Key Takeaways

• DarkSword compromises iOS versions 18.4 through 18.7, exfiltrating cryptocurrency assets and sensitive information.
• Ghostblade spyware focuses on popular exchanges like Coinbase, Binance, Kraken, and wallets such as Ledger and MetaMask.
• Infection occurs through malicious websites requiring zero user interaction to compromise devices.
• Malware payloads automatically erase themselves after successfully extracting victim data.
• iOS 26.3 update addresses vulnerabilities; Lockdown Mode provides additional defense against DarkSword.

Cybersecurity researchers have uncovered DarkSword, a sophisticated exploit chain compromising Apple devices running iOS versions 18.4 to 18.7. This attack framework utilizes six previously unknown zero-day security flaws to deploy surveillance malware on targeted iPhones. Active campaigns have been detected across Saudi Arabia, Ukraine, Malaysia, and Turkey, indicating widespread deployment.

The DarkSword framework installs data-stealing malware capable of harvesting authentication credentials, communication records, and geolocation data. Cryptocurrency applications and digital wallets represent primary targets for this malicious campaign. Victims become infected simply by visiting weaponized web pages, requiring no clicks or downloads.

Security analysts have documented three distinct malware variants delivered via DarkSword: Ghostblade, Ghostknife, and Ghostsaber. These payloads rapidly extract targeted information before automatically removing themselves from infected systems. Evidence suggests both commercial surveillance companies and government-sponsored hacking groups are utilizing DarkSword in their operations.

Ghostblade Malware Hunts Cryptocurrency Applications

The Ghostblade payload distributed through DarkSword systematically scans compromised iOS devices for cryptocurrency exchange apps. Its target list encompasses leading trading platforms: Coinbase, Binance, Kraken, Kucoin, OKX, and MEXC. Additionally, it searches for prominent wallet software including Ledger, Trezor, MetaMask, Exodus, Uniswap, Phantom, and Gnosis Safe.

Beyond digital currency theft, Ghostblade harvests text messages, iMessages, phone logs, and contact lists from infected devices. The spyware extracts Wi-Fi passwords, Safari browser cookies, web history, and GPS coordinates. It further accesses Apple Health records, photo libraries, and conversations from messaging platforms like Telegram and WhatsApp.

Ghostblade executes a hit-and-run strategy, removing temporary artifacts and self-destructing after completing data exfiltration. This rapid execution minimizes forensic evidence left on compromised devices. The deployment of Ghostblade through DarkSword demonstrates escalating threats facing cryptocurrency holders.

Worldwide Campaign Distribution and Technical Operation

DarkSword deployment has been documented through weaponized websites and hijacked government web portals. Saudi Arabian victims were lured through a counterfeit Snapchat-themed page hosting the DarkSword exploit. The attack framework generates hidden iframes and retrieves remote code execution modules to inject malware payloads.

Various remote code execution exploits within DarkSword target distinct iOS versions, exploiting memory handling flaws and pointer authentication bypass weaknesses. The loader mechanism occasionally struggles with device version identification, suggesting accelerated development timelines. Nevertheless, DarkSword successfully delivers terminal payloads including Ghostknife and Ghostsaber across affected devices.

Security teams disclosed these vulnerabilities to Apple during late 2025, with remediation patches released in iOS 26.3. Domains associated with DarkSword distribution have been incorporated into browser Safe Browsing databases. iPhone owners should immediately install iOS updates or activate Lockdown Mode to defend against DarkSword exploitation.

DarkSword represents a critical security challenge for iOS cryptocurrency users worldwide. The exploit’s swift proliferation among diverse threat actors demonstrates heightened risks to digital financial holdings. Its comprehensive targeting of exchanges, wallets, and personal information emphasizes the urgency of applying available security patches.

Oil volatility triggered by the Iran conflict is pushing traders onto decentralized exchanges (DEXs) like Hyperliquid, where markets never close, Wall Street investment bank JPMorgan said in a Wednesday report.

The bank flagged a surge in activity from non-crypto investors using perpetual futures, derivatives with no expiry, to gain round-the-clock oil exposure. Unlike traditional venues, these contracts trade 24/7 and use funding rates to track spot prices.

“In particular, oil trading exploded on the Hyperliquid exchange early this month when the Iran war erupted as CME traders were unable to react when Iranian infrastructure strikes broke over the weekend,” wrote analysts led by Nikolaos Panigirtzoglou.

Market volatility spiked following the outbreak of war in the Middle East, with oil prices leading sharp moves as traders reacted to supply risks and geopolitical uncertainty. The initial shock was amplified by thin liquidity outside traditional trading hours, driving wider price swings and pushing investors toward venues offering continuous, 24/7 market access.

A decentralized exchange (DEX) is a peer-to-peer marketplace where users trade crypto directly without intermediaries. Unlike centralized exchanges, DEXs are non-custodial, meaning users retain control over their private keys and funds.

Rather than relying on a central operator, DEXs use smart contracts to automatically execute trades and settle them onchain. These trustless systems are a fast-growing part of the crypto market and are driving new types of financial products.

With CME markets shut over the weekend, traders turned to Hyperliquid’s CL-USDC perpetual, which stayed open for price discovery. The contract, margined in USDC with up to 20x leverage, hit $1.7 billion in peak daily volume and is now the platform’s third-most traded product, the bank said. Open interest has climbed to about $300 million.

More broadly, the analysts said demand for 24/7 access to traditional assets is accelerating interest in DEXs. Platforms like Hyperliquid use onchain order books rather than automated market makers, offering tighter spreads and more precise execution closer to traditional markets.

Features such as sub-second finality and portfolio margining are further attracting institutional traders by enabling faster execution and more capital-efficient strategies.

As a result, DEXs are taking share from mid-tier centralized exchanges in crypto derivatives, driven by speed, liquidity, self-custody and continuous market access, according to the analysts.

The trend is likely to expand beyond commodities as DEXs capitalize on a key gap in traditional finance: markets that don’t close, the report added.

Hyperliquid’s HYPE token is up roughly 25% year-to-date, outperforming much of the broader crypto market.

Read more: Iranian crypto outflows jump 700% minutes after U.S.-Israeli airstrikes, Elliptic says

Coinbase (COIN) said it began offering perpetual stock futures to eligible non-U.S. retail and institutional traders, extending its derivatives product line into U.S. equities.

The contracts let traders take leveraged positions on a group of large-cap U.S. stocks, colloquially known as the Magnificent 7: Apple, Microsoft, Alphabet, Amazon, Nvidia, Meta and Tesla. Perpetual futures tied to the SPY and QQQ exchange-traded funds, which track the S&P 500 and Nasdaq 100 indices, are also available in some jurisdictions, the exchange said in a Friday blog post.

Unlike standard futures contracts, perpetual futures have no expiry date. Coinbase’s contracts are cash-settled in USDC, a dollar-pegged stablecoin issued by Circle Internet (CRCL).

Coinbase said traders can use up to 10-times leverage on single-stock contracts and up to 20-times on ETF products. Demand for round-the-clock equity exposure, it added, has been growing rapidly, and most of the offerings have been concentrated on decentralized platforms.

The largest such decentralized platform is Hyperliquid, which earlier this week introduced S&P 500 perpetual futures contracts. The platform has become a hotbed for contracts tied to traditional financial instruments, including oil-linked contracts that are trading round-the-clock as war erupts in the Middle East.

Coinbase also said the product uses the same risk engine that supports its crypto derivatives markets, with cross-margining across perpetual futures and spot positions.

The move comes as the exchange expands the range of assets available on its platform as part of a bid to become the “Everything Exchange.”

Coinbase has expanded its stock perpetual futures offering to eligible non-U.S. traders, delivering leveraged, cash-settled exposure to major U.S. equities and indices on its non-U.S. trading rails. The rollout, disclosed in a Friday blog post, underscores Coinbase’s ongoing effort to provide a unified platform where crypto, stocks, and event-based contracts can be accessed in a single account.

The product is not available to U.S. residents at this time, with Coinbase indicating it is working to extend the offering to additional regions in the future. Access is currently limited to retail users on Coinbase Advanced and to institutions on Coinbase International Exchange, featuring perpetual contracts tied to notable stocks such as Apple and Nvidia.

Key takeaways

• Stock perpetual futures deliver leveraged, cash-settled exposure to major U.S. equities (including Apple and Nvidia) via Coinbase Advanced for retail clients and Coinbase International Exchange for institutions, aimed at crypto-style trading familiarity.
• The launch aligns with Coinbase’s broader 2026 roadmap, which centers on a multi-asset, “everything exchange” built around stablecoins, its Base layer-2 network, and a brokerage model spanning crypto and traditional assets.
• Europe already saw a related move earlier in March, when Coinbase rolled out perpetual futures for Coinbase Advanced users across 26 MiFID-regulated countries, signaling a broader international push beyond the U.S. footprint.
• In the wider market, several platforms offer tokenized or perpetual equity exposure to non-U.S. traders, including Binance and Kraken, highlighting an active, competitive space for synthetic stock products and on-chain real-world assets.

Non-U.S. expansion shapes Coinbase’s multi-asset strategy

Coinbase framed stock perpetual futures as a core element of its non-U.S. trading expansion, presenting a format familiar to crypto traders while delivering exposure to traditional equities. The company notes that the product is not yet available to U.S. persons, but it plans to broaden coverage to additional regions over time. By offering leveraged, cash-settled exposure on both its retail-focused Coinbase Advanced platform and its institutional Coinbase International Exchange, Coinbase aims to provide a seamless cross-asset experience without requiring users to toggle between separate apps or brokers.

Coinbase’s move dovetails with its stated ambition to evolve into an “everything exchange.” In January, CEO Brian Armstrong highlighted a priority to grow global access to crypto, equities, prediction markets, and commodities within a single ecosystem, emphasizing a strategy that places stablecoins, the Base network, and multi-asset brokerage at the heart of its 2026 outlook.

European rollout complements a broader regulatory push

Europe’s earlier March iteration of the stock perpetual futures program rolled out under Coinbase’s MiFID-compliant entity, covering 26 countries. The European effort demonstrates how Coinbase is threading regulatory compliance with product expansion, enabling non-U.S. users to trade synthetic stock products in a framework designed to align with regional oversight.

The Europe-focused expansion also mirrors a broader trajectory in which crypto-native platforms seek to bridge traditional capital markets with digital trading mechanics. As part of its multi-asset ambition, Coinbase is positioning itself to offer a spectrum of instruments—from tokens and tokens-to-equities to event-driven contracts—that can operate alongside cash equities, futures, and options in a single interface.

Rivals, regulation, and the evolving landscape for equity perps

The stock perpetual sector remains fragmented but increasingly crowded. Coinbase is entering a field where other non-U.S. platforms have ventured into equity exposure, including Binance’s equity perpetual contracts and Kraken’s tokenized-equity perpetual futures for global traders. A cluster of offshore platforms also list single-stock and index perpetuals with varying degrees of regulatory oversight. In March, the tokenization of stocks reached a notable milestone, surpassing $1 billion in on-chain value, underscoring the rapid growth of real-world assets tied to blockchain networks and the demand for cross-market access among traders.

As regulators weigh appropriate guardrails for synthetic equities and tokenized assets, Coinbase’s Europe launch under a MiFID framework and its ongoing U.S. non-availability stance for this product reflect a cautious approach: expand functionality where oversight exists, while continuing to navigate the evolving rules that govern cross-border crypto and traditional markets.

Strategic significance for Coinbase’s broader platform

Stock perpetual futures reinforce Coinbase’s vision of a single, multi-asset marketplace. By integrating stock-like exposure with the familiar crypto trading flow, the company signals a path toward deeper liquidity and more versatile product design—an attractive proposition for traders seeking diversified exposure without managing multiple counterparties or platforms. The European rollout, paired with the ongoing push in non-U.S. regions, suggests Coinbase views global expansion as a critical lever for user acquisition and retention across its ecosystem.

What remains uncertain is the pace and geography of the U.S. configuration for stock perpetuals, and how upcoming regulatory developments might shape access, risk controls, and product scope. Investors and users should watch for further regional expansions, updates on leverage and settlement specifics, and any changes to eligibility criteria as Coinbase continues to push toward a broader, all-in-one trading experience.

Readers should keep an eye on the next steps in Coinbase’s international roadmap and any official communications detailing new regions, asset coverage, and pruning of regulatory friction, which could redefine how traditional equities are accessed within crypto-native trading environments.

Source references: Coinbase’s official blog post on stock perpetual futures and related corporate statements; prior European MiFID rollout announcements; ongoing market reports on tokenized stocks and cross-asset platforms.

The World Gold Council has proposed plans to develop a platform that will change how the metal operates in digital financial systems.

In a white paper released on March 18, the World Gold Council outlined plans for a proposed “Gold as a Service” platform that would “support the issuance and operation of scalable, interoperable digital gold products.”

The platform would link the physical custody of gold with digital systems used to issue and manage tokenized gold products. It would standardize essential market processes such as custody coordination, reconciliation, compliance, and redemption to “reduce operational complexity, improve access, and enable greater consistency across digital gold products,” the World Gold Council said.

Among some of the key features, the new service would include standardizing tokenized gold issuance and management, improving digital gold’s fungibility, embedding audits and assurance, enabling interoperability with existing financial rails, and improving liquidity in lending and borrowing markets.

According to CEO David Tait, gold must evolve to maintain its role in the global financial system.

“Shared infrastructure can help gold become more accessible, more easily traded and fully integrated into modern financial systems, ensuring it remains as relevant tomorrow as it has been for millennia,” he added.

It must be noted that similar products already exist, such as Tether Gold or Pax Gold, which have built their own custody, compliance, and redemption frameworks. However, the Council’s position in the space could offer its platform an edge among institutional participants.

As previously reported by crypto.news, in September last year, Tait said the group was working on a framework that would allow participants to “pass gold digitally around the gold ecosystem, as collateral, for the first time.”

He said gold is often seen as a static unyielding asset, and by digitalizing it, the metal could be used for margins and collateral, generating profit for investors through a structure referred to as “pooled gold interest” or PGI.

A pilot for the initiative was planned for the first quarter of 2026.

The British pound continues to weaken against major peers following a brief recovery earlier this week. After notable losses at the end of last week, sterling attempted a corrective rebound at the start of the current week, but pressure resumed following the Federal Reserve’s meeting.

While the decision to keep interest rates unchanged was widely expected, comments from Chair Jerome Powell were interpreted as moderately hawkish. The central bank signalled that it is in no rush to begin easing policy, as inflation risks remain elevated. Against this backdrop, US Treasury yields moved higher, supporting the dollar and weighing on most currencies, including the pound.

An additional source of caution is the upcoming Bank of England meeting. Investors are closely monitoring the vote split within the Monetary Policy Committee, the accompanying statement, and policymakers’ remarks, as any signals pointing towards potential policy easing could put further pressure on sterling.

GBP/USD

The upward correction in GBP/USD seen earlier this week stalled near the key resistance level of 1.3370. Technical analysis suggests a potential retest of the recent low around 1.3210, as a bearish engulfing pattern has formed on the daily timeframe.

Should today’s decision by the Bank of England provide support to sterling buyers, another attempt to test the 1.3370 level cannot be ruled out.

Key events for GBP/USD:

• today at 09:00 (GMT+2): UK claimant count change;
• today at 09:00 (GMT+2): Bank of England Monetary Policy Committee minutes;
• today at 14:30 (GMT+2): Philadelphia Fed Manufacturing Index (US).

GBP/JPY

The GBP/JPY pair rose to 212.70 yesterday but sharply reversed following the Federal Reserve meeting, closing the session below 212.00. A “dark cloud cover” candlestick pattern has formed on the daily chart, signalling the potential for a move lower towards last week’s lows in the 210.40–210.80 range.

Key events for GBP/JPY:

• today at 14:00 (GMT+2): Bank of England interest rate decision;
• today at 14:00 (GMT+2): Bank of England Monetary Policy Committee minutes;
• tomorrow at 09:00 (GMT+2): UK public sector net cash requirement.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

South Korea’s National Tax Service is seeking to select a private custody provider to handle seized crypto assets after a security lapse resulted in private keys being exposed and assets being transferred by unauthorized entities.

The National Tax Service has begun reviewing a plan to outsource custody of confiscated crypto assets, according to a report from ZDNet Korea.

The latest action follows a security mishap on Feb. 26, when a wallet recovery phrase was exposed in an official press release. Images of a Ledger cold wallet and a sheet of paper showing the mnemonic phrase were published. Subsequently, unauthorized transfers of crypto tokens worth about $4.8 million took place.

As such, the agency will now evaluate candidates based on several factors, including security requirements, company size, and whether the firm holds insurance under South Korea’s Virtual Asset User Protection Act, the report said.

A newly formed task force focused on digital asset management systems will lead the process. The task force is already working on several initiatives, including improving operational manuals covering the full lifecycle of seized assets, from seizure to storage and liquidation. It will also conduct internal assessments and personnel training.

Meanwhile, the task force will also work toward establishing a dedicated division to oversee crypto-related work.

An NTS official cited in the report said responsibilities are split across departments, but added that preparations are underway to create a centralized unit.

The NTS incident is one of the many that have surfaced across South Korea over the past months. At least two other similar incidents were recorded involving law enforcement and other agencies, where seized crypto assets were lost or compromised.

As previously reported by crypto.news, South Korea’s National Police Agency has introduced new guidelines for handling seized cryptocurrencies. Law enforcement agencies would now have to follow standardized procedures when handling wallet addresses, private keys, and storage systems.

Key Highlights

• National Tax Service transitions to external custodians following $4.8M breach.

• Public exposure of seed phrase triggers comprehensive custody reform.

• Custodian selection prioritizes insurance coverage and proven track records.

• Dedicated oversight team will centralize confiscated asset management.

• Reform initiative matches international best practices for digital custody.

Following a significant security incident, South Korea’s National Tax Service has announced plans to engage private custody solutions for managing confiscated digital currencies. The agency inadvertently revealed a wallet’s recovery phrase in publicly released documentation on February 26, enabling unauthorized withdrawals totaling $4.8 million. Officials are implementing comprehensive safeguards to eliminate similar vulnerabilities and enhance asset protection protocols.

The security lapse centered on an insufficiently redacted photograph displaying a Ledger hardware wallet alongside its complete mnemonic recovery sequence. This episode exposed critical gaps in South Korea’s current framework for managing government-controlled digital holdings. The tax authority intends to transfer custody responsibilities to specialized providers equipped with robust security infrastructure and comprehensive insurance policies.

This strategic pivot occurs as regulatory expectations intensify for appropriate virtual asset stewardship. The National Tax Service has established a target completion date within 2026’s first two quarters for finalizing custodian partnerships. The initiative represents South Korea’s commitment to professionalizing its approach to handling seized cryptocurrency holdings.

Evaluation Framework and Administrative Safeguards

The tax agency is constructing comprehensive benchmarks for assessing prospective custody partners. Security qualifications encompass cutting-edge cybersecurity protocols, multi-party authorization systems, and hardened storage infrastructure. Candidates must carry insurance mandated by South Korea’s Virtual Asset User Protection Act, providing safeguards against system breakdowns and operational mishaps.

Company scale and fiscal soundness represent critical evaluation components in South Korea’s vetting framework. Prospective custodians must showcase expertise managing substantial digital currency portfolios for governmental or institutional clientele. Operational clarity, comprehensive audit mechanisms, and robust contingency planning will serve as fundamental prerequisites during the selection phase.

South Korea’s NTS is assembling a dedicated supervisory unit to manage the custodian selection initiative. This team will develop standardized operating procedures, employee education programs, and comprehensive management strategies for confiscated digital holdings. The centralization effort seeks to consolidate functions presently distributed among various administrative units.

Historical Context and Legal Framework

South Korea’s recent custody failure adds to previous incidents, including municipal law enforcement’s loss of 22 Bitcoin. Responding to these setbacks, government authorities initiated a multi-department investigation examining asset management practices and identifying preventive measures. This coordinated response demonstrates a systematic commitment to protecting South Korea’s expanding inventory of confiscated cryptocurrencies.

The Virtual Asset User Protection Act establishes the regulatory foundation supporting South Korea’s custody transformation. This legislation requires insurance coverage, regulatory compliance, and reserve holdings for all authorized service operators. South Korea’s policy direction aligns with worldwide patterns where governmental bodies increasingly depend on specialist custodians for blockchain-based assets.

The forthcoming custody infrastructure will create uniform processes governing seizure activities, secure storage, and eventual liquidation of digital currencies. South Korea plans to strengthen technical capabilities, encompassing wallet administration, cryptographic key management, and distributed ledger surveillance. This framework additionally prepares South Korea to extend professional custody services throughout various governmental departments.

South Korea’s National Tax Service anticipates that engaging private custodians will substantially diminish security vulnerabilities and procedural breakdowns. This strategic shift demonstrates enhanced institutional capacity for cryptocurrency-related enforcement activities. The implementation of specialized custody partnerships underscores South Korea’s dedication to secure, compliant administration of seized virtual assets.

Bitcoin (BTC) has endured a 14-month bear market against gold, with the BTC/gold ratio and momentum indicators at historic lows that previously marked cycle bottoms.

Key takeaways:

• The BTC/GOLD ratio is at historic lows as multiple indicators hint at a cycle bottom.

• Bitcoin price must hold $70,000 to avoid a deeper drop over the coming weeks.

BTC/GOLD RSI, MACD print classic reversal signal

Data from TradingView reveals that the relative strength index (RSI) of the BTC/GOLD ratio has begun climbing.

The weekly RSI reached its most oversold level of 21 in mid-February, signaling fading bearish momentum.

Related: Bitcoin tests old 2021 top as gold falls to six-week lows under $4.7K

Similarly, the moving average convergence divergence (MACD) indicator has dropped to its lowest level ever and is about to produce a bullish cross.

Note that previous bullish crosses, particularly coming after the RSI has recovered from oversold conditions, have marked macro bottoms for the ratio.

This ultimately led to 280%-620% Bitcoin price breakout against gold, as seen in 2019, 2021, and 2023.

The RSI has now recovered to 33 from 21 in mid-February. When combined with a buy signal on the MACD, the picture begins to resemble previous cycles.

“Bottom is in for $BTC vs Gold,” technical analyst James Easto said in an X post on Friday, adding that the “stage is set” for Bitcoin’s recovery.

The last time Bitcoin bottomed against gold was in November 2022. It marked the beginning of a 700% BTC price rally to its current all-time high of $126,000.

Analysts at GeoMetric said the past 3 BTC/GOLD bear markets have taken between 12-14 months, with the drawdowns ranging from 75% to 84%.

About 13 months have elapsed in the current cycle, which has “so far gone down 81%, surpassing the 2021 bear market,” the analysts said, adding:

“I think there is a solid case for a potential bottom here.”

Investor and analyst Crypto Fergani echoed both scenarios discussed above saying:

“For over 13 years, we’ve seen the same pattern:
Bitcoin enters a bear market against gold
that lasts roughly 400 days. During that time, the RSI
falls into deeply oversold territory. Historically, these phases have always marked the bottom.”

Bitcoin price must hold above $70,000

Meanwhile, BTC/USD remains cautiously bullish as long as it holds the $68,000-$70,000 support zone. This is where the 200-week exponential moving average (EMA) and 50-day simple moving average sit.

The 200-week EMA forms a key support band for BTC price during bear markets, and analysts warn that its reliability could be tested on Sunday’s weekly close.

Bitcoin analyst AlphaBTC said he had faith that Bitcoin will recover to $80,000 before dropping toward $50,000, as long as the price stayed above the weekly low at $68,800.

“I don’t want to see this week’s low lost, otherwise it’s going to break back down to range lows or lower!”

As Cointelegraph reported, holding $70,000 would align with a previous fractal recovery path, opening a move toward $76,000-$80,000.