Crypto World
how Term Labs got governance hijacked
An attacker bought a controlling stake in a DAO governance token for less than $1,000, passed malicious proposals, and drained $8.5 million from strategy vaults. The exploit exposes a vulnerability that most DeFi protocols have not patched.
Summary
- An attacker spent approximately $951 to acquire a controlling share of Term Labs’ governance tokens, then passed proposals that drained roughly $8.5 million from the protocol’s strategy vaults on August 23, 2026.
- The stolen assets included 2,843 ETH (approximately $6.87 million) and 1.68 million USDC, later swapped for roughly 1.6 million DAI, with the attacker’s initial funding traced to just 2 ETH sourced through Tornado Cash.
- The exploit did not involve a smart contract bug or a coding flaw. Every transaction was a permitted governance action executed by the address the protocol recognized as its legitimate governor.
- Term Labs permanently shut down all Meta Vault deposits and revoked DAO governance roles in response, while keeping withdrawals open for existing depositors.
- The attack is the fifth governance exploit of 2026 according to DefiLlama, bringing the combined total for the year to $25.1 million, led by a $20 million BonkDAO treasury drain in July.
The math is the story. An attacker spent $951 on governance tokens for a protocol that held $12.45 million in depositor funds. That $951 bought enough voting power to control four USDC strategy vaults and approximately 91% of the Ethereum Meta Vault. The attacker submitted proposals to move the funds, voted on those proposals with the tokens just purchased, and watched the vaults transfer $8.5 million to a wallet seeded with 2 ETH from Tornado Cash.
Every step was legal from the protocol’s perspective. The governance contracts worked exactly as designed. The proposals were submitted correctly, the votes were counted accurately, and the vault transfers executed precisely as the governance system instructed. The problem was not that the code broke. The problem was that the code did what it was told by someone who spent less than $1,000 to become its highest authority.
Term Labs confirmed the exploit on X on August 23, 2026. Security firms PeckShield and CertiK independently verified the incident and traced the stolen funds to attacker address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. The protocol’s on chain monitoring bot, Decurity’s Defimon, flagged the unusual transactions first.
This was not a novel attack. It was the fifth governance exploit of 2026 and the second in seven weeks. The pattern is repeating because the vulnerability is structural, and most DeFi protocols have not addressed it.
How the attack worked, step by step
Term Finance operates fixed rate lending through on chain auctions. The core lending infrastructure, where borrowers and lenders are matched through sealed bid auctions, was not affected by the exploit. The attack targeted a separate layer: the Meta Vaults and strategy vaults that Term Labs built on top of Yearn V3 infrastructure to automate yield strategies for depositors.
These vaults incorporated a custom governance layer developed by Term Labs. Governance token holders could submit and vote on proposals that directed how vault funds were deployed. The governance mechanism was designed to give the community control over strategy allocation, a feature that many DeFi protocols include as a decentralization measure.
The attacker exploited the thin liquidity of the governance token. With total market capitalization low and trading volume minimal, acquiring a majority stake required only a modest capital outlay. The $951 figure, identified by on chain analysts, represents the total cost of purchasing enough tokens to control the vote.
Once the tokens were acquired, the attacker submitted proposals to the four USDC strategy vaults and the Ethereum Meta Vault. The proposals directed the vaults to transfer their holdings to the attacker’s wallet. Because the attacker held a majority of governance tokens, the proposals passed without opposition. The vault contracts, functioning as designed, executed the transfers.
The entire sequence, from token purchase to fund extraction, required no technical exploit in the traditional sense. There was no reentrancy attack, no oracle manipulation, no flash loan. The governance system simply processed valid instructions from its recognized authority. The attacker became that authority for $951.
The BonkDAO precedent
Seven weeks before the Term Labs exploit, BonkDAO suffered a similar attack on a larger scale. On July 6, 2026, an attacker purchased roughly $4 million worth of BONK tokens on exchanges over several days, accumulated a dominant share of voting power, and submitted a proposal to the Solana based DAO’s treasury.
The proposal transferred 4.43 trillion BONK tokens, the bulk of the treasury, to a wallet the attacker controlled. When the vote closed, addresses linked to the attacker accounted for 99.878% of the votes cast. Only seven addresses participated in the vote. The proposal passed, and approximately $20 million in BONK drained from the treasury.
The BonkDAO attack was more expensive to execute ($4 million vs. $951 for Term Labs) because BONK tokens had higher liquidity and a larger market capitalization. But the mechanics were identical: acquire voting power, submit a malicious proposal, and let the governance system do the rest. Exchanges Upbit and Kraken paused BONK deposits and withdrawals after the incident, and BonkDAO coordinated with the Solana Foundation and law enforcement, though recovery prospects were described as limited.
The two attacks share a structural vulnerability that neither protocol had mitigated: the absence of safeguards between a governance vote passing and the resulting transaction executing. In both cases, there was no time lock, no multi signature requirement, and no secondary review mechanism that could have paused the execution long enough for the community to notice and respond.
Yearn V3 and the infrastructure distinction
Yearn Finance moved quickly to clarify its role after the Term Labs exploit. The affected products were Term’s Meta Vaults and strategy vaults, which operated on Yearn V3 infrastructure but incorporated a custom governance wrapper developed by Term Labs. Yearn stated that the vulnerability stemmed from Term’s additional governance layer not from any problem with standard Yearn vault designs.
This distinction matters for the broader DeFi ecosystem. Yearn V3 vaults are used by dozens of protocols for yield automation. If the vulnerability had been in Yearn’s core code, the implications would have extended far beyond Term Labs. The fact that it was isolated to Term’s custom governance layer limits the blast radius but does not diminish the lesson.
The lesson is that composability cuts both ways. DeFi’s modularity allows developers to build custom layers on top of established infrastructure, combining Yearn’s vault mechanics with Term’s lending auctions and a governance system that gives token holders control. Each layer works correctly in isolation. The vulnerability emerges at the intersection, in the governance wrapper that connects depositor funds to a vote that can be won for $951.
Yearn’s standard vault designs include protective measures that Term’s governance layer bypassed. Standard Yearn vaults use strategist multisigs and guardian addresses that can emergency revoke strategies. Term’s custom layer replaced these protections with token weighted governance, trading security for decentralization in a context where the decentralization was illusory because the governance token had no meaningful distribution.
Why thin governance is DeFi’s unpatched vulnerability
The term “governance attack” has entered the DeFi lexicon primarily in 2026. DefiLlama has classified five incidents as governance attacks this year, totaling $25.1 million in losses. The category barely existed before 2025 because governance tokens were either too expensive to accumulate (making attacks unprofitable) or too centralized (with founding teams retaining enough tokens to block malicious proposals).
The current wave of attacks exploits a specific market condition: protocols whose governance tokens have lost most of their value while the protocols themselves still hold significant depositor funds. Term Labs’ governance token was thinly traded with minimal market capitalization, but its vaults held $12.45 million. BonkDAO’s governance was conducted through a token that had fallen significantly from its peak, but the treasury still held $20 million in assets.
The ratio between governance token market capitalization and protocol controlled funds is the key metric. When the cost of acquiring 51% of governance tokens is less than the value of the assets those tokens control, the protocol is mathematically vulnerable to a governance attack. This is not a bug. It is an emergent property of token weighted voting in markets where token prices fluctuate independently of protocol usage.
Most DeFi protocols do not monitor this ratio. Governance structures are typically designed during the launch phase when token prices are high and the ratio favors security. As token prices decline through market cycles, the ratio inverts, and protocols that were economically secure at launch become vulnerable without any code change or governance update.
The defenses that exist but were not used
Several well known mechanisms could have prevented or mitigated the Term Labs exploit. Time locks, which impose a delay between a governance vote passing and the resulting transaction executing, are the most basic. A 24 or 48 hour time lock would have given the community and the Term Labs team time to notice the malicious proposal, mobilize opposition votes, or invoke emergency shutdown procedures.
Multi signature requirements for high value transactions provide a second layer of defense. Under this model, governance proposals that move funds above a certain threshold require approval from multiple independent signers in addition to the token vote. The BonkDAO attack and the Term Labs exploit both involved proposals that moved the majority of treasury funds in a single transaction, an action that a multi signature check would flag.
Quorum requirements are a third option. Both attacks succeeded with extremely low voter participation. The BonkDAO vote involved seven addresses. If the governance system required a minimum percentage of total token supply to participate before a vote could be considered valid, acquiring a controlling share would become proportionally more expensive.
Conviction voting, a model used by protocols like Gardens and 1Hive, replaces discrete voting periods with continuous signal aggregation. Under conviction voting, tokens must be staked for a sustained period before their voting weight reaches full strength. An attacker who purchases tokens and immediately votes would have negligible influence. This model directly addresses the purchase and vote pattern that both the Term Labs and BonkDAO exploits relied on.
The fact that these mechanisms are well documented, widely discussed, and available as open source implementations makes their absence from the exploited protocols harder to excuse. Term Labs chose to implement a custom governance layer without including any of them. The result was a system that trusted governance token holders unconditionally while making it trivially cheap to become one.
The response and what comes next
Term Labs responded to the exploit by permanently shutting down all Meta Vault deposits and revoking DAO governance roles. Withdrawals remained open for existing depositors, allowing them to retrieve whatever funds the attacker did not take. As of August 24, no recovery proposal, reimbursement commitment, or deadline for a postmortem had been announced.
The protocol’s core lending infrastructure, the fixed rate auction system, was not affected. Borrowers and lenders using Term’s auction markets continued to operate normally. The exploit was contained to the vault layer, which functioned as a separate product built on top of the core lending protocol.
For the broader DeFi ecosystem, the Term Labs exploit adds urgency to a conversation that the BonkDAO attack started but did not resolve. Governance attacks are not random. They target a specific structural weakness, thin governance token liquidity relative to protocol controlled assets, that is present in hundreds of DeFi protocols. The $25.1 million in governance attack losses in 2026 represents only the incidents that have already occurred. The number of protocols that are currently vulnerable to the same attack vector is almost certainly larger.
The August 2026 exploit wave extends beyond governance attacks. Total DeFi losses for the month surpassed $27 million, including the Sandbox bridge vulnerability and the BounceBit authorization exploit that led to a full chain shutdown. Each incident involved a different attack surface, but they share a common theme: the gap between the value secured by DeFi infrastructure and the security measures protecting it continues to widen.
What to watch
- Term Labs postmortem publication: the technical details of how the governance takeover was executed and what safeguards the team plans to implement for future products.
- Governance ratio monitoring tools: whether analytics platforms begin tracking the ratio between governance token market cap and protocol controlled assets as a vulnerability metric.
- Time lock adoption across DeFi: whether the Term Labs and BonkDAO exploits accelerate the implementation of mandatory time locks for governance proposals that move funds.
- Insurance protocol payouts: whether DeFi insurance products (Nexus Mutual, InsurAce) cover governance exploits or classify them as design failures outside their coverage scope.
- Regulatory response: whether the SEC or CFTC cite governance attacks in their arguments for DeFi regulation, particularly in the context of the Regulation Crypto Assets comment period.
Disclaimer: This article is for informational purposes only and does not constitute financial or security advice. DeFi protocols carry significant risk, including smart contract vulnerabilities and governance exploits. Readers should conduct their own research before depositing funds. Published August 25, 2026.
BNB Chain has activated the Pasteur hard fork on the BNB Smart Chain (BSC) mainnet, marking a focused change to how blocks are verified and authorized—while aiming to increase how much traffic can fit into each block. The network says Pasteur went live on Tuesday and targets bridge, staking, and governance security, without altering BSC’s 450-millisecond block time.
In the update, BNB Chain combines multiple BNB Evolution Proposals (BEPs) to close verification and authorization gaps, improve validator handling around cross-chain and governance operations, and revise the route used by block builders and validators during busy periods.
Key takeaways
- Pasteur is live on BSC mainnet, with BNB Chain describing it as a security and performance upgrade that keeps the 450ms block time unchanged.
- BEP-682 and BEP-695 address validator duplication during cross-chain light-block verification and tighten controls around validator key rotation, slashing, and governance voting.
- BEP-675 changes block submission mechanics, allowing builders to submit blocks they have already executed, reducing duplicated work by validators.
- QANet test results showed higher throughput—but they were from a controlled test environment, not a live mainnet measurement.
What Pasteur changes on BSC mainnet
According to a Tuesday confirmation from BNB Chain, Pasteur is now active on the BSC mainnet and is designed to strengthen core system components tied to network integrity. The team says the upgrade improves the network’s bridge, staking, and governance security, while also increasing block capacity.
BNB Chain frames the upgrade around three BNB Evolution Proposals:
- BEP-682 prevents duplicate validator entries during cross-chain light-block verification.
- BEP-695 tightens how validator-related changes are handled, including validator key rotation, slashing, and governance voting.
- BEP-675 revises the process for how specialist block builders submit blocks to validators.
BNB Chain also says Pasteur is intended to stop validators from being effectively counted more than once in bridge approvals, reduce the authority of older validator keys, and keep restricted addresses from participating in voting. Those are practical safeguards: bridge verification and governance voting both rely on correct validator participation, so tightening these mechanics is a direct defense against edge-case failures and mis-accounting.
Why BSC is adjusting the block-building route
BNB Chain’s update focuses heavily on how work is distributed between block builders and validators. Under the prior route described by the network, a builder executed transactions before submitting a proposed block, and then validators executed the transactions again before signing.
BNB Chain said that “repeated work” can consume time within the block window, at times leaving blocks underfilled—a problem that becomes more visible when the network is busy.
With BEP-675, the new route allows builders to submit blocks they have already executed. In this design, validators verify the proposed block against consensus rules, sign and broadcast it, and only then proceed with full execution verification afterward.
Importantly, BNB Chain says the previous route is still available: builders can continue to use the earlier method in which validators execute transactions before signing. That dual approach suggests Pasteur is being introduced with operational flexibility, potentially reducing risk for builders that may need time to align with the revised workflow.
Throughput gains in QANet tests—what to watch
To quantify the changes, BNB Chain points to tests conducted on QANet, an internal environment created to mirror BSC’s geographically distributed validators. In those tests, the new block-building route increased throughput by roughly 88%, rising from 1,237 to 2,324 transactions per second.
BNB Chain also reported that average gas used per block increased from 46.35 million to 84.15 million, while two key parameters remained steady: the block interval and the 100-million gas limit.
However, the network emphasized that these figures were generated under a controlled test workload and were not mainnet measurements. For investors and operators, this matters because test throughput does not always translate directly to real-world performance under fluctuating demand, different transaction mixes, and changing validator/builder behavior.
Still, the directional outcome is clear: Pasteur is designed to help validators spend less time on duplicated pre-execution, which should make it easier to keep blocks closer to their capacity during peak traffic.
Where Pasteur fits in BSC’s recent performance push
Pasteur follows an earlier phase of BSC upgrades that prioritized faster block production. BNB Chain previously highlighted that its Maxwell hard fork reduced average block time from 1.5 seconds to about 0.8 seconds in June 2025. The subsequent Fermi upgrade then brought the network down to 450 milliseconds.
In that context, Pasteur looks like a complementary step: once block times were shortened, the system needed a way to avoid traffic bottlenecks that can appear when the time available for building and validating shrinks. By changing how builder execution and validator signing interact—while also tightening validator authorization rules—the network is effectively trying to balance speed, throughput, and correctness.
BNB Chain’s latest move therefore targets two layers at once: security boundaries (validator accounting, key rotation controls, and governance participation rules) and block production efficiency (reducing duplicated work inside the block window).
Readers should watch how quickly builders and validators adopt the new route under real mainnet load, and whether QANet gains translate into more consistently full blocks during periods of elevated activity. The big remaining question is how performance behaves across different transaction profiles—not just raw throughput—now that Pasteur has changed the operational choreography of execution and signing.
Standard Chartered Bank (Hong Kong), or SCBHK, has become the first bank authorized to distribute HKDAP, a regulated Hong Kong dollar-backed stablecoin issued by Anchorpoint Financial.
On Monday, the bank said it is engaging eligible institutional clients and partners on uses including tokenized fund settlements, treasury operations and cross-border payments during a phased rollout.
Standard Chartered’s addition expands HKDAP distribution into conventional banking nearly two weeks after Anchorpoint began beta access through HashKey Group and OSL. SCBHK said it expects to introduce new commercial applications over the coming months.
The bank plans to introduce HKDAP-based subscriptions and settlements for tokenized money market funds with international and local asset managers in the fourth quarter. It also intends to use the stablecoin in intragroup settlements across its banking network in the near term.
“Since Anchorpoint received its stablecoin issuer licence, we have seen strong interest from clients exploring how HKDAP can support their business needs,” SCBHK CEO Mary Huen said in the announcement.
She added that SCBHK’s distribution could support payments, settlement and treasury management while providing eligible clients with access through a regulated banking channel.
Related: Hong Kong warns of fake stablecoins impersonating HSBC and Anchorpoint
HKDAP expands distribution
Anchorpoint is a joint venture established by Standard Chartered’s Hong Kong arm, telecommunications company HKT and Web3 investment company Animoca Brands. Standard Chartered is Anchorpoint’s largest shareholder, and the licensed issuer operates as a subsidiary of the bank.
In February 2025, the partners announced plans for an HKD-backed stablecoin, after participating in the Hong Kong Monetary Authority’s (HKMA) stablecoin issuer sandbox since July 2024. In August 2025, they formally established Anchorpoint Financial and began pursuing an issuer license.
Hong Kong’s Stablecoins Ordinance took effect on Aug. 1, 2025. Ahead of its implementation, the HKMA issued supervisory guidelines and opened a public register of licensed issuers.
On April 10, the HKMA granted its first stablecoin issuer licenses to Anchorpoint and HSBC’s Hong Kong banking arm. The approvals came under rules requiring licensed issuers to meet standards covering reserve backing, redemption, governance and Anti-Money Laundering (AML) controls.
Magazine: MiCA cracks down on USDT in Europe… but no one else cares
Two major crypto industry advocacy groups have taken legal action against Illinois over a newly enacted digital asset tax that is scheduled to take effect in January 2027. The Crypto Council for Innovation (CCI) and the Blockchain Association (BA) filed a lawsuit in Sangamon County, arguing that the measure runs afoul of the U.S. Constitution and other legal protections.
Illinois’ policy imposes a 0.2% tax on cryptocurrency based on transaction volume, which the state described as a “privilege tax.” The groups say the tax’s structure and administration create constitutional problems, including claims that the law is too vague and risks duplicative taxation for cross-border activity.
Key takeaways
- CCI and BA sued Illinois officials over a 0.2% cryptocurrency tax tied to transaction volume, effective January 2027.
- The complaint argues the tax violates multiple constitutional and legal provisions, including due process and the Commerce Clause.
- Opponents contend the rules are “unconstitutionally vague,” placing compliance burdens on residents and brokers under penalty threats.
- The lawsuit follows earlier Illinois crypto tax litigation from the Digital Chamber in July.
- Illinois’ broader regulatory posture also includes prediction market restrictions, alongside separate related legal challenges.
What Illinois’ crypto tax requires—and what challengers object to
The lawsuit was filed Friday in the Circuit Court of the Seventh Judicial Circuit for Sangamon County. According to the court filing, CCI and BA challenge Illinois’ digital asset tax on constitutional grounds, including claims involving due process and the Commerce Clause.
Illinois Governor JB Pritzker signed the measure into law in June as part of the state’s fiscal year 2027 budget. The tax is framed as a “privilege tax,” and it is designed to apply to transaction volume rather than income.
CCI and BA argue the tax creates uncertainty for market participants because it requires residents and brokers to determine what qualifies and how assets are taxed, while simultaneously exposing them to “serious civil and criminal penalties.” Their due process argument centers on alleged vagueness—essentially, that the law does not provide sufficiently clear guidance to comply safely.
Commerce Clause and the “risk of duplicative taxation” claim
Beyond due process, the complaint asserts that the Illinois tax implicates the U.S. Constitution’s Commerce Clause, which governs regulation of interstate commerce. In the filing, the groups contend the state tax creates a “specter of duplicative taxation,” a point aimed at the risk that crypto transactions spanning multiple jurisdictions could face overlapping tax obligations.
The core logic is that crypto activity is not confined to a single state boundary in the way traditional in-state commerce might be. If multiple jurisdictions try to levy comparable taxes based on transaction activity, the result—according to the lawsuit’s framing—could be inconsistent treatment and uncertainty for businesses and consumers operating across state lines.
“States have an important role in fostering innovation, but that authority has constitutional limits,” said Summer Mersinger, CEO of the Blockchain Association and a former commissioner at the U.S. Commodity Futures Trading Commission. She added that Illinois cannot impose a “novel tax regime” that discriminates against digital commerce, creates uncertainty for consumers and businesses, and threatens to fragment what she described as a rapidly growing national market.
How this fits into a wider pattern of Illinois crypto and prediction market scrutiny
The CCI/BA legal challenge is not the first court fight over Illinois’ approach. In July, the Digital Chamber filed a separate lawsuit against the same state crypto tax. That earlier case argued that the measure “discriminates against people who transact in digital assets,” aligning with the broader theme in the new complaint: that the tax places crypto users and related businesses under a regulatory burden not matched by other forms of commerce.
These lawsuits also arrive during an election year cycle in which crypto policy can become politically consequential. The filings and related actions point to how industry groups are mobilizing to challenge state laws that they say could reshape the compliance landscape well before the provisions take effect.
Illinois’ regulatory efforts extend beyond crypto taxation. The background includes Kalshi’s lawsuit against Illinois officials over legislation that took effect July 1 and, according to Kalshi, “expressly bans sports event contracts” in violation of federal law by requiring state licensing. Separately, Pritzker signed an executive order in April barring state employees from betting on prediction market platforms, explicitly aimed at preventing insider trading concerns amid the growth of event-based gambling contracts.
What to watch next
As the case moves forward, the key issue will likely be how courts evaluate the law’s clarity and enforcement mechanics—particularly the alleged vagueness and the constitutional concerns tied to interstate activity. With the tax slated for January 2027, businesses and brokers will be watching whether the litigation leads to court-ordered changes, delays, or a clearer interpretation of how Illinois intends to apply the 0.2% levy.
Leveraged exchange-traded funds (ETFs) tied to South Korea’s two biggest chipmakers shed close to $1 billion in August.
The withdrawals mark the first monthly outflow since the products launched in late May. The reversal comes as enthusiasm around the AI trade has weakened and regulators have introduced measures aimed at curbing speculative demand.
Leveraged Chip ETFs in South Korea Snap Inflow Run
Data compiled by Bloomberg Intelligence shows $601 million left the funds tracking SK Hynix, while Samsung-linked products lost $381 million. The ETFs aim to deliver twice the daily move of the underlying stock.
The reversal follows a brutal July for Korean equities. The KOSPI sank 22% that month. Samsung Electronics fell 21.5% over the same period.
SK Hynix dropped 35.5%, deepening losses for retail traders who had piled into double-leveraged wrappers.
Officials called an emergency meeting after 864.5 trillion won left the market across two sessions. Lawmakers blamed single-stock leveraged ETFs for amplifying the slide.
Regulators responded by raising the minimum deposit for new investors. They also mandated a five-day mock trading session. Trading volumes in the products cooled sharply afterward, according to Bloomberg.
Follow us on X to get the latest news as it happens
Retail Money Rotates Into ELS
Both chipmakers have steadied since. Samsung is up 3.63% in August, and SK Hynix has gained 2.19%, though Samsung slid 8.7% on Monday after its record shareholder return plan disappointed the investors.
Cooling ETF demand has not ended Korean risk appetite. Instead, mom-and-pop traders moved into equity-linked securities (ELS), advertising annualized coupons of 40% to 50%.
About 3.5 trillion won, or $2.5 billion, of ELS products were sold in July, according to the Korea Financial Investment Association. This was the highest monthly total since April 2023, led by notes tied to Samsung and SK Hynix.
The structured notes carry their own history of losses, having burned Korean buyers during the 2016 Brexit vote, the 2020 oil crash, and the China equity slump between 2021 and 2024.
Whether the coupon chase proves steadier than the leverage trade depends on how the chipmakers hold their August gains.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
The post Samsung and SK Hynix Leveraged ETFs Post First Outflow Since May Launch appeared first on BeInCrypto.
Crypto World
Treasury’s bond buyback plan fights the market and heightens the danger, billionaire Druckenmiller says
The billionaire investor argues the intervention removes a vital check on government borrowing and fiscal accountability while markets remain the better judge of prices.
Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.
Monero users are turning to instant swaps and decentralized platforms as centralized exchanges restrict access to XMR.
As access to Monero has become more restricted on some centralized exchanges — notably after Binance delisted XMR globally on 20 February 2024, OKX removed XMR pairs on 5 January 2024, and Kraken restricted it for EEA users on 31 October 2024 — many users now rely on instant swap services and decentralized platforms.
This guide compares practical ways to exchange Monero without registration, focusing on USDT TRC20 to XMR, minimum amounts, confirmation requirements, and AML procedures.
Why use a Monero exchange without registration?
Monero’s privacy features — ring signatures, stealth addresses, and confidential transactions — hide sender, receiver and amount on-chain. The best Monero exchange depends on whether the user prioritizes live pricing, decentralization or the number of supported assets.
However, the way to acquire or dispose of XMR still matters. Centralized exchanges that still list XMR usually require full identity verification and maintain user accounts.
Services that do not require registration let users create a one-time order, send crypto from their own wallet to a temporary deposit address, and receive the output directly in a controlled wallet.
This reduces the personal data trail associated with the exchange itself.
“No registration” is not the same as an unconditional guarantee that identity information will never be requested.
Most instant services apply automated AML screening. A standard-order flow usually proceeds without documents, but a flagged deposit can pause processing.
How should investors compare no-registration XMR exchanges?
Useful comparison points include:
- Supported XMR directions, especially USDT TRC20 → XMR, XMR → BTC and other assets.
- Whether an account or identity documents are needed to create a standard order.
- Minimum amounts; always check the live quote — they are pair- and liquidity-dependent.
- How the service handles incoming deposits and outgoing XMR.
- Stated AML / risk-screening policy.
- Custody model during the brief processing window.
According to the official Monero Wallet CLI documentation, newly received XMR normally becomes spendable after 10 confirmations.
Which no-registration Monero exchanges are available in 2026?
The following services are commonly used for accountless XMR swaps. The best XMR exchange for a particular transaction depends on the required pair, available rate, liquidity, and AML terms.
Descriptions reflect publicly available information and community testing as of mid-2026; always re-verify.
Quickex
Quickex operates as an accountless instant exchange. Users can create an order without registration for standard pairs that include Monero.
The service supports XMR routes involving USDT across several networks, as well as BTC and ETH, including exchanges in both directions.
Minimum amounts appear in the live quote and are pair-dependent.
Newly received XMR typically becomes spendable after 10 Monero confirmations, which is approximately 20 minutes at Monero’s two-minute block target. This wallet unlock period should not be confused with the exchange provider’s own deposit-processing requirements.
Quickex applies risk-based AML screening. According to its published policy, suspicious transactions may be delayed for review and additional information can be requested.
For users specifically needing the reverse direction, the service provides an XMR to BTC route.
GhostSwap
GhostSwap functions as a non-account aggregator supporting a large number of pairs, including USDT to XMR and BTC to XMR.
It markets a no-registration flow for standard swaps.
Minimums and exact confirmation counts are shown at quote time and depend on the backend liquidity provider used for that order.
ChangeNOW, StealthEX, and Godex
These established instant-swap services (ChangeNOW, StealthEX, and Godex) allow creation of XMR-related orders without registration for ordinary volumes.
They typically offer both floating and fixed-rate options.
Minimum amounts, supported networks, including USDT TRC20, and confirmation expectations are displayed in the order interface and can differ by pair and current network conditions.
Trocador
Trocador acts as a privacy-oriented aggregator. It does not hold funds itself but routes orders to partner services, allowing rate comparison while remaining within an accountless workflow for many routes.
Haveno
Haveno is a decentralized, Tor-based peer-to-peer platform focused on Monero. It does not operate as a centralized instant swap. Trades rely on an order book and multisig-style escrow. It offers the greatest degree of decentralization among the listed options at the cost of potentially longer matching times and variable liquidity.
How do the leading monero exchanges compare?
Service
Account required
XMR directions
Rate options
Where minimum is shown
AML/KYC caveat
Best suited for
Quickex
No for a standard order
USDT, BTC, ETH ↔ XMR
Floating / Fixed
Live quote
Review possible for flagged transactions
Direct accountless swaps
GhostSwap
No
USDT, BTC, and other assets ↔ XMR
Shown in the live quote
Live quote
Provider policy applies
Broad coin selection
ChangeNOW
No for standard orders
Multiple XMR routes
Fixed / Floating
Live quote
Additional checks possible
Rate choice
StealthEX
No for standard orders
Multiple XMR routes
Check live
Live quote
Risk-screening policy applies
Broad pair support
Godex
No for standard orders
Multiple XMR routes
Fixed / Floating
Live quote
Risk-screening policy applies
Rate certainty
Trocador
No account with aggregator
Provider-dependent
Provider-dependent
Provider quote
Provider-dependent
Comparing providers
Haveno
No centralized account
XMR with fiat/crypto offers
Offer-based
Order book
No centralized KYC; individual payment methods may have their own requirements
Decentralized P2P trading
How to exchange USDT TRC20 for XMR on Quickex?
A typical accountless flow looks like this:
- Select USDT (TRC20) as the asset to send and XMR as the asset to receive.
- Enter a fresh Monero receiving address; a subaddress is preferable. Using a new subaddress for each incoming payment improves privacy by preventing address reuse.
- Review the live minimum, expected output, rate type, choose fixed or floating rate (fixed locks the receive amount for a limited window, floating follows the market), and any network notes.
- Send the exact amount of USDT TRC20 from a wallet to the one-time deposit address generated by the service.
- After the USDT deposit receives the required TRON confirmations, the service processes the swap and broadcasts the XMR transaction.
Most Monero wallets display the incoming transaction relatively quickly.
Newly received XMR normally becomes spendable after 10 Monero confirmations, roughly 20 minutes under normal network conditions.
The service’s own internal detection or release threshold may differ slightly from the wallet unlock time. Always perform a small test transaction first and double-check the network, TRC20 vs ERC20, etc.
Can a no-KYC XMR exchange freeze a transaction?
Yes. Even services that do not require registration for a standard order usually run automated risk screening.
If a deposit is flagged, for example due to associations with mixers, high-risk addresses or other risk indicators, the service may pause the order, request additional information or source-of-funds details, or process a refund according to its policy.
Quickex’s published AML documentation states that it applies risk-based checks and may request information when elevated risk is identified. Similar policies exist at most instant-swap providers.
Risk-screening outcomes depend on transaction history, counterparties, and the provider’s internal thresholds. Using a self-custody wallet does not by itself guarantee that a deposit will pass screening.
What are the risks of exchanging Monero without registration?
- Sending to the wrong network or an incorrect address is irreversible.
- Floating rates can move between the moment the quote is received and the moment the deposit is detected.
- Confirmation times vary with network conditions.
- AML review can delay or alter the outcome of an order.
- Regulatory treatment of privacy coins continues to evolve.
Recommended practices include using a dedicated Monero wallet, the official Monero GUI or well-established self-custody options such as Feather or Cake Wallet, generating fresh subaddresses, verifying every detail in the order form, and keeping records of order IDs and transaction hashes.
Review each service’s terms and regional restrictions before accessing it via VPN or Tor, as policies differ.
Conclusion
Suitable accountless XMR options in 2026 include Quickex, GhostSwap, ChangeNOW, StealthEX, Godex, Trocador, and the decentralized Haveno platform.
Instant services work well for straightforward routes such as USDT TRC20 → XMR, while Haveno maximizes removal of intermediaries. No single service is universally “best.”
Evaluate speed, live rates, minimums, confirmation expectations, and AML handling against personal priorities, and always confirm current details in the order interface before sending funds.
Combine careful platform selection with secure wallet practices to reduce operational risks during an XMR swap.
FAQ
Can I exchange USDT TRC20 for XMR without registration?
Yes, on multiple accountless instant services. Users can create an order, send USDT TRC20 to a temporary deposit address, and receive XMR in their own wallet.
No account is required to start a standard swap.
Can a no-registration Monero exchange still ask for ID?
Yes, if automated AML screening flags the deposit. Most services allow standard orders without documents, but elevated-risk transactions can be paused pending review or additional information.
How many confirmations does a Monero exchange require?
It depends on the service and the direction. Standard Monero wallets typically unlock newly received funds after 10 confirmations, about 20 minutes.
Instant services may use their own detection thresholds. Always check the specific order details.
What happens if an XMR exchange flags a transaction?
The order may be delayed while the service reviews the deposit.
Outcomes can include a request for information, continued processing after clearance, or a refund according to the provider’s policy.
What is the minimum amount needed to exchange USDT for XMR?
Minimums are pair- and liquidity-dependent and appear in the live quote.
They commonly fall in a modest range for stablecoin pairs but should be confirmed on the day of the swap.
What is the best XMR exchange without registration?
There is no single best XMR exchange for every transaction. Quickex is one of the services that offers a direct XMR to BTC route without requiring registration for a standard order.
Disclosure: This content is provided by a third party. Neither crypto.news nor the author of this article endorses any product mentioned on this page. Users should conduct their own research before taking any action related to the company.
Treasury says Ivan Obukhov processed over $100 million in crypto for IRGC-QF oil sales since 2023.
Fortune Protocol has integrated Polymarket liquidity into Fortune Markets, adding another source of prediction markets alongside Predict.fun while giving users a single interface to compare liquidity, volume and market probabilities.
Summary
- Fortune Protocol has added Polymarket liquidity to Fortune Markets alongside Predict.fun.
- Users can compare liquidity, trading volume and probabilities across markets in one interface.
- The updated trading flow includes outcome selection and position previews.
- A unified Portfolio combines open positions, resolved markets and trading history.
Fortune Protocol said in an X announcement on Aug. 25 that Polymarket liquidity was now live on the platform, bringing markets from both Polymarket and the previously integrated Predict.fun into what it describes as a unified market layer.
The integration allows Fortune Markets users to browse event markets supplied through different liquidity sources without moving between separate prediction platforms. Market information is displayed through a redesigned interface that lets traders compare liquidity, trading volume and implied probabilities before selecting a market.
Alongside the additional liquidity, Fortune has changed its trading flow to include outcome selection and a position preview. Its Portfolio section has also been combined into one view covering open positions, settled markets and a user’s full trading history.
“More markets. More liquidity. One Fortune,” the project said while announcing the update.
Fortune Protocol brings Polymarket liquidity into one interface
Fortune Protocol describes Fortune Markets as a prediction market product built around aggregated access, with liquidity from outside venues brought into a common interface. The latest addition puts Polymarket beside Predict.fun as the two named liquidity sources currently available through the product.
Under the new market design, users can examine comparable information across markets before trading, including how much liquidity is available, the volume recorded by a market and the probability implied by its pricing.
Fortune said the updated trading process also lets a user select an outcome and preview the resulting position before proceeding. Once trades have been made, the unified Portfolio provides access to active positions, markets that have already resolved and previous trading activity.
The project said it plans to continue integrating liquidity from established prediction market venues as it builds the unified market layer. According to Fortune, combining different liquidity sources is intended to give users a more efficient way to access and trade prediction markets from one place.
Predict.fun already has integrations elsewhere in the crypto market. In April, crypto.news reported on Predict.fun powering prediction-market access inside Binance Wallet for eligible users.
Through that integration, prediction-market activity is executed on-chain using Predict.fun smart contracts, while Predict.fun operates the events, pricing and resolution rules. Users can access markets covering areas including sports, economics, world events, culture and crypto, with outcome prices representing the probability assigned by traders to each result.
Polymarket has been expanding its own liquidity infrastructure
Fortune’s addition of Polymarket comes after the prediction market operator made changes to its own trading infrastructure earlier this year.
In April, Polymarket launched CLOB v2, introducing new exchange contracts, a rewritten central limit order book backend and Polymarket USD, or pUSD, as its collateral token.
The upgrade was accompanied by a $1 million liquidity rewards program designed to attract market makers and deepen order books across Polymarket’s event contracts. Polymarket also added support that allows front ends and other builders to route orders and track trading flow through its infrastructure.
Those changes matter for aggregation products because liquidity determines how easily traders can enter and exit a prediction market and how closely prices can track changes in market expectations. Fortune’s redesigned interface makes liquidity one of the metrics displayed when users compare available markets.
Polymarket’s trading model uses event contracts whose prices change as traders buy and sell different outcomes. A contract priced at 60 cents, for example, represents an implied probability of roughly 60% before considerations such as market structure, liquidity and trading costs.
Fortune has not disclosed separate volume or liquidity figures for the Polymarket markets made available through its interface.
Prediction market liquidity has drawn professional trading firms
Liquidity has become a larger focus across prediction markets as trading activity has increased.
During May, Wintermute entered prediction market making, providing continuous two-way quotes across several prediction platforms. Aggregate monthly trading volume across the sector had passed $20 billion at the time, while Wintermute described liquidity as still early by institutional market standards.
Jake Ostrovskis, Wintermute’s head of OTC trading, said there was “clear demand for these markets” but liquidity remained insufficient. The firm said tighter spreads and more trading capacity could improve the quality of probabilities produced by event markets.
Market makers provide competing bids and offers that can reduce the gap between prices available to buyers and sellers. For prediction platforms, deeper order books can also make it easier for traders to execute larger positions without moving a contract’s price as sharply.
Fortune’s model approaches the same liquidity issue from the user interface side by pulling markets supplied by multiple venues into one place and allowing traders to examine them before choosing where to take a position.
Aggregating prediction markets is becoming a separate product category
Other firms have also started building products designed around access to several prediction platforms.
Paradigm has been developing a prediction terminal for professional traders and market makers. The project, which began in late 2025, was designed to provide tools for analyzing and routing liquidity across on-chain and regulated prediction platforms.
Paradigm had also begun aggregating prediction-market data into a public dashboard and was considering an internal market-making operation and an index that could package several event markets into one product.
Fortune’s product is focused on bringing the markets themselves into a unified trading interface. Its latest update adds Polymarket to the Predict.fun liquidity already available, while the redesigned Portfolio keeps open positions, resolved contracts and trade history under the same account view.
The protocol said it would continue adding liquidity from other mainstream prediction markets as Fortune Markets develops its unified market layer.
Metaplanet transferred 1,000 Bitcoin, worth approximately $79.77 million, to Coinbase Prime on Aug. 25, according to blockchain analytics account Lookonchain.
Summary
- Metaplanet transferred 1,000 Bitcoin worth roughly $80 million to wallets attributed to Coinbase Prime today.
- The transfer alone does not establish a sale because Coinbase Prime provides institutional custody services.
- Metaplanet officially holds 43,000 Bitcoin, valued near $3.4 billion at current market prices this week.
- Super League sold 475,598 shares, generating approximately $2.23 million in gross ATM offering proceeds reported.
- Metaplanet’s Super League transaction remains subject to shareholder approval and targets closing during fourth-quarter 2026.
The transfer follows several large movements involving the Japanese company’s 43,000 BTC treasury. However, neither Metaplanet nor Coinbase had identified the latest movement as a sale when checked Tuesday.
Metaplanet’s Coinbase Prime transfer does not prove a sale
Lookonchain described the transaction as a deposit into Coinbase Prime. Prime provides institutional trading, financing and custody services. Moving Bitcoin there can precede a sale, but it can also reflect custody management, collateral arrangements or internal account transfers.
“Metaplanet deposited another 1,000 BTC into Coinbase Prime,” Lookonchain reported. The destination attribution is an on-chain analyst’s assessment, not confirmation that Coinbase executed a sale.
Metaplanet has addressed similar speculation before. On Aug. 12, CEO Simon Gerovich said the company moved 5,014 BTC between custodial addresses without selling any coins. Its reported holdings remained unchanged at 43,000 BTC.
As crypto.news reported, analysts had initially observed 3,881 BTC leaving Metaplanet-linked wallets during that earlier movement. Subsequent company clarification showed why a blockchain transfer should not automatically be treated as a disposal.
Metaplanet’s 43,000 BTC figure requires price context
Metaplanet reported holding 43,000 BTC after acquiring 2,823 BTC during the second quarter. Its disclosed average acquisition price was approximately 15.3 million yen per coin. Lookonchain converted that figure to an estimated $96,191.
At that average, the position’s estimated acquisition cost would be approximately $4.14 billion. Lookonchain’s separate $3.48 billion figure represents an approximate market valuation near current prices, rather than the amount Metaplanet originally paid.
The latest transfer also does not necessarily reduce Metaplanet’s holdings. Bitcoin held through a Coinbase Prime account could remain under the company’s beneficial ownership. An official treasury update or evidence of subsequent asset sales would be needed to confirm a reduction.
U.S. Bitcoin treasury transaction remains pending
The transfer comes one week after Metaplanet agreed to contribute 2,100 BTC and $2.5 million to Nasdaq-listed Super League Enterprise. The proposed transaction would turn Super League into a U.S. Bitcoin treasury platform named Superplanet.
Metaplanet would receive 44.86 million common shares, preferred shares and warrants. It expects to own approximately 95.7% of the resulting company. The planned Nasdaq ticker is SUPA.
The 2,100 BTC contribution would remain within Metaplanet’s consolidated group after closing. In related coverage, the companies valued the initial investment at about $134.6 million.
There is no official evidence connecting Tuesday’s 1,000 BTC transfer with that transaction. The timing permits that possibility, but neither company has identified the transferred coins as part of the pending contribution.
Super League completed its first ATM allocation
Separately, Super League reported selling 475,598 shares for approximately $2.23 million in gross proceeds through its at-the-market program. The completed sales followed an Aug. 18 agreement with Benchmark and StoneX.
The company subsequently authorized another $2.27 million of ATM capacity. That additional amount represents shares available for future sale, not completed financing. Agents receive a 1% commission on gross proceeds from each sale.
The larger Superplanet transaction still requires Super League shareholder approval, Nasdaq requirements and applicable procedures in the U.S. and Japan. The companies are targeting a fourth-quarter 2026 closing.
Until Metaplanet issues another treasury disclosure, the verified development is a 1,000 BTC movement to wallets attributed to Coinbase Prime. Describing it as a confirmed sale would go beyond the available evidence.
Chinese state-affiliated hackers now run twice as many attacks as they did before handing mundane work to DeepSeek and open-source artificial intelligence (AI) systems, according to Taiwanese threat intelligence firm TeamT5.
Attribution remains imprecise. The firm cannot tie every intrusion to a specific system, though it said that DeepSeek remains a popular choice among hackers.
Why Cheap AI Beats Frontier Models for Attackers
The finding inverts a common assumption that the risk of offensive AI lies mainly with the most advanced systems. Instead, operators are now scaling output using relatively weaker tools.
Cost and permissiveness drive that choice. Moonshot’s Kimi K3 is more powerful. Yet, TeamT5 has logged no incidents involving it and considers its running costs prohibitive for hackers.
Charles Li, chief analyst at TeamT5, framed the trade-off directly.
“DeepSeek is the AI of choice for Chinese hackers because it’s relatively powerful with very low cyber guardrails. Western models are highly sought-after but their guardrails are much more strict and require a lot more effort to bypass,” Li said.
Follow us on X to get the latest news as it happens
How Hackers Use AI
TeamT5 obtained scripts and logs, placing DeepSeek across multiple attack stages. A group called Grimfengxi used it to generate exploit code. Teleboyi used it to gather 1,000 IP addresses and map a target’s domains.
Huapi hit a Taiwanese company’s email system with a Chinese model that researchers believe was DeepSeek. Western tools appear too.
TeamT5 said a group tracked as Slime22 breached a Taiwanese technology firm’s systems, installed Kali, and directed Claude Code to run lateral movement. Operators bypassed safeguards by claiming to be engineers conducting authorized tests.
Meanwhile, CyCraft traced a 10-person Chinese startup selling intrusion software for 300,000 to 500,000 yuan, or roughly $44,500 to $74,000. At least four hacking groups bought it. The company also used ChatGPT during an attack.
A spokesperson for OpenAI said the firm is committed to identifying, preventing, and disrupting attempts to abuse its models.
Meanwhile, Chinese groups are not alone in this shift. North Korea’s Kimsuky is also testing local models.
Anthropic reached a broader conclusion in June, finding that AI now handles advanced attack work for hackers who lack the skill to do it themselves.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
The post Chinese State Hackers Double Attack Volume After Adopting AI, Report Shows appeared first on BeInCrypto.
European stocks rebound to one-week highs as sanctions threat proves toothless
BNB Chain activates Pasteur hard fork to bolster bridge security
Perez Hilton’s Family Still Has No Answers After Crisis
-
Fashion4 days agoWeekend Open Thread: Madewell – Corporette.com
-
Business3 days agoMusk’s Tesla, SpaceX Confirm $16.8 Billion ‘Terafab’ Chip Plant as World’s Largest Building in Texas
-
Crypto World3 days agoanatomy of crypto’s biggest liquidation event since 2021
-
Business7 days agoSMA Solar Technology AG (SMTGY) Q2 2026 Earnings Call Transcript
-
Politics3 days ago6 months on, Irish renters crushed by effects of government housing bill
-
NewsBeat3 days agoThe ‘Lucky Dip Gang’ causing carnage for clicks: After five thugs were killed speeding in the wrong direction on a motorway, GUY ADAMS investigates a sick new trend… and why police aren’t even allowed to pursue them
-
Tech6 days agoGLM-5.3 hits the API at $1.4/$4.4 per million tokens
-
News Videos5 days agoDon’t Leave Your Financial Future To Chance | August 19, 2026
-
Business2 days agoMystery AI Model ‘Ox Alpha’ Draws Developers With Free Access as Chinese Lab Origins Remain Debated
-
Business5 days agoFive Below: Kids Discount Retailer Reaps Rich Rewards
-
Business7 days agoStock Market Today: Tech Futures Slide As Treasury Yields Jump; Nvidia, Micron, Sandisk Sell Off
-
Business6 days agoMarvell Shares Jump 7% as Google Chip Deal Confirms Custom AI Silicon Partnership, Analysts
-
Tech7 days agoKen Okuyama’s Kode89 Supercar Features Three Pedals and a Choice of V12s
-
Politics7 days agoThe House Opinion Article | Security means more than military spending
-
Sports2 days agoDeshaun Watson fires back at Browns fans after being booed: ‘It’s a disrespectful thing’
-
Fashion7 days agoThe Best Wide Leg Pants to Wear to Work
-
Fashion7 days agoFlat sandals on sale at Esska
-
Crypto World7 days agoSherlock Takes Audit Engine Public After Months of Quiet Testing
-
Tech5 days agoOpenAI confirms ChatGPT is down as logins and signups fail
-
Business4 days agoUK firms in critical financial distress rise 9% to 53,756
You must be logged in to post a comment Login