard, as a selloff in Asian semiconductor shares dragged every major cryptocurrency lower.

Ether dropped 4% to $1,850, though it remains up 4% over seven sessions and is the only major still green on the week. HYPE was the worst of them at $60, down 10% on the day and 12% on the week, its steepest stretch since June. Solana slid 2% to $75 and is off 5% for the week.

XRP eased 2% to $1.09, BNB fell 2% to $571, TRON slipped to 32 cents and dogecoin lost 2%. Bitcoin held up best of the group, down 2% to about $63,400 and 1% on the week after failing twice at $65,000.

The selling started in semiconductors. MSCI’s Asia Pacific equities gauge dropped 3%, heading for its lowest close in two months, while Japan’s Nikkei 225 slumped 5% in its worst session since March. Taiwan Semiconductor was on track for its biggest one-day decline since April 2025 and Japan’s Kioxia sank as much as 16%.