US regulatory agencies missed the rulemaking deadline under the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act on Saturday, which marked one year since the law was signed. 

Several US regulatory agencies published proposed rules and collected public feedback during the past year, but no final regulations were issued before the deadline.

These agencies include the Department of the Treasury, the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC) and the Federal Reserve Board, which issued proposed rules but no final rules, according to rulemaking trackers by law firm Chapman and crypto investment company Paradigm.

Missing the statutory deadline does not invalidate the GENIUS Act, but the unfinished rules may result in regulatory uncertainty for stablecoin issuers. 

The GENIUS Act established the first comprehensive federal regulatory framework for stablecoins in the US. The act was signed into law by US President Donald Trump on July 18, 2025.

Related: ABA, state banking groups push back on CLARITY Act stablecoin yield provisions

Regulators issued 10 rule proposals during the GENIUS Act’s first year

Federal regulators issued 10 notices of proposed rulemaking (NPRM) in the year since the GENIUS Act was signed into law, according to Paradigm.

The Treasury Department issued four proposals covering the broader implementation of the act, including standards for determining whether state stablecoin regulatory regimes are similar to the federal framework, registration requirements for foreign stablecoin issuers and guidelines for compliance with anti-money laundering measures.

Rulemaking progress after the GENIUS Act was signed into law. Source: Paradigm.

The OCC issued two NPRMs covering nationally chartered payment stablecoin issuers, approval requirements and supervisory standards.

The FDIC issued one NPRM on FDIC-supervised institutions that issue payment stablecoins, focused on supervisory expectations and operational standards such as reserve management.

The National Credit Union Administration (NCUA) proposed rules enabling federally insured credit unions to participate in stablecoin issuance.

Finally, federal banking agencies jointly proposed an interagency implementation rule to harmonize supervision across the OCC, Federal Reserve and FDIC, aiming to ensure consistent supervisory expectations across all federal regulators.

Anchorage urges lawmakers to pass CLARITY Act

Federally chartered crypto bank Anchorage Digital has urged lawmakers to pass the Digital Asset Market Clarity Act (CLARITY).

“On GENIUS’ one-year anniversary, we’re renewing our call for Congress to pass the CLARITY Act and extend the clear market-structure rules that worked for stablecoins to the broader digital asset economy,” Anchorage Digital wrote in a Friday report.

The CLARITY Act seeks to establish the first federal regulatory framework for digital assets in the US. It cleared the Senate Banking Committee in May, though banking industry groups argued that it would allow crypto firms to offer yields on stablecoins without facing the same requirements as traditional banks.

On July 13, state banking associations, including the American Bankers Association (ABA) and the Independent Community Bankers of America (ICBA), sent a joint letter urging Senate leaders to provide more detail on the CLARITY Act’s stablecoin yield provisions and argued that new amendments need to prevent payment stablecoins from acting as deposit substitutes rather than pure transaction tools.

On June 26, Galaxy Digital cut its odds of the CLARITY Act becoming law in 2026 to 50%, citing the lack of a unified Senate Banking-Agriculture text, no firm floor schedule and a narrowing legislative window before lawmakers leave Washington. 

Magazine: Gambling on random Pokémon cards: Onchain gagcha hits record high as crypto sinks

South Korea’s Financial Supervisory Service (FSS) has reportedly begun a formal sanctions process related to the November 2025 $36 million exploit on Upbit, the country’s major crypto exchange operated by Dunamu. According to Yonhap News, the regulator has sent Dunamu an inspection opinion letter following a review of the incident.

The letter effectively opens the next stage of enforcement. It also gives Dunamu an opportunity to respond to the inspection findings before the FSS moves to notify the company of any proposed sanctions.

Key takeaways

• The FSS has reportedly issued an inspection opinion letter to Dunamu, kicking off a sanctions procedure after Upbit’s November 2025 $36 million hack.
• Yonhap reported that regulators are assessing whether Upbit violated the Virtual Asset User Protection Act, even though the law reportedly lacks direct penalties for cyberattacks and computer hacks.
• Upbit previously said it reimbursed affected customers using its own balance sheet funds and froze certain assets after the breach.
• Authorities are also weighing changes to South Korea’s Digital Asset Basic Act to add sanctions and compensation provisions for hacking and system failures.
• Upbit said it upgraded its wallet infrastructure after the incident and later introduced an automatic onchain tracing service intended to support recovery efforts.

FSS inspection letter launches enforcement step

Yonhap News reported Sunday that the FSS recently sent Dunamu an inspection opinion letter connected to the $36 million exploit that affected Upbit in late November 2025. The report frames the letter as the formal start of a sanctions process, with Dunamu able to respond to the findings before the regulator issues details of any proposed penalties.

The FSS is assessing whether the exchange breached the Virtual Asset User Protection Act. However, Yonhap noted that the statute does not provide direct sanctions provisions specifically for cyberattacks or computer hacking incidents.

This creates a compliance pressure point for exchanges and operators in South Korea: even when losses originate from security failures outside traditional financial market conduct, regulators are still attempting to map the incident to existing consumer protection obligations.

Criticism focused on delayed disclosure

Yonhap said Upbit faced criticism for delaying its announcement of the $36 million hack. The breach reportedly lasted about 54 minutes, beginning at 4:42 a.m. KST on November 27, but Upbit did not publicly disclose the incident until the end of the day.

The timing of the public disclosure, according to Yonhap, coincided with a merger-related event involving Naver Financial, after which the exchange finally announced the exploit. The regulatory review described in the report suggests that disclosure timing—along with incident handling—may be a key part of the FSS’s evaluation under the user protection framework.

Cointelegraph said it approached Dunamu for comment on the matter. No further response is included in the provided text.

Regulatory gap and proposed legislative changes

Yonhap also reported that South Korean authorities are considering how to address the current legal gap. The outlet said officials plan to add sanctions and compensation provisions for hacking and computer system failures into the second phase of the Digital Asset Basic Act.

For market participants, the significance is practical: a clearer statutory basis could shift enforcement from interpretive reviews—such as whether a hack violates broader user-protection obligations—to direct, incident-specific penalties and compensation duties. In other words, the likely focus may expand from “did the operator comply with existing rules?” to “did the operator meet explicit standards designed for cyber incidents?”

Until those amendments take effect, operators may remain exposed to enforcement theories rooted in consumer protection and operational responsibility, even where the law lacks cyberattack-specific sanction language.

Upbit’s response: reimbursements, wallet overhaul, and tracing

Upbit’s public response to the November 2025 exploit emphasized customer reimbursement and infrastructure changes. In a statement released after the incident, the exchange said it froze roughly 2.3 billion won (about $1.5 million) worth of funds. Upbit also said it would fully reimburse affected customers using its own balance sheet assets.

Separately, Upbit said it initiated an overhaul of its crypto wallet architecture after the exploit and migrated all assets from the wallets implicated in the incident. The exchange’s stated objective was to reduce exposure to potential vulnerabilities that could allow similar attacks to succeed.

In December 2025, Upbit said it developed an automatic onchain tracking service called the Onchain AI Tracer System, intended to trace the path of stolen funds and support recovery efforts.

These operational updates matter in the regulator’s context because they may influence how authorities assess whether Upbit took adequate steps both immediately after the breach and in the subsequent months. Even when reimbursement addresses direct user losses, regulators may still consider whether changes demonstrate robust incident prevention, transparent communication, and effective post-incident controls.

Upbit also ranks among the larger spot crypto exchanges in South Korea and globally, according to CoinMarketCap’s exchange rankings, which use scoring that includes traffic, liquidity, and trading volume.

Going forward, the key development to watch is Dunamu’s response to the FSS inspection opinion letter, since it will shape what sanctions—if any—are ultimately proposed. At the same time, traders and users should monitor the legislative process around the Digital Asset Basic Act’s next phase, because any move toward explicit hacking-related sanctions and compensation could materially alter how compliance is judged after major security incidents.

South Korea’s Financial Supervisory Service (FSS) has reportedly moved to formally examine whether crypto exchange operator Dunamu, the parent company behind Upbit, breached local rules after a $36 million hack last November. Yonhap News reported Sunday that the regulator recently sent Dunamu an inspection opinion letter—an early step that starts a sanctions process and gives the company a chance to respond to the FSS’s findings before any penalties are proposed.

At the center of the inquiry is a regulatory question about how existing South Korean law applies to cyber incidents. According to the same report, authorities are also looking at a potential legislative fix that would add clearer sanctions and compensation provisions for hacking and computer system failures.

Key takeaways

• The FSS has sent an inspection opinion letter to Dunamu, the operator of Upbit, marking the start of a formal sanctions procedure, per Yonhap News.
• Dunamu is expected to respond to the regulator’s inspection findings before any proposed sanctions are issued.
• The probe is tied to a $36 million exploit reported by Upbit in connection with a breach that lasted about 54 minutes on November 27, 2025, though the announcement came later that day.
• South Korean authorities are reviewing whether the incident violated the Virtual Asset User Protection Act, which currently lacks direct provisions for cyberattacks or computer hacks.
• The report indicates plans to address that legal gap in a second phase of the Digital Asset Basic Act by adding sanctions and compensation related to system failures.

Regulator signals sanctions after the November Upbit exploit

Yonhap News said the FSS recently sent Dunamu an inspection opinion letter following the November 2025 hack tied to Upbit. The letter effectively initiates the regulator’s step-by-step sanctions process, starting with a formal assessment and allowing the exchange operator to reply before the FSS notifies the company of any proposed penalties.

The development matters for market participants because it frames the incident not just as a security lapse, but as a compliance issue under South Korea’s financial oversight. When regulators move from incident response to sanctions procedures, it typically signals heightened scrutiny over both operational controls and communications practices around material events.

Timing of Upbit’s disclosure comes under scrutiny

Yonhap also highlighted criticism directed at Upbit regarding the timing of its public disclosure about the $36 million exploit. The report states that the breach began at 4:42 a.m. KST on November 27, 2025 and lasted roughly 54 minutes. However, Upbit did not announce the hack until the end of the day.

Yonhap attributed the delayed announcement to the conclusion of a merger-related event involving Naver Financial. That detail underscores the potential tension between corporate event calendars and the expectations regulators and users may have for timely disclosure after a major security incident.

Legal gap: current law lacks direct cyberattack sanctions

According to Yonhap, the FSS is reviewing whether the exchange violated the Virtual Asset User Protection Act. The report specifically notes that the act does not contain direct sanction provisions for cyberattacks or computer hacks.

This is a significant point for investors and compliance teams: if the law does not clearly address hacking events, regulators may have to rely on broader consumer protection obligations or other compliance standards to justify penalties. That can lead to uncertainty about outcomes—especially while case-specific interpretations develop.

Yonhap added that South Korean authorities intend to reduce this ambiguity by proposing additions for sanctions and compensation related to hacking and computer system failures in the second phase of the Digital Asset Basic Act. In practical terms, that suggests policymakers want future regulatory enforcement to be more direct and standardized when similar incidents occur.

Upbit’s response after the breach: reimbursement and wallet changes

Following the November exploit, Upbit said it froze approximately 2.3 billion won (about $1.5 million) worth of funds and would fully reimburse affected customers using its own balance sheet, according to a statement published on the exchange’s website. Upbit said it would reimburse impacted users rather than leaving them to absorb losses.

In addition to reimbursement, Upbit said it initiated an overhaul of its crypto wallet architecture to address potential vulnerabilities identified in the aftermath of the incident. The exchange also stated that it migrated all assets from wallets considered affected.

The operator’s efforts extended into onchain monitoring as well. In December 2025, Upbit said it developed an automatic onchain tracking service called Onchain AI Tracer System. The stated purpose was to follow the path of stolen funds and support potential recovery efforts.

For traders and users, these actions are relevant because they indicate how Upbit has approached both immediate risk containment and longer-term incident response. Yet regulators may still evaluate whether controls were sufficient before the breach, how the incident was managed during the window of compromise, and how promptly users were informed.

Separately, Upbit is described as ranking third in CoinMarketCap’s spot exchange rankings, based on a scoring system that includes factors such as traffic, liquidity, and trading volumes, according to CoinMarketCap’s exchange rankings page.

What to watch as the inspection and sanctions process unfolds

With the FSS inspection opinion letter now in place, the next key development will be how Dunamu responds to the regulator’s findings and what compliance arguments it presents around disclosure timing, incident handling, and the applicability of existing law. Observers should also watch the legislative track Yonhap described—if the second phase of the Digital Asset Basic Act adds cyber-focused sanctions and compensation provisions, it could materially change how future security incidents are regulated in South Korea.

Zcash founder Zooko Wilcox has explained how the network’s July 28 Ironwood hard fork will address uncertainty around a critical flaw in the Orchard shielded pool.

The upgrade will not identify or freeze individual counterfeit coins. Instead, it will seal the old pool and limit how much ZEC can leave.

In a July 19 post on X, Wilcox explained how the planned upgrade would deal with any hidden excess supply if the flaw was exploited before developers patched it. Because Orchard hides transaction details, the network cannot prove that counterfeit ZEC was never created.

Ironwood will seal the vulnerable Orchard pool

Ironwood, also known as NU6.3, is scheduled to activate at block 3,428,143 on July 28. The upgrade will retire the current Orchard pool and introduce a new shielded pool based on the corrected circuit.

According to Zcash’s official Ironwood user update, users will no longer be able to send or receive ZEC inside the old Orchard pool after activation. Funds can leave only through the turnstile, which prevents more ZEC from exiting than legitimately entered.

The Zcash team said it believes the flaw was “unlikely to have been exploited,” but users cannot independently prove no counterfeit ZEC was created. Ironwood aims to trap any excess value inside the old pool rather than allow it to enter wider circulation.

Orchard bug left a supply question Zcash could not prove away

Security researcher Taylor Hornby discovered the Orchard flaw on May 29 while auditing the shielded system. The bug could have allowed an attacker to create counterfeit ZEC inside Orchard without leaving an obvious public record.

As reported by crypto.news, developers first disabled Orchard activity and then restored it through the NU6.2 hard fork with corrected cryptography. No evidence of unauthorized value creation was found, but Orchard’s privacy means past exploitation cannot be ruled out with complete certainty.

Crypto.news later reported that Ironwood would create a fresh shielded pool and use the turnstile to control value leaving the old one. Node operators can then verify that circulating ZEC does not exceed the amount permitted by the network’s monetary rules.

Wallets and exchanges may temporarily pause services

Zcash users do not need to take immediate action before the hard fork. However, wallets, exchanges and other providers may temporarily suspend deposits, withdrawals or related services while completing software upgrades.

The official network guidance says Orchard users will eventually need wallet support to move funds into the new pool. Funds may remain temporarily unavailable in wallets that have not added the required migration tools.

The July 28 activation also follows Zcash’s move away from the legacy zcashd client. Providers still completing that migration may need more time before fully supporting Ironwood.

Zcash adds more security checks after the flaw

The Orchard incident led to wider security work across the Zcash ecosystem. As reported by crypto.news, an AI-assisted review using Anthropic’s Mythos system found no additional serious vulnerabilities after the original flaw was disclosed.

Developers are also pursuing independent audits and formal verification for the updated cryptographic system. The work aims to reduce the risk of another hidden counterfeiting flaw and give users stronger ways to verify Zcash’s supply rules.

Ironwood addresses the unresolved supply question rather than the already-fixed bug itself. By sealing Orchard and controlling withdrawals through the turnstile, the hard fork aims to prevent any hypothetical counterfeit ZEC from entering circulation.

Circle President Heath Tarbert has defended the company’s long-term strategy after Circle shares fell sharply from their post-IPO peak.

Speaking in a July 14 interview with FOX Business, Tarbert said management remains focused on building financial infrastructure rather than reacting to short-term moves in the stock.

The interview came as Circle faced growing investor concern over competition in the stablecoin market. CRCL had traded near $260 after its public debut before falling toward the low $60 range. Tarbert said Circle is “playing the long game” and argued that successful execution would eventually support shareholder value.

Tarbert points to USDC network effects

Tarbert said Circle’s main focus remains building a full-stack internet financial platform around USDC and related infrastructure. He argued that the company’s position cannot be measured only through daily stock movements and said the stock should “take care of itself” if Circle delivers on its wider mission.

He also defended USDC against new competitors. Tarbert pointed to roughly $73 billion in circulation and native support across 34 blockchains, saying those network effects would be “incredibly hard to replicate.” Circle describes USDC as a regulated digital dollar used across trading, payments and settlement.

Open USD adds new pressure to Circle

The comments came after Open Standard launched Open USD, a planned stablecoin backed by more than 140 participating businesses. The group includes Visa, Mastercard, Stripe, BlackRock, BNY and Coinbase. Open Standard says partners can mint and redeem Open USD without fees and receive reserve earnings after a management charge.

As reported by crypto.news, Circle shares fell 17.5% to $62.63 after Open USD entered the market and CRCL left several Russell Growth indexes. The decline added to concerns about whether new stablecoin models could pressure Circle’s economics.

Wall Street has also raised questions about that competition. Crypto.news reported that Mizuho cut its Circle price target to $50, arguing that Open USD’s revenue-sharing structure could pressure margins and raise distribution costs.

Circle faces pressure over USDC economics

Circle’s challenge extends beyond new stablecoin issuers.JPMorgan lowered earnings forecasts for Circle and Coinbase after a new revenue-sharing agreement tied to USDC balances on Hyperliquid. The bank said stronger adoption could come with lower reserve income retained by the companies.

Tarbert pushed back on the idea that competitors can quickly reproduce USDC’s reach. He also described USDC as the largest regulated stablecoin and said it leads in actual transaction volume, presenting scale and existing distribution as key parts of Circle’s competitive position.

Circle keeps expanding regulated infrastructure

Circle has continued adding regulated infrastructure despite the stock decline. On July 10, the company received final OCC approval to establish Circle National Trust. The trust bank will initially provide digital asset custody, with USDC reserve management planned as a possible future service.

As reported by crypto.news, the approval places the new entity under direct federal supervision. Circle says the structure could support wider institutional use of its digital asset infrastructure.

Tarbert’s comments frame the stock decline against a wider contest for stablecoin distribution and reserve income. Open USD brings a large group of payment and financial companies into the market, while Circle continues betting that USDC’s existing network and regulated infrastructure will support its long-term position.