Crypto’s security threat is no longer confined to hacked exchanges, phishing links, or compromised custody. According to a report released this week by blockchain analytics firm Chainalysis, criminals carried out more than $30 million in thefts through “wrench attacks” in the first half of the year—an alarming category of violent crimes that targets crypto holders using threats, coercion, kidnappings, and home invasions.

Chainalysis documented 46 violent crypto-related incidents globally through late June, up from 40 in the same period of 2025. If the pace holds, the year would exceed the $58 million record reported stolen via these physical attacks in 2025.

Key takeaways

• Chainalysis tracked 46 “wrench attacks” worldwide through late June, rising from 40 during the same period in 2025.
• Despite the violence, attacker “success” remains relatively low: only 12 of the 46 incidents resulted in payment (about 26%).
• France is the clear hotspot, with 30 publicly known incidents by midyear versus 19 throughout all of 2025; authorities reportedly recorded more than 70.
• Chainalysis links the increase to suspected data leaks and targeted selection of victims, not random violence.
• Some attackers appear operationally sophisticated—moving funds through exchanges, bridges, decentralized platforms, and laundering services—suggesting ties to broader criminal networks.

What Chainalysis calls “wrench attacks”

In Chainalysis’s terminology, wrench attacks are physical coercion attempts used to force victims to hand over crypto. The report highlights scenarios including kidnappings, home invasions, and hostage situations. While these crimes are often described in sensational terms, Chainalysis frames them as a structured threat model: victims are selected in advance, and the violence is used to extract access or payments.

The report underscores a key tension for investors, traders, and everyday holders: the risk extends well beyond software security and custody choices. Even people who hold funds safely—offline or with reputable custody solutions—could still be targeted if criminals believe they can force them to act under duress.

Chainalysis also cautioned that the totals likely understate the real problem. The firm noted that many attacks go unreported, meaning public documentation can lag behind actual victimization.

Fewer payments than last year, but the volume is rising

Although the number of violent incidents is increasing, Chainalysis reports that outcomes are not as consistently successful as the headlines might suggest. Of the 46 incidents recorded, only 12 resulted in a payment, producing a 26% success rate.

That rate is down significantly from 49% in 2025, when nearly half of documented attempts resulted in payments. For readers, this matters because it suggests attackers are facing more resistance—or, alternatively, that they are running larger operations with a higher proportion of failed attempts. In either case, a lower success rate does not necessarily mean the threat is shrinking; it can simply mean criminals are conducting more operations to reach the same or greater totals.

Chainalysis described the modus operandi as uneven in capability: “tradecraft tends to be amateur at the point of violence, but professional at both ends.” In other words, criminals may not execute the coercion with high technical skill, but the processes before and after the violence—such as identifying targets and monetizing stolen funds—can be more refined.

France emerges as the main battleground

The most striking geographic detail in the Chainalysis report is France’s concentration of documented incidents. The firm says France recorded 30 publicly known wrench attacks by midyear, compared with 19 incidents reported during all of 2025.

Chainalysis further notes that French authorities have counted more than 70 incidents overall. That gap implies that public figures represent only a portion of what investigators and officials are tracking, again reinforcing the likelihood that reported totals undercount the true scale.

The report also aligns with official comments earlier in the year. In July, France’s Interior Minister Laurent Nuñez put the first-half count at 77 kidnappings, extortions, or attempted extortions—rising from 45 across all of 2025. According to that reporting, France has introduced a rapid-alert and protection system and promised enhanced intelligence-sharing and coordination with the crypto industry.

Data leaks, suspected tax-record misuse, and how criminals move money

Chainalysis attributes the surge in France largely to suspected misuse of French tax records. The report states that a French tax official allegedly accessed and sold information about crypto investors to criminals. Chainalysis also references a separate breach at crypto tax-reporting company Waltio, which was reportedly linked to exposure of data for about 50,000 users.

For holders, the implication is direct: wrench attacks appear to rely on victim identification rather than luck. If criminals can pinpoint which individuals likely hold valuable crypto and when they might be vulnerable, the physical attack becomes more targeted—and potentially more scalable.

The report also describes how stolen funds may be handled differently depending on the sophistication of the perpetrators. In some cases, attackers allegedly sent funds straight to centralized exchanges. Other cases involved the use of bridges, decentralized exchanges, and laundering services. Chainalysis said the most advanced incidents showed links to broader criminal networks, suggesting that the people carrying out violence may not be the same actors responsible for the entire financial operation.

That split matters for prevention: it suggests that public safety measures alone may not be sufficient. A credible response likely needs both improved physical protection for potential victims and stronger controls around data access—especially in areas where personal financial information can be accessed or exported improperly.

As this threat evolves, readers should watch whether the reported incident counts continue to rise in France and whether success rates remain suppressed or begin to climb again. Chainalysis’s findings also point to a key indicator for future risk: the extent to which leaked or misused financial data continues to supply criminals with targets.

Introduction

For centuries, money has served a simple purpose: it stores value, facilitates trade, and acts as a unit of account. Whether in the form of coins, paper bills, or digital bank balances, money has traditionally remained passive. It waits for humans to decide when, where, and how it should be used.

Blockchain technology is changing that assumption.

The emergence of programmable capital transforms money from a static asset into an intelligent financial tool capable of executing predefined rules automatically. Instead of relying on banks, intermediaries, or manual approvals, programmable capital allows digital assets to move, invest, distribute, or lock themselves according to transparent code.

This innovation is rapidly becoming one of the foundational building blocks of decentralized finance (DeFi), tokenized assets, digital commerce, and the future internet economy.

What Is Programmable Capital?

Programmable capital refers to digital assets that can automatically perform financial actions based on predefined conditions encoded in smart contracts.

Unlike traditional money, programmable capital can:

• Release payments automatically
• Distribute revenue instantly
• Enforce financial agreements
• Trigger investments
• Pay royalties
• Lock or unlock funds
• Manage collateral
• Execute trades

—all without requiring manual intervention.

In simple terms:

Traditional money waits for instructions. Programmable capital already knows what to do.

The Technology Behind It

Programmable capital is made possible through smart contracts.

A smart contract is software deployed on a blockchain that automatically executes when predefined conditions are met.

For example:

“If Product A is delivered…”

→ Release payment.

“If staking rewards reach 100 tokens…”

→ Automatically compound rewards.

“If a loan becomes undercollateralized…”

→ Liquidate collateral.

No human approval is needed once the contract has been deployed.

The blockchain guarantees that the code executes exactly as written.

Why Programmable Capital Matters

The traditional financial system depends heavily on intermediaries.

Banks verify transfers.

Lawyers enforce agreements.

Accountants calculate distributions.

Payment processors settle transactions.

These layers increase:

• Cost
• Time
• Complexity
• Operational risk

Programmable capital removes much of this friction by embedding financial logic directly into the asset itself.

Money becomes capable of enforcing its own rules.

Real-World Examples

1. Payroll Automation

Imagine an international company with employees across 30 countries.

Instead of manually processing salaries every month, programmable capital could:

• Verify employment status
• Calculate tax deductions
• Convert currencies
• Send salaries automatically
• Record transactions on-chain

Payroll becomes instant and transparent.

2. Streaming Payments

Instead of paying freelancers after completing an entire project, programmable capital can stream earnings continuously.

For every second worked:

• Funds are released automatically.

No invoices.

No waiting periods.

No delayed payments.

3. Automated Royalties

Artists, musicians, writers, and game developers often rely on royalty collection agencies.

Programmable capital enables royalties to be distributed automatically whenever digital content is sold or used.

Revenue instantly reaches:

• Creator
• Collaborators
• Publishers
• Investors

Each party receives their predefined percentage without disputes.

4. Decentralized Lending

In DeFi lending protocols:

Users deposit collateral.

Borrowers receive loans.

Interest accumulates automatically.

If collateral falls below safety thresholds:

Smart contracts initiate liquidation instantly.

No bank employee makes the decision.

The protocol operates autonomously.

5. Revenue Sharing

Businesses can tokenize their revenue streams.

Every time profits arrive:

Smart contracts automatically distribute income among:

• Investors
• Founders
• Treasury
• Community
• Liquidity providers

Distribution becomes transparent and verifiable.

Programmable Capital in DeFi

DeFi is perhaps the best example of programmable capital in action.

Every major DeFi application relies on automated financial logic.

Examples include:

Lending

Funds earn interest automatically.

Staking

Rewards are calculated and distributed continuously.

Automated Market Makers (AMMs)

Liquidity pools price assets without centralized exchanges.

Yield Farming

Rewards follow mathematical formulas encoded in smart contracts.

Stablecoins

Supply expands or contracts based on protocol rules.

Everything operates through programmable financial infrastructure.

Benefits of Programmable Capital

Greater Efficiency

Transactions occur automatically.

No paperwork.

No manual processing.

No unnecessary delays.

Lower Costs

Removing intermediaries significantly reduces transaction fees and administrative expenses.

Businesses save both time and money.

Transparency

Every transaction is publicly verifiable on-chain.

Rules cannot be secretly changed after deployment.

Global Accessibility

Anyone with an internet connection and a compatible wallet can interact with programmable capital.

Geography becomes far less relevant.

24/7 Operation

Traditional financial institutions close after business hours.

Programmable capital never sleeps.

Transactions execute around the clock, every day of the year.

Challenges and Risks

Despite its advantages, programmable capital is still evolving.

Smart Contract Bugs

Code errors may lead to financial losses if contracts are poorly audited.

Regulatory Uncertainty

Governments worldwide are still determining how programmable financial assets should be regulated.

Future policies may shape adoption.

Oracle Dependency

Many smart contracts depend on external data feeds.

If an oracle provides inaccurate information, contracts may execute incorrectly.

User Experience

Managing wallets, private keys, and blockchain transactions remains difficult for many newcomers.

Improved interfaces will be essential for mass adoption.

Industries That Could Be Transformed

Programmable capital extends well beyond cryptocurrency.

Potential applications include:

• Real estate settlements
• Insurance claims
• Supply chain finance
• Healthcare reimbursements
• Subscription services
• Government aid distribution
• Corporate treasury management
• Carbon credit markets
• Cross-border trade
• Gaming economies

Any financial workflow based on predefined rules can potentially become programmable.

The Future of Money

As tokenization expands and real-world assets move on-chain, programmable capital will become increasingly common.

Imagine a future where:

• Mortgages adjust automatically to interest rate changes.
• Investments rebalance themselves according to market conditions.
• Businesses distribute dividends instantly.
• Insurance claims settle within minutes.
• Supply chain payments execute immediately after delivery confirmation.
• Autonomous AI agents manage portfolios using programmable financial rules.

Money evolves from being merely digital to becoming intelligent.

Conclusion

Programmable capital represents one of the most significant innovations enabled by blockchain technology. By embedding logic directly into digital assets, it allows money to move, invest, distribute, and enforce agreements automatically without relying on traditional intermediaries.

While challenges around security, regulation, and usability remain, the potential benefits—greater efficiency, transparency, lower costs, and global accessibility—are driving rapid adoption across decentralized finance and beyond.

As blockchain infrastructure matures, programmable capital is poised to reshape how individuals, businesses, and governments interact with value. In the years ahead, the question may no longer be whether money can be programmed—but how much of the global economy will eventually run on it.

REQUEST AN ARTICLE

JPYC Inc. raised 6 billion yen ($38 million) in an extension of its Series B funding round to accelerate the expansion of its yen-pegged stablecoin.

The investment brings the company’s total raised to $106 million across seven funding rounds since November 2021, according to venture capital data site Tracxn.

New investors in the latest round include AZ-COM Maruwa Holdings (9090), a major Japanese logistics company.

AZ-COM plans to settle payments in JPYC with its clients, including Amazon Japan. Its network of around 2,300 partners is made up of subcontractors, drivers and so on. The move marked the first large-scale corporate use of a stablecoin for daily business operations in Japan.

JPYC is one of the most prominent stablecoins pegged to the Japanese yen with a market cap of $55.5 million, according to data tracked by CoinGecko.

Stablecoins are digital tokens pegged to the value of a traditional financial asset, usually a fiat currency. The market is overwhelmingly dominated by tokens pegged to the U.S. dollar. The yen stablecoin sector is growing, helped by adoption among some of Japan’s largest financial institutions, but remains negligible in the context of the USD-dominated market.

Sandisk (SNDK) and Western Digital (WDC), two of the biggest beneficiaries of the AI storage boom, were both 10% lower in pre-market trading Thursday, despite reporting strong quarterly results.

Sandisk posted record fourth-quarter revenue of $8.97 billion and non-GAAP EPS of $39.25, comfortably beating expectations. Western Digital also delivered a double beat, reporting revenue of $3.75 billion, up 44% year over year, while its gross margin surged to 54.4%. Despite those results, both stocks are now trading roughly 50% below their all-time highs.

The problem was guidance. Sandisk’s first-quarter outlook came in below expectations, with projected revenue of $10.7 billion versus the $11.2 billion analysts had estimated. Its EPS guidance also fell short. Western Digital’s first-quarter outlook was solid, but after a 500% run, investors were looking for another blowout beat.

Sandisk and Western Digital have gained more than 3,000% and 550%, respectively, over the past 12 months, propelled by the AI boom and leaving assets such as crypto and precious metals in the rearview mirror.

In addition, Sandisk’s board of directors has also approved an additional $14 billion share buyback program, bringing the total authorization to $15.5 billion.

Bitget has signed a cooperation agreement with Bhutan’s Gelephu Mindfulness City Authority to establish a local presence and pursue a Financial Services Licence under the city’s virtual asset framework.

According to Bitget, the agreement provides a framework for the exchange to establish a legal entity in Gelephu Mindfulness City (GMC), prepare an application for a Financial Services Licence under the regulatory framework administered by the Gelephu Financial Services Office (GFSO), and collaborate with the Gelephu Mindfulness City Authority (GMCA) on operational, regulatory and ecosystem development workstreams. The company said the cooperation remains subject to the required regulatory approvals.

Bitget plans legal entity and license application in Bhutan

Under the announced framework, Bitget intends to establish offices in GMC over time and hire locally as part of its long-term presence in Bhutan. The company said the local setup will support talent development, knowledge transfer and capability building alongside its exchange operations.

Gracy Chen, chief executive officer of Bitget, said Bhutan combines long-term planning, renewable energy resources and a regulatory framework that supports digital assets. She added that the company intends to contribute exchange infrastructure, operational experience and local talent development as the ecosystem develops.

The agreement also commits both parties to cooperate on regulatory processes and ecosystem-building activities tied to GMC’s financial services framework rather than limiting the relationship to licensing alone.

Gelephu Mindfulness City requires licensed virtual asset firms

Located in southern Bhutan, Gelephu Mindfulness City is being developed as a Special Administrative Region with ambitions to become an international financial and innovation hub.

Its virtual asset regime operates under the Financial Services Act 2025 and related rulebooks. Under that framework, companies providing regulated financial services or virtual asset activities in or from GMC must obtain a Financial Services Licence from the GFSO before operating.

Jigdrel Singay, board director of Gelephu Mindfulness City, said the city’s objective is to develop a digital asset ecosystem built on regulation, institutional standards and long-term economic value. He said partners such as Bitget contribute international expertise while helping strengthen local capabilities and the financial ecosystem.

The announcement also referred to Bhutan’s Bitcoin Development Pledge announced in December 2025, which presented the country’s strategy for integrating digital assets into economic development while promoting institutional participation and regulatory oversight.

Bhutan has already drawn attention within the digital asset industry for using surplus hydropower to support environmentally powered Bitcoin mining as part of efforts to diversify the economy, create employment opportunities and retain young professionals.

Bhutan agreement extends Bitget’s jurisdiction-by-jurisdiction strategy

The Bhutan announcement follows several regulatory moves by Bitget across different markets during the past few weeks.

Earlier this month, the exchange announced that it would withdraw services for residents of Japan instead of seeking local authorization. New account registrations have already been suspended, while account restrictions are scheduled to begin on Nov. 1. Bitget also said any positions that remain open on Dec. 31 will be closed automatically.

The Japan withdrawal came after repeated warnings from Japan’s Financial Services Agency in 2023 and 2024 over operating without registration. In June 2025, the Kanto Local Finance Bureau also issued a warning to BTG Technology Holdings Limited, identifying the company as operating under the Bitget name while allegedly soliciting certain online derivatives transactions without registration.

Outside Japan, the exchange has continued applying for registrations and approvals where it plans to maintain a local presence.

In July, Bitget completed registration on New Zealand’s Financial Service Providers Register across five financial service categories, including foreign exchange, client asset custody, domestic and cross-border money transfers, portfolio management, and execution of financial products. The company also joined New Zealand’s Insurance and Financial Services Ombudsman dispute resolution scheme.

New Zealand’s Companies Office has stated that registration on the FSPR does not itself constitute government approval or active regulatory supervision. Depending on the activity involved, separate authorization from the Financial Markets Authority or the Reserve Bank of New Zealand may still be required.

Local licensing remains central to Bitget’s expansion plans

Bitget has adopted a market-by-market regulatory approach rather than offering identical services across all jurisdictions.

During July, the exchange confirmed that Singapore remains a restricted jurisdiction because it is not licensed, approved, registered or supervised by the Monetary Authority of Singapore. The company said it neither offers services to nor targets residents in the country.

The exchange is also preparing for a return to the United States. As previously reported by crypto.news, Bitget plans to establish an independent U.S. entity before launching services and will first pursue money-transmitter, broker-dealer and derivatives approvals. She said the company’s U.S. expansion will proceed regardless of whether Congress ultimately passes the CLARITY Act.

Alongside its regulatory work, Bitget has continued expanding its tokenized investment products. Chen previously said tokenized traditional assets accounted for between 20% and 30% of the exchange’s spot trading volume during the previous quarter, while 52% of Bitget users held both cryptocurrencies and stocks.

Stolen funds tied to the Coldcard hardware wallet exploit are showing early signs of laundering, but blockchain security researchers say most potential copycats have not yet moved large amounts of the victimed crypto. According to CertiK, about 64 Bitcoin (worth roughly $4.17 million) and 200 Ether (worth about $380,000) linked to the attack were routed into well-known mixing services—Wasabi for BTC and Tornado Cash for ETH.

The Coldcard incident has quickly become one of the largest crypto hacks of the year. Galaxy Digital previously put confirmed losses at least at $100 million in Bitcoin across three waves, and it also flagged a possible fourth wave that could raise total losses to around $130 million.

Key takeaways

• CertiK says roughly 64 BTC linked to the Coldcard exploit were sent to Wasabi, and 200 ETH were moved to Tornado Cash.
• Mixing services typically pool funds and obscure onchain linkages, reducing the odds of recovery for victims.
• TRM Labs’ tracing suggests most victim balances remain concentrated in a small set of attacker-controlled addresses with limited mixing activity.
• Analysis of transaction patterns across attack waves indicates the exploit may involve more than one actor.

Mixing services enter the Coldcard laundering picture

CertiK’s blockchain monitoring connected specific transfer activity to the Coldcard exploit and mapped part of the flow into privacy and obfuscation tooling. In its reporting, CertiK indicated that the Bitcoin transfer—sourced from address bc1q0—was sent to the Wasabi mixing protocol on Tuesday, using CertiK’s address data shared with Cointelegraph.

On the Ethereum side, CertiK stated that 200 ETH were sent to Tornado Cash on Wednesday, pointing to an X post from its account as the basis for the observation.

Crypto mixers like Tornado Cash operate by pooling deposits from multiple users and then releasing funds in a way that breaks straightforward onchain tracking from original sender to final recipient. That feature is precisely what makes tracing more difficult and asset recovery less likely—especially when attackers move quickly and fragment funds across multiple addresses and services.

Why this matters: laundering momentum vs. copycat behavior

CertiK’s spokesperson told Cointelegraph that the activity could be linked to a smaller exploiter, adding that “there’s likely a few copycats after the initial exploit.” The implication is straightforward: if additional parties used the same weakness, their onchain movement could help or hinder investigators depending on whether they follow up with laundering at scale.

That’s where TRM Labs’ findings become important. In a Thursday report titled “The largest hardware wallet exploit of 2026: inside the $116 million Coldcard hack”, TRM Labs said its onchain tracing indicates most victim funds were still pooled in a limited number of attacker-controlled addresses and that mixing attempts appeared restrained.

TRM Labs also highlighted that “differences in transaction construction” between each wave suggest multiple attackers. In other words, even if the underlying vulnerability was shared, the operational playbook may not be identical—an asymmetry that can be useful for investigators trying to separate participant identities, funding sources, and laundering pathways.

Coldcard hack scale and the “waves” pattern

Galaxy Digital previously characterized the Coldcard exploit as the third-largest cryptocurrency hack of 2026 so far, based on confirmed activity. In its assessment, Galaxy put drained losses at at least $100 million in Bitcoin across three verified attack waves involving 7,300 victim wallets. Galaxy also pointed to a suspected fourth wave that could lift total losses to roughly $130 million in BTC, according to earlier coverage from Cointelegraph.

Those wave-based findings matter for how analysts interpret laundering. If attackers are not distributing funds aggressively—or if only one portion of the stolen assets has been moved into mixers—then the time dimension becomes critical: investigators may still be waiting for broader follow-through as additional actors or additional batches of stolen funds begin to move.

Galaxy’s earlier analysis, also cited by Cointelegraph, suggested at least 15 different attackers exploited the vulnerability. This lines up with TRM Labs’ point about differences in transaction construction between waves, reinforcing the idea that what may look like a single incident could actually be a coordinated (or at least parallel) operation with distinct participants.

The technical weakness behind the exploit

TRM Labs’ report attributed part of the vulnerability to a firmware bug from March 2021 that weakened seed randomness on some Coldcard wallets. According to TRM Labs, the bug effectively reduced key strength to 40 bits from 128 bits, making it “brute-forceable without physical access.”

Other commentary around the fix has emphasized the low cost of better security hygiene. Dragonfly managing partner Haseeb Qureshi wrote that approximately “$2 of AI hardening” could have prevented the Coldcard exploit, referencing social media reports that some AI models rediscovered the vulnerability quickly—though those claims are framed as commentary rather than formal technical findings.

For investors and builders, the core takeaway is less about any single price tag and more about how quickly weaknesses can be weaponized once public knowledge spreads. When a vulnerability can be exploited remotely and at scale, incident response needs to account for both immediate attackers and longer-tail copycats.

Going forward, readers should watch whether additional attacker-controlled addresses begin pushing larger portions of stolen balances into mixing services, and whether the “suspected” fourth wave confirmed by Galaxy develops further. As more funds move—or fail to move—onchain, investigators will gain clearer signals about how many actors are involved and how successfully they’re managing to break traceability.

Russian President Vladimir Putin has signed legislation that lays out a regulated framework for cryptocurrency markets in Russia, marking a significant shift from the country’s largely restrictive posture toward a formal rules-based approach for licensed crypto activity.

The law, identified as bill No. 1194918-8 and titled “On Digital Currencies and Digital Rights,” was signed on Tuesday, according to official records from the State Duma, Russia’s lower house of parliament. It sets out requirements for major categories of crypto market participants, including exchanges, brokers, custodians, and other service providers.

Key takeaways

• Russia has moved toward a regulated crypto market through bill No. 1194918-8 (“On Digital Currencies and Digital Rights”).
• Crypto exchanges must meet regulatory conditions and join a financial market self-regulatory organization.
• Retail investors will be limited to purchasing only approved digital assets via intermediaries, with a 300,000 ruble annual cap per intermediary.
• Qualified investors are expected to face fewer restrictions and be able to buy any cryptocurrency.
• The law keeps Russia’s ban on using crypto assets to pay for goods and services domestically.

What the law changes for Russian crypto activity

At the center of the new bill is a licensing and oversight model intended to bring Russia’s crypto market into a clearer regulatory structure. The legislation defines rules for key participants across the crypto ecosystem, including trading venues (exchanges) and intermediary services such as brokerage and custody.

Under the framework, operators of crypto exchanges are required to comply with regulatory requirements and become members of a financial market self-regulatory organization. That combination suggests that, beyond direct supervision, exchanges will likely be subject to additional industry-level governance through the self-regulatory body.

Limits for retail investors, flexibility for qualified investors

A major practical feature of the law is how it differentiates between types of market participants. The bill limits retail investors’ access to cryptocurrencies by requiring intermediaries to sell only approved crypto assets and by imposing a quantitative ceiling on purchasing activity.

Specifically, the law sets an annual cap of 300,000 rubles (about $3,700) per intermediary for retail investors. Qualified investors, by contrast, will be allowed to purchase any cryptocurrency without the same restrictions.

For everyday users and smaller investors, the implication is straightforward: access to the broader crypto market could become more fragmented and filtered through intermediaries—while larger or more formally designated investors may be able to maintain wider exposure.

Regulatory oversight and the approval process

According to the law as reported through official parliamentary records, the Bank of Russia will be responsible for overseeing the regulated crypto market. That includes issuing related regulatory rules and determining which crypto assets licensed intermediaries can offer to investors.

In late July, the State Duma approved the legislation after final readings, an earlier step referenced in separate coverage at Cointelegraph. With the signing now completed, implementation becomes the next critical phase—particularly because different parts of the law take effect at different times.

When rules take effect—and what stays prohibited

Timing matters for investors, exchanges, and service providers because regulatory obligations rarely arrive all at once. The core provisions of the law take effect on Sept. 1, 2026. Some elements—including rules covering non-resident digital depositories—are scheduled to begin on July 1, 2027.

The law also preserves an existing prohibition on using crypto assets to pay for goods and services within Russia. That means the new regulatory structure is aimed at governance of crypto market participants and investor access, rather than enabling everyday crypto spending domestically.

Why this framework could reshape Russia’s crypto market

This legislation matters beyond legal formality because it defines who can participate, what assets can be offered through licensed channels, and how investors access those markets. By placing responsibility on the Bank of Russia to issue rules and approve which assets intermediaries may provide, the law effectively creates a gatekeeping mechanism—one that could influence liquidity, available trading pairs, and the list of cryptocurrencies that reach retail customers.

The retail investment cap per intermediary may also affect product design for brokers and custodians, since their compliance exposure would be linked to both approved asset lists and distribution limits. Meanwhile, the distinction between retail and qualified investors suggests that market access will not be uniform: segments of the investor base could experience different levels of flexibility and risk exposure depending on their classification.

As the implementation dates draw closer, market participants will likely focus on how the Bank of Russia translates the law into operational guidance—especially around licensing conditions, asset approval procedures, and the treatment of non-resident digital depositories.

Investors and builders should watch closely for the Bank of Russia’s rulemaking and for how “approved” crypto assets are selected, since those decisions will determine what retail users can realistically access before the Sept. 1, 2026 start date.