U.S. federal law enforcement says it has helped disrupt a long-running cybercrime operation tied to cryptocurrency theft, working alongside international partners and private-sector cybersecurity experts. The Justice Department announced that the Sality malware and its botnet infrastructure were targeted in an effort spanning multiple countries.

According to the U.S. Justice Department, the operation involved Bulgarian, Hungarian and Romanian authorities, as well as partners including CrowdStrike and the Shadowserver Foundation. The department said Sality was used to compromise devices and facilitate theft of digital assets, with activity traced back to 2003.

Key takeaways

• The U.S. Justice Department said it disrupted the Sality botnet and associated malware in an international takedown effort.
• CrowdStrike linked the scheme to clipjacking behavior that targets cryptocurrency wallet addresses copied to a clipboard.
• U.S. officials and CrowdStrike described a peer-to-peer botnet of roughly 15,000 infected computers checking connectivity every 40 minutes.
• CrowdStrike reported at least 12.1 million rubles (about $150,000) stolen over an eight-year period tied to “never-spent” digital assets, with a peak value around January 2025.

What the Justice Department says was targeted

In a Tuesday notice, the U.S. Justice Department stated that it had “disrupted the Sality botnet and malware” through a coordinated international operation. The department’s announcement names government agencies in Bulgaria, Hungary and Romania, while also citing private-sector support from CrowdStrike and the Shadowserver Foundation.

Officials said Sality malware was responsible for installing malicious code on compromised systems. They tied that activity to both cryptocurrency theft and broader cyberattacks. While the announcement frames the action as a disruption rather than a total elimination, the message is clear: the takedown interfered with the malware’s ability to coordinate with infected machines.

The announcement also underscores why botnets remain a key threat vector for the crypto sector. Malware operators can use compromised endpoints to manipulate users and move stolen assets, turning ordinary wallet operations—like copy-and-paste—into moments of vulnerability.

The clipjacking mechanism behind the crypto theft

CrowdStrike provided technical detail on how actors behind Sality allegedly harvested cryptocurrency payments. In a post describing the operation, the company said the criminals used EggJagger, described as a “clipjacking tool” that monitors a device’s clipboard for cryptocurrency wallet addresses.

The method is designed to be difficult for victims to notice. When a user copies a Bitcoin or Ethereum address to send funds, CrowdStrike said the malware can silently replace that address with one controlled by the attacker. In its explanation, CrowdStrike said that “funds are redirected” when the victim pastes the altered destination address into a payment.

This matters for investors and users because it highlights a persistent class of wallet-related risk: attacks do not always require users to install obviously malicious software. Instead, they can compromise normal device behavior and quietly reroute transactions.

Scale and operational details described by CrowdStrike

CrowdStrike said that in the eight years preceding the disruption, the operators behind Sality used EggJagger to steal at least 12.1 million rubles—about $150,000 in cryptocurrency—by redirecting copied wallet addresses. The company also reported that the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

Officials and CrowdStrike described a network architecture built around peer-to-peer communication. In their account, around 15,000 infected computers formed a botnet that would check whether systems were online every 40 minutes. The operational cadence is notable: such periodic communication patterns often help attackers maintain control while keeping command-and-control traffic manageable.

As a result of the authorities’ efforts, CrowdStrike and U.S. officials said the criminals “lost the ability to communicate with infected machines.” That shift is a practical outcome of takedowns: even if some malware remains on endpoints, the attacker’s capacity to coordinate, update tactics, or manage automated theft can be severely reduced.

Why this takedown is significant for crypto security

Criminal ecosystems built around clipboard manipulation reflect a larger reality for the cryptocurrency space: user behavior and device integrity are often the weakest links. The Sality/EggJagger case demonstrates that even basic actions—copying addresses—can become an attack surface when malware is present.

For defenders, the episode reinforces the importance of hardening endpoints and monitoring for suspicious clipboard activity, not just traditional signs of malware infection. For crypto users, it strengthens the case for safer transfer practices such as verifying addresses through trusted channels and being cautious when transactions are prepared on potentially compromised systems.

From a broader market perspective, disruptions like this can reduce the flow of stolen assets—though the exact immediate impact is hard to quantify from public reporting alone. What is clear from the announcements is that law enforcement and security researchers were able to interfere with a mature cybercrime setup that had been active for years.

Looking ahead, readers should watch for two things: whether additional reporting clarifies how many victims were impacted in total, and whether security teams publish indicators or mitigation guidance connected to Sality and EggJagger techniques. As the ability to communicate with infected machines has been disrupted, the more enduring question is how quickly attackers will attempt to reconstitute similar clipboard-stealing capabilities elsewhere.

New Jersey has asked the U.S. Supreme Court to decide whether federal derivatives law prevents states from regulating sports contracts offered by CFTC-registered prediction markets.

A Sept. 2 court filing shows that New Jersey has petitioned the Supreme Court for a writ of certiorari, asking the justices to review a Third U.S. Circuit Court of Appeals decision that favored Kalshi.

The petition asks whether the Dodd-Frank Wall Street Reform and Consumer Protection Act prevents states from applying their sports-gambling laws to bets made within their borders when the contracts are offered on a market registered with the Commodity Futures Trading Commission.

Kalshi operates a designated contract market overseen by the CFTC. The company treats its sports products as event contracts governed by federal derivatives rules, while New Jersey considers them sports wagers subject to state licensing and consumer-protection requirements.

New Jersey challenges Kalshi’s Third Circuit victory

In April, the Third Circuit upheld preliminary relief that stopped New Jersey regulators from enforcing state gambling laws against Kalshi’s sports contracts.

The appellate court found that Kalshi had shown a reasonable chance of succeeding on its claim that sports event contracts qualify as swaps under the Commodity Exchange Act. Under that interpretation, the CFTC’s exclusive jurisdiction could displace conflicting state requirements.

As crypto.news reported at the time, the decision did not settle the full lawsuit. It affirmed a preliminary injunction, meaning the court assessed Kalshi’s likelihood of success without issuing a final judgment on every part of the dispute.

New Jersey is now asking the Supreme Court to reject the appellate court’s interpretation. According to the petition, Congress did not clearly authorize federally registered markets to offer sports betting across the country without complying with state gambling laws.

State officials also argue that sports wagering has long fallen under state authority. Under New Jersey’s position, registering an exchange with the CFTC does not automatically turn a sports bet into a federally protected financial contract.

The petition challenges the Third Circuit’s treatment of sports event contracts as swaps, a classification central to Kalshi’s federal preemption argument. If the products do not fall within that category, the state contends that the Commodity Exchange Act’s exclusive-jurisdiction provision cannot shield them from local enforcement.

Conflicting Kalshi rulings strengthen the request for review

New Jersey’s filing points to a conflicting decision from the Ninth U.S. Circuit Court of Appeals, which recently allowed Nevada to enforce its gaming laws against prediction market sports contracts.

In the Nevada dispute, the Ninth Circuit found that sports contracts were likely wagers rather than swaps covered by the Commodity Exchange Act. The court rejected the argument that CFTC oversight automatically prevented state regulators from acting.

The Ninth Circuit ruling produced a direct disagreement between two federal appellate courts. Kalshi has protection from New Jersey enforcement under the Third Circuit’s reasoning, while prediction market operators face state gambling controls within the Ninth Circuit.

A split between appellate courts is one factor the Supreme Court considers when deciding whether to hear a case, although the filing does not mean the justices have accepted New Jersey’s petition. Kalshi will have an opportunity to respond before the court decides whether to grant review.

The state cited the Ninth Circuit decision in its petition, arguing that the opposing rulings have created uncertainty over the line between federal derivatives oversight and state gambling regulation.

Similar disputes have already spread to other jurisdictions. In August, a federal judge rejected Coinbase’s request to block Michigan regulators from taking action against sports prediction markets, while New York has separately sued Kalshi over products that state officials describe as unlicensed gambling.

New York’s complaint seeks at least $36 billion in penalties and restitution. The state has accused Kalshi of offering unlicensed wagering products and allowing access without the safeguards required of licensed sportsbooks, allegations that Kalshi disputes.

By mid-August, the state enforcement fight had produced more than 20 lawsuits and cease-and-desist actions across the United States. Arizona had also filed criminal charges, while several other states had ordered prediction market operators to stop offering sports-related products.

Major-questions doctrine enters the Kalshi case

Sports law attorney Daniel Wallach said New Jersey’s petition invokes the major-questions doctrine, which courts use when an agency claims authority over an issue carrying major economic or political consequences without clear direction from Congress.

Quoting earlier Supreme Court language, the state called the Third Circuit’s interpretation an “astonishing” conclusion with grave “economic and political consequences.”

New Jersey also argued that allowing federal derivatives law to displace state sports-gambling rules would represent a “significant change in the sensitive relation between federal and state” power in an area of “traditional state authority.”

Under the state’s argument, Congress would have needed to speak clearly before allowing the CFTC’s authority to override local sports-betting laws. The petition says Dodd-Frank contains no clear statement giving federally registered exchanges nationwide immunity from state gambling controls.

Kalshi offered a different reading in a statement shared with Front Office Sports. The company said the Ninth Circuit still accepted the central principle that the CFTC’s exclusive jurisdiction can preempt state law, while disagreeing over how an existing regulation applies to sports contracts.

According to Kalshi, the regulation behind that disagreement is already being rewritten.

“We remain confident in the lower courts’ rulings, and nothing in New Jersey’s filing today changes our view,” the company said.

The CFTC has proposed changes to its event-contract rules, but any final regulation could face a separate court challenge over the agency’s legal authority or rulemaking process. The Ninth Circuit decision could also give states another basis for contesting a rule that treats sports contracts as federally governed derivatives.

Prediction market valuations continue to climb

While legal challenges have spread across the United States, private investors have continued assigning multibillion-dollar valuations to the largest prediction market platforms.

An Aug. 25 SEC filing showed that Kalshi had sold approximately $1.12 billion in equity since April, with about $380 million left under an offering of nearly $1.5 billion. The filing did not identify which financing rounds were included in the amount already sold.

Kalshi’s recent equity filing may include its $1 billion Series F round, which valued the company at $22 billion. Coatue led that financing with participation from Sequoia Capital, Andreessen Horowitz, IVP, Paradigm, Morgan Stanley, and ARK Invest.

Company figures released around the Series F placed Kalshi’s annualized trading volume at $178 billion, up from $52 billion over six months. Kalshi also reported more than two million monthly users and about $1.5 billion in annualized revenue at the time.

Sports accounted for an estimated 85% to 90% of Kalshi’s trading volume, according to figures discussed during a May prediction market debate at Consensus Miami. The concentration makes the classification of sports contracts material to the company’s U.S. operations.

Rival Polymarket is also seeking new funding. A reported $1 billion round would value the company at approximately $21 billion, with Donald Trump Jr.-linked 1789 Capital planning to invest about $300 million.

Polymarket’s U.S. business operates through QCX LLC, a CFTC-designated contract market acquired by the company. Intercontinental Exchange, the owner of the New York Stock Exchange, remained Polymarket’s largest investor after accumulating an approximately 22% stake, according to the Wall Street Journal.

For many long-term XRP holders, waiting for market prices to rise has been a common strategy, however, the cryptocurrency market is highly volatile, and relying solely on price fluctuations for profit means facing market uncertainty.

With the continuous development of automation and intelligent systems, more and more digital asset users are focusing on more convenient ways to use their assets. XRPPower is now launching a limited-time participation program for eligible XRP users, allowing them to learn about and experience the platform’s automated trading system, exploring long-term daily profit opportunities while reducing complex manual operations.

This program aims to provide long-term XRP holders with more digital asset service options. Through automated systems and pre-set operating mechanisms, users can participate in related services without frequently monitoring market changes or engaging in lengthy manual operations.

How can new users join XRPPower and learn about its services?

1. Free account registration

You can quickly create an XRPPower account using your frequently used email address; the registration process is simple and convenient. After registration, you can access the platform to learn about related functions, services, and different plans.

2. Understanding platform services and plans

Based on your individual needs, view the duration, participation conditions, and related rules of different service plans. Before participating, it is recommended to fully understand the service content and potential risks.

3. Participate using supported digital assets

Depending on the payment methods provided by the platform, users can use supported digital assets such as XRP, BTC, ETH, and USDT to participate in related services. Please confirm the specific conditions and rules before proceeding.

4. View account information and service records

Users can view relevant service records, balance changes, and historical information through their accounts at any time for a clearer understanding of their account status.

Based on individual needs and platform rules, users can apply for withdrawals or continue to explore other service options offered by the platform.

Some popular profitable contracts

Investment Amount: $1000, Investment Period: 7 days, Daily Yield: $13.2, Principal Returned at Maturity: $1000

Investment Amount: $5000, Investment Period: 15 days, Daily Yield: $70.5, Principal Returned at Maturity: $5000

Investment Amount: $10000, Investment Period: 20 days, Daily Yield: $153, Principal Returned at Maturity: $10000

Click to view all contract yields

How to achieve long-term returns with zero investment

New users receive a $21 bonus upon registration, which can be used to purchase daily contracts, earning $0.60 per day.

Additional referral rewards

Log in to your account using your referral code or request link to invite friends and family to join the XRPPower platform and earn permanent rewards of 3% + 2%.

Example description:

(A) User A refers User B to make an additional investment; if B invests $10,000, A will receive a 3% ($300) reward.

(B) User B refers User C to make an additional investment; if C invests $10,000, B will receive a 3% ($300) reward, while A will receive a 2% ($200) second-level referral reward.

XRPPower Intelligent Technology System: Continuously enhancing security, efficiency, and transparency

In today’s ever-evolving digital service landscape, users are increasingly focused on platform security, system stability, operational efficiency, and information transparency. XRPPower continuously improves its technical architecture and service processes around these core areas, providing users with a clearer and more convenient digital service experience.

Strengthening security architecture and enhancing multi-Layer protection

XRPPower strengthens platform security through various technical measures, including SSL/TLS encryption, two-factor authentication (2FA), cold and hot wallet isolation, multi-signature, and access control management.

Simultaneously, the platform continuously monitors the relevant practices of international professional institutions in risk management, internal control, and information security, and references the professional concepts of international professional auditing and consulting firms such as PwC to continuously optimize internal management and security processes.

Intelligent monitoring for more efficient system operation

XRPPower applies intelligent data analysis and automation technologies to daily system operations, monitoring system status and abnormal activity to help improve risk identification and operational efficiency.

Furthermore, the platform combines DDoS protection, Web Application Firewall (WAF), and other network security technologies to continuously strengthen network and infrastructure protection capabilities.

Making service information clearer and more understandable

To help users better understand the platform, XRPPower continuously optimizes service pages and account functions, providing a clearer display of service rules, participation conditions, cycles, and related information.

Users can view relevant records and information through their accounts and independently understand and select relevant services according to their needs.

Continuous innovation, driving technology and service upgrades

As artificial intelligence and digital infrastructure technologies continue to develop, XRPPower will continue to monitor industry changes and improve its overall service capabilities through technology updates, system optimization, and process refinement.

In the future, the platform will continue to focus on security, stability, transparency, and intelligence, continuously improving its digital service system to provide users with a more convenient and efficient service experience.

Learn more: https://xrppower.com/

Email: [email protected]

Bitcoin (BTC) sold off into the early European trading hours on Wednesday to hit local lows of $76,400, per data from CoinGecko.

Key points: 

• Bitcoin’s apparent demand indicator turns negative again, with BTC price dropping to a local low of $76,400 before reclaiming $77,000.
• USD/JPY drops sharply to 158.5, sparking speculation that another yen intervention has taken place.
• Asian equities sell off sharply as South Korea’s KOSPI falls 4.0% to 6,562.72 and Japan’s Nikkei 225 drops 2.9% to 64,325.64.

Bitcoin’s apparent demand flips negative again

The move in BTC came after US spot Bitcoin exchange-traded funds (ETFs) recorded outflows of $236 million the day prior. Data from CryptoQuant now shows Bitcoin’s apparent demand turning negative once more after a brief reprieve during the August rally. 

Bitcoin price and apparent demand, 30-day change. Source: CryptoQuant

The indicator is inspired by similar metrics from commodity markets and measures the difference between newly mined issuance and changes in inactive supply. Positive demand implies that old coins are waking up and the market is absorbing them along with new issuance. This is taken to be a sign of active spot demand. Negative readings mean coins are aging into dormancy faster than miners issue them. 

At the time of writing, BTC has reclaimed $77,000, but remains pinned under a cluster of resistance that we have previously reported on. 

Bonds and Asian equities sell off

The global bond rout that Cointelegraph reported on Monday eased slightly as the US 10-year yield briefly dipped below 4.8%. There was inorganic price action in the USD/JPY pair at 13:00 UTC, which commentators widely took as a sign of another central bank intervention. USD/JPY declined to 158.5, retreating from the psychological 160 level widely seen as a line the Bank of Japan (BOJ) will defend. At the time of writing, no official announcement on the matter has been made. 

USD/JPY trading pair one-day chart. Source: TradingView

Asian equities, meanwhile, suffered steep declines, likely driven by soaring oil prices and further profit-taking in the AI sector. South Korea’s KOSPI led the decline, falling 4.0% to close at 6,562.72 as chipmakers SK Hynix and Samsung Electronics shed 4% and 4.7%, respectively.

Related: Bitcoin lows pierce $63K as Asia chip-stock crash spreads to Wall Street

Japan’s Nikkei 225 fell 2.9% to 64,325.64, dragged down by tech heavyweights including SoftBank Group, an OpenAI investor. Taiwan’s TAIEX rounded out the losses with a 1.7% drop. Back in July, Cointelegraph reported on the first cracks beginning to show on the US side of the AI trade, as credit spreads on hyperscalers rose significantly. 

US federal law enforcement, in cooperation with cybersecurity company CrowdStrike and international partners, announced an operation targeting the Sality malware ecosystem—an infection chain authorities say has been used for more than two decades to steal cryptocurrency and carry out cyberattacks.

In a Tuesday announcement, the US Department of Justice (DOJ) said it disrupted the Sality botnet and related malware in an international effort involving Bulgarian, Hungarian, and Romanian officials, as well as private-sector partners CrowdStrike and the Shadowserver Foundation. The DOJ linked Sality to long-running compromise activity dating back to 2003, including the installation of malware on affected devices.

Key takeaways

• The DOJ says the Sality botnet and malware infrastructure were disrupted through a coordinated international takedown.
• CrowdStrike reports that clipboard-based “clipjacking” was used to replace cryptocurrency addresses with attacker-controlled ones.
• According to CrowdStrike, entities behind Sality stole at least 12.1 million rubles (about $150,000) over the prior eight years.
• Authorities described a peer-to-peer botnet of roughly 15,000 infected computers that periodically checked whether targets were online.
• During the operation, Sality operators reportedly lost the ability to communicate with infected machines.

Why clipboard hijacking matters for crypto security

The most consequential detail in the reporting is how the theft worked. CrowdStrike said that in the previous eight years, the operators used EggJagger, a clipjacking tool that monitors a victim’s clipboard for cryptocurrency wallet addresses and then silently swaps them for addresses controlled by the attacker.

In practical terms, the mechanism targets a common user behavior: copying and pasting wallet addresses when sending funds. According to CrowdStrike, when a victim copies a Bitcoin or Ethereum address to complete a payment, the funds are redirected to the substituted address.

This type of attack is particularly damaging because it doesn’t require the victim to sign malicious transactions or interact with a fake website in the moment. Instead, it compromises the transaction flow at the point of address entry—meaning users who rely on clipboard copy/paste can be tricked even if they never knowingly interact with malware prompts or phishing pages.

Scope and reported impact of the Sality operation

In its write-up on the takedown, CrowdStrike said that the clipjacking approach enabled theft of at least 12.1 million rubles, or roughly $150,000 in cryptocurrency, during the period it described. The company also emphasized that stolen assets remained “never-spent,” meaning the seized digital funds were not later spent or otherwise moved from the attacker-linked destinations in the observed timeframe.

It further stated that the value of these “never-spent” assets peaked at about $1.5 million in January 2025, giving a sense of how significant the stored proceeds could become once operational theft processes are running.

While the reported theft amount and peak valuation describe only what CrowdStrike observed in its analysis, they help clarify why disrupting the botnet’s communication channels is so important: if operators can’t reliably control or maintain infections, their ability to trigger address substitutions and collect funds diminishes.

How the botnet functioned—and what the disruption changed

US officials and CrowdStrike both described Sality as a peer-to-peer botnet. According to the company, about 15,000 infected computers were part of this network, which checked whether systems were online every 40 minutes. That periodic connectivity helped ensure the malware operators could maintain visibility into infection status and, when possible, continue malicious operations.

After the authorities’ efforts, CrowdStrike said the criminals “lost the ability to communicate with infected machines.” In botnet operations, that loss is often decisive: even if infected devices remain in place temporarily, removing command-and-control communications reduces the malware’s ability to coordinate, update, and execute its most profitable functions.

The DOJ’s announcement framed the disruption as part of a broader disruption of Sality malware and the botnet infrastructure tied to it, not just a removal of individual infections. For crypto users, the key takeaway is that these campaigns can persist for long periods—DOJ said Sality was responsible for installing malware on compromised devices since 2003—so enforcement actions and technical disruptions are critical for shrinking the attacker’s operational surface.

What investors and users should watch next

This takedown highlights how cryptocurrency theft campaigns increasingly blend malware distribution with human workflow attacks like clipboard hijacking. Users should treat clipboard-based address substitution as a real threat—especially when sending Bitcoin or Ethereum funds—and consider validating recipient addresses through out-of-band methods (for example, checking a pasted address against a trusted source or using verification steps in wallet software).

Looking ahead, the open question is how attackers adapt if their ability to communicate with infected machines is curtailed. Readers should watch for follow-on malware variants, new clipboard hijacking tools, or broader changes in how criminals maintain access to victim devices as the Sality infrastructure disruption ripples through criminal operations.

Kraken parent Payward has postponed its planned initial public offering until as early as the second quarter of 2027 after market conditions disrupted its previous listing schedule.

Kraken IPO timeline moves into 2027

As per reports on Wednesday, citing two people familiar with the matter, Payward had pushed the offering into the second quarter of 2027 at the earliest.

The new timeline extends the IPO process that has already faced several delays. Payward initially prepared for a public debut after cryptocurrency companies returned to U.S. equity markets in 2025, but falling digital asset prices and weaker trading activity made that schedule harder to maintain.

Payward confidentially submitted a draft registration statement on Form S-1 to the U.S. Securities and Exchange Commission in November 2025. A confidential filing allows a company to begin the SEC review process without immediately publishing its financial statements and other disclosures.

Kraken co-CEO Arjun Sethi later confirmed the confidential filing during an industry conference in April. Sethi said at the time that access to public capital was not the company’s main reason for pursuing a listing, describing regulatory trust and its long-term plans as more important factors.

In March, Payward paused its multi-billion-dollar offering as difficult market conditions reduced demand for new crypto stocks. Reuters said it could not independently confirm the report, while a Kraken spokesperson declined to comment on the listing plans.

An IPO in the second quarter of 2027 would still depend on SEC review, market conditions and Payward’s final decision to proceed. Since its draft filing remains confidential, the company has not publicly disclosed a proposed share price, ticker, exchange, or number of shares for sale.

Payward entered the process with a $20 billion valuation

Shortly before submitting the draft S-1, Payward completed an $800 million financing package across two tranches. The transaction valued the company at $20 billion and supplied additional private capital before the proposed listing.

As crypto.news reported in November, Citadel Securities contributed $200 million through a strategic investment. The funding also supported Payward’s work in regulated derivatives, tokenized financial products and international markets.

Public-listing expectations had increased after Circle Internet Group and Bullish completed IPOs in 2025. Several other digital asset companies also began preparing offerings, raising expectations that the industry would produce another group of U.S. listings in 2026.

Weaker cryptocurrency prices, lower trading volumes, and poor share performance at some recently listed companies later reduced investor interest. Grayscale, Consensys, and Ledger also postponed their listing plans as companies waited for a more favorable market.

Ledger paused preparations for a U.S. listing that could have valued the hardware wallet company at about $4 billion. The company had hired Goldman Sachs, Jefferies, and Barclays as advisers but had not filed a draft S-1, according to a May report.

BitGo, which was identified in that report as the only crypto-native company to list during 2026 at the time, was trading 36% below its January IPO price. The decline added another data point for private crypto companies assessing demand from public-market investors.

Payward revenue rises while trading activity falls

Payward has continued expanding its operations while the listing remains on hold. Company results for the second quarter showed adjusted revenue of $508 million, up 17% from the same period in 2025.

Funded accounts increased 42% from a year earlier to 6.6 million, while assets held on the platform reached $40 billion. Asset-based and other revenue accounted for 60% of total adjusted revenue, according to Payward’s financial report.

Trading figures presented a less favorable picture. Total platform transaction volume dropped 13% year over year to $310 billion as crypto spot activity slowed, while adjusted earnings before interest, taxes, depreciation, and amortization fell to $23 million.

First-quarter results had already shown how newer business lines were reducing Payward’s dependence on spot crypto trading. In May, the company reported $507 million in adjusted revenue, a 3% annual increase, even as Bitcoin fell 22% during the quarter and industry spot volume declined 38%.

Daily average revenue trades in futures rose 51% during the first quarter, supported by NinjaTrader, Breakout, and Bitnomial. Funded accounts stood at 6.1 million at the end of that period, compared with 6.6 million three months later.

Adjusted EBITDA was $18 million in the first quarter as Payward spent money on acquisitions, product development, and regulatory infrastructure. The company also reduced its workforce by about 150 employees in May, equal to roughly 5% of its staff, as part of a cost restructuring.

Kraken builds regulated U.S. derivatives business

Payward has used acquisitions and product launches to move into derivatives, tokenized stocks and payment services while its shares remain privately held.

The company acquired NinjaTrader, a U.S. retail futures platform, for $1.5 billion in 2025. Payward also bought Bitnomial, a CFTC-regulated derivatives exchange, in a $550 million transaction and added Breakout, a proprietary trading platform for qualified users.

Bitnomial gives Payward a regulated route for offering derivatives to eligible American customers. In August, Hyperliquid Labs and Payward entered advanced discussions about bringing selected Hyperliquid-linked perpetual futures to the United States through the platform, a recent report found.

Any products offered through Bitnomial would operate under rules enforced by the Commodity Futures Trading Commission. Bitnomial Exchange is registered as a designated contract market, while NinjaTrader Clearing operates as a registered futures commission merchant under the Kraken Derivatives US name.

In tokenized equities, Payward acquired Backed Finance, the issuer behind Kraken’s xStocks products. The deal gave the company more control over the issuance and trading infrastructure used to offer blockchain-based representations of stocks and exchange-traded funds.

Payward also agreed in May to acquire Hong Kong-based payment company Reap Technologies for $600 million in cash and stock. The transaction, which valued Payward shares at the same $20 billion level established by its funding round, added stablecoin-based cross-border and commercial payment services to the company’s operations.