A Bitcoin wallet linked to convicted Irish drug dealer Clifton Collins has transferred 500 BTC worth about $39.56 million to Coinbase Prime after the coins were reportedly inaccessible because their private keys had been lost.

Collins-linked Bitcoin has moved to Coinbase Prime

Lookonchain said in an Aug. 28 X post that Bitcoin connected to Collins was “moving again,” with 500 BTC reaching Coinbase Prime. The blockchain tracker valued the transaction at $39.56 million when it reported the transfer.

At the stated value, each Bitcoin was worth about $79,120. Lookonchain associated the transfer with a group of wallets that once held approximately 6,000 BTC and were thought to be inaccessible after their private keys disappeared.

The blockchain data identifies movements between labeled addresses, but Lookonchain did not provide evidence that Collins personally controlled the sending wallet or directed the transaction. Irish authorities had already gained access to several wallets in the same group, making it possible that the latest activity involved seized assets under official control.

Coinbase Prime serves institutions, companies, and government agencies through custody and trade execution services. Although Bitcoin sent to the platform could be sold, the deposit alone does not show whether the coins were liquidated, placed in custody, or moved as part of an asset-management process.

No statement from Ireland’s Criminal Assets Bureau, An Garda Síochána or Europol accompanied the latest transaction at the time of Lookonchain’s report. Without an official notice, the purpose of the transfer and the party that authorized it remain unconfirmed.

How authorities recovered the lost Bitcoin

Collins acquired about 6,000 BTC in late 2011 and early 2012 with proceeds from cannabis sales, according to earlier reports cited by Irish authorities and blockchain intelligence firms. Bitcoin traded at around $5 during parts of that period, putting his estimated purchase cost near $30,000 before the holdings later rose to hundreds of millions of dollars.

Rather than keeping the balance in one place, Collins reportedly divided the coins among 12 wallets containing roughly 500 BTC each. He printed the private keys on a sheet of paper and concealed it inside the aluminum cap of a fishing rod case stored at a rented property in County Galway.

Following his arrest in 2017, the property was cleared, and the fishing equipment was believed to have been taken to a waste facility. With the paper no longer available, the Bitcoin appeared unreachable even after the assets became subject to seizure proceedings.

Access began returning in March 2026, when Irish authorities announced that they had opened one of the wallets with help from Europol’s European Cybercrime Centre. As reported in March by crypto.news, the recovered wallet held 500 BTC and sent the coins to Coinbase Prime after years without activity.

Ireland’s Criminal Assets Bureau said Europol provided “highly complex technical expertise and decryption resources” for the operation. Neither agency disclosed the method used to open the wallet, leaving the technical details of the recovery outside the public record.

A second 500 BTC wallet became accessible by May, increasing the amount recovered from the Collins-linked group to 1,000 BTC. Earlier coverage of the seizure reported that the second batch followed a different route, reaching a Binance deposit address linked by Arkham Intelligence to market maker Wintermute rather than Coinbase Prime.

Previous recoveries reached 1,500 BTC

By early July, the Criminal Assets Bureau had secured another wallet with support from Europol, taking the known recovery to 1,500 BTC. A third 500 BTC recovery reduced the amount still associated with dormant addresses to about 4,500 BTC at the time.

The bureau said its July operation again involved the European Cybercrime Centre. Europol hosted operational meetings in The Hague and supplied technical and decryption support, according to the agency’s statement cited in the earlier report.

Lookonchain separately observed a 500 BTC deposit to Coinbase Prime around the same period, valuing that transaction at approximately $30.85 million. The Aug. 28 transfer carried the same number of coins but a higher dollar value because Bitcoin was trading at a higher price.

While the latest movement may represent access to another wallet, neither Lookonchain nor an Irish agency confirmed that authorities had completed a fourth 500 BTC recovery. Counting it as an additional seizure before an official statement would therefore go beyond the available evidence.

The original structure of 12 wallets, each holding about 500 BTC, explains why the observed transactions have repeatedly appeared in equal-sized batches. Public blockchain labels can connect addresses with known entities, though such labels do not always identify the person or agency controlling the private keys at the time of a transfer.

Coinbase Prime also handles U.S. seized assets

Coinbase Prime’s role gives the story a direct point of comparison for U.S. readers because American agencies also use the platform to manage forfeited cryptocurrency. The U.S. Marshals Service selected Coinbase Prime in 2024 to provide custody and trading services for certain seized digital assets.

In July 2026, wallets attributed to the U.S. government transferred nearly $297 million in Bitcoin and Ether to the platform. The transaction included about 3,940 BTC worth $244 million and approximately 30,000 ETH valued at $53 million, according to government wallet data.

Coinbase offers custody, financing, and execution through its institutional platform, so government deposits do not establish that a sale has occurred. U.S. agencies may transfer digital assets to consolidate holdings, satisfy a court order, return funds to verified victims, or prepare assets for disposal where legally permitted.

President Donald Trump’s March 2025 executive order created a Strategic Bitcoin Reserve for forfeited BTC held by the federal government. The order states that Bitcoin placed in the reserve should not be sold, while allowing agencies to follow court orders and meet restitution or law-enforcement obligations under existing law.

Ireland operates under its own asset-recovery system. The Criminal Assets Bureau pursues property considered to be proceeds of crime, while Europol can supply technical support to member states during investigations. Irish officials had not publicly identified the legal or operational purpose of the Aug. 28 Coinbase Prime transfer when Lookonchain flagged the transaction.

Bullish has provided USD.AI with a $100 million stablecoin debt facility to fund loans secured by graphics processing units used in artificial intelligence infrastructure.

Bullish said in a Friday announcement that the facility will give USD.AI capital to finance operators purchasing high-performance computing equipment, extending the exchange operator’s exposure to tokenized assets and AI infrastructure.

Developed by Permian Labs, USD.AI connects stablecoin liquidity with companies seeking funds to buy GPUs. Instead of evaluating claims against a borrower’s entire business, the platform issues non-recourse loans secured by the computing hardware purchased with the financing.

Bullish Head of Tokenization Thomas Cowan said the company used USD.AI’s onchain records when assessing the facility. Bullish had already invested in the platform before agreeing to provide the new debt financing.

“Our commitment to USD.AI reflects a conviction we’ve believed since our first investment in the protocol: that credible, well-structured real-world assets belong onchain.”

Bullish facility expands USD.AI’s GPU loan capacity

Under the arrangement, USD.AI will use the $100 million facility to originate loans for middle-market AI infrastructure operators. Ownership of the financed hardware provides the collateral, while the loan does not create a claim against the operator’s other corporate assets, according to the announcement.

Such a structure separates the loan from the borrower’s main balance sheet, but repayment still depends on the income and resale value generated by the underlying computing equipment. GPUs can lose value as newer models enter the market, making loan terms, collateral checks and repayment schedules important parts of the financing process.

USD.AI has already completed large transactions involving recent Nvidia hardware. In June, the protocol announced a $98.1 million loan backed by 2,304 Nvidia B300 GPUs, while investors fully funded another $34 million facility secured by 768 Nvidia B200 units.

Combined, the two disclosed loans involved 3,072 GPUs and more than $132 million in financing. The latest Bullish facility gives the protocol another source of stablecoin liquidity as it adds loans for operators building data centers and AI computing clusters.

Permian Labs CEO David Choi said demand for computing equipment has created a distinct lending category.

“Compute is becoming a credit market in its own right,” Choi said, adding that Bullish’s facility would allow USD.AI to finance more infrastructure and develop trading markets for compute-backed debt.

According to USD.AI, its financing is settled onchain and gives capital providers exposure to loans backed by income-producing computing equipment. The company describes the funding as non-dilutive because operators do not have to surrender an ownership stake when borrowing.

sUSDai listing will create a secondary trading market

Alongside the lending facility, Bullish plans to introduce sUSDai across several trading pairs on its institutional exchange. A dedicated market-making program will provide orders for the token once trading begins, according to the companies.

USD.AI uses sUSDai as its yield-bearing token, giving holders exposure to returns generated from the protocol’s credit operations. Listing the asset would allow holders to trade the position instead of relying only on the repayment period of the underlying loans.

Bullish expects the program to improve secondary liquidity and price discovery for GPU-backed debt. The companies did not disclose the planned trading pairs, launch date or market-making budget in Friday’s announcement.

At the same time, Bullish and USD.AI are expanding a research project focused on ways to finance capital spending in the AI sector. The work will combine Bullish’s experience operating institutional markets with USD.AI’s lending structure, according to the announcement.

Tokenized exposure to computing hardware has appeared elsewhere in the crypto market. In August 2025, Injective introduced an Nvidia GPU derivatives market that allowed traders to gain exposure to rental prices for Nvidia H100 processors.

Aethir and Injective also launched a tokenized GPU marketplace in December 2024, using blockchain-based products to provide access to computing capacity. Unlike those trading and rental products, USD.AI’s model centers on secured loans issued to infrastructure operators.

Bullish deepens an existing USD.AI relationship

The $100 million facility follows Bullish Capital’s $4 million investment in USD.AI in September 2025. Cowan said onchain transparency allowed Bullish to review the protocol using the institutional underwriting standards applied elsewhere across its business.

Bullish operates spot and derivatives markets for professional investors and supplies the liquidity supporting the new facility.

In Europe, Bullish operates under the European Union’s Markets in Crypto-Assets framework as an authorized crypto asset service provider offering spot trading and custody. Its U.S. presence expanded after the company obtained a New York BitLicense in September 2025, when crypto.news reported that Bullish shares gained nearly 6% following the approval.

The license allowed Bullish to serve eligible customers in New York and arrived about one month after its public listing. Regulatory approval in the state added to the company’s U.S. operations, although Friday’s announcement did not specify whether sUSDai would be offered to American customers or describe any access limits.

Bullish stock rebounds after steep post-IPO decline

For U.S. investors, the transaction adds AI infrastructure lending to the businesses tied to NYSE-listed Bullish shares under the ticker BLSH. Any financial effect will depend on the facility’s terms, loan performance, and contribution to Bullish’s results, none of which the companies disclosed.

Bullish completed its New York Stock Exchange debut in August 2025 after pricing shares at $37. The offering raised about $1.03 billion, while the stock opened at $90 during its first trading session.

Earlier coverage of the Bullish public offering reported that the company entered the market at a valuation of about $5.4 billion after pricing above its original range. BlackRock-managed funds and accounts linked to ARK Investment Management had indicated interest in purchasing up to $200 million of stock.

Despite its recent recovery, BLSH remains more than 60% below its $90 opening price, according to Yahoo Finance data. The shares traded around $33 on Friday after gaining approximately 45% during the preceding month.

Other U.S.-traded crypto companies also advanced over the same period. Bitcoin treasury company Strive gained about 88%, Bitcoin miner Canaan rose roughly 55%, and USDC issuer Circle added close to 40%.

North Korea-linked Lazarus Group has transferred 244.148 Bitcoin worth about $19.42 million, bringing fresh attention to wallets associated with one of the crypto industry’s most active hacking operations.

Lazarus Group moves 244 BTC between wallets

Lookonchain reported the transfer in an Aug. 28 X post, saying wallets attributed to Lazarus Group had become active again and moved 244.148 BTC about an hour before its alert.

Bitcoin traded at roughly $79,500 when the analytics account published its estimate, placing the transaction’s value at $19.42 million. Lookonchain did not identify the receiving address in the text of the post or say whether the Bitcoin moved to an exchange, mixer, or another wallet controlled by the group.

Without a disclosed destination, the transaction alone does not show that Lazarus sold or attempted to cash out the Bitcoin. Public blockchain records confirm when funds move between addresses, but connecting those addresses to an organization usually depends on labels and analysis supplied by investigators or blockchain intelligence firms.

The Aug. 28 transaction followed another large Bitcoin movement attributed to the group earlier in the month. On Aug. 12, Lookonchain said Lazarus transferred 262.2 BTC, then valued at approximately $16.64 million, from an identified wallet to a newly created address.

At the time, the analytics account described the transaction as a wallet-to-wallet transfer rather than a sale. Taken at their reported dollar values, the two August movements involved more than $36 million in Bitcoin, though no source has confirmed that the transactions came from the same balance or served the same purpose.

Past wallet activity shows why the destination matters. In March 2025, five unknown addresses received a combined 44.07 BTC worth about $3.76 million from wallets attributed to Lazarus, according to earlier on-chain reporting. The transactions reduced the tracked wallet’s holdings to 13,441 BTC at the time.

Bybit theft left Bitcoin across thousands of addresses

As crypto.news previously reported, Bybit sued North Korea and Lazarus Group in a Washington, D.C., federal court on Aug. 7, seeking to recover assets tied to the exchange’s $1.5 billion theft.

The lawsuit also named North Korea’s Reconnaissance General Bureau, or RGB, which the U.S. Treasury identifies as the country’s main intelligence agency. A federal judge issued a preliminary injunction that blocked unidentified defendants from transferring, selling, or disposing of certain assets connected to the case.

Bybit filed the civil action separately from ongoing U.S. criminal investigations. A preliminary injunction preserves the identified property while litigation continues and does not amount to a final decision on ownership or liability.

The FBI attributed the February 2025 Bybit attack to North Korean actors operating under the TraderTraitor name. According to the agency, the attackers converted part of the stolen holdings into Bitcoin and other assets before spreading them across thousands of addresses on several blockchains.

In its public alert, the FBI said it expected the assets to be moved again and eventually exchanged for government-issued currency. The bureau asked exchanges, bridges, decentralized finance services, blockchain analytics companies, and node operators to block transactions involving the addresses it identified.

By April 2025, Bybit CEO Ben Zhou said 27.6% of the stolen funds could no longer be tracked, according to an August report on North Korea’s attack methods. The same report said the distribution of assets across many Bitcoin wallets had made blockchain tracing more difficult.

Lookonchain has not connected the latest 244.148 BTC transfer directly to the Bybit theft. No government agency or blockchain intelligence company cited in the available reporting has publicly identified the source of the coins involved in the Aug. 28 movement.

Lazarus-linked attacks continued into 2026

Chainalysis estimated that North Korean hackers stole at least $2.02 billion in cryptocurrency during 2025, an increase of 51% from the previous year. The firm placed the country’s cumulative crypto theft at no less than $6.75 billion by the end of that period.

According to its December 2025 report, North Korean operations accounted for 76% of the value lost through attacks on crypto services during the year. Chainalysis said the attackers carried out fewer confirmed incidents but extracted larger amounts from successful breaches.

The firm also found that North Korean operators had increasingly targeted companies through impersonation and employee access. Some actors posed as job applicants to enter crypto businesses, while others pretended to recruit for known Web3 and artificial intelligence companies, according to Chainalysis.

Activity attributed to Lazarus continued in April 2026 when attackers drained approximately 116,500 rsETH, worth about $292 million, from KelpDAO’s LayerZero-based bridge. LayerZero attributed the attack with preliminary confidence to Lazarus Group’s TraderTraitor unit.

Chainalysis later said the attackers compromised infrastructure that supplied blockchain information to LayerZero’s verification system. By feeding false data to the system, they caused an Ethereum contract to release assets even though no matching token burn had occurred on the source network.

Rapid intervention blocked a second attempted theft worth about $95 million, according to Chainalysis. The Arbitrum Security Council also froze more than 30,000 ETH that investigators connected to the attacker’s downstream transactions.

By June, the KelpDAO attacker had moved approximately $220 million in unfrozen assets through privacy services, according to subsequent tracking data. The routes included THORChain, Wasabi, Tornado Cash, and Umbra, while around $1.7 million remained in the original wallets.

U.S. sanctions restrict dealings with Lazarus Group

The U.S. Treasury’s Office of Foreign Assets Control sanctioned Lazarus Group in September 2019 under an executive order targeting the North Korean government. OFAC identified Lazarus, Bluenoroff, and Andariel as state-controlled hacking groups connected to the RGB.

Under the designation, property belonging to Lazarus that enters the United States or comes under the possession or control of a U.S. person must be blocked and reported to OFAC. Treasury regulations also generally prohibit Americans from conducting transactions with sanctioned entities unless the agency authorizes them.

Treasury said Lazarus had targeted governments, financial institutions, media companies, manufacturers, infrastructure operators and cryptocurrency businesses through cyber theft, espionage and malware attacks. The department linked the group to the 2014 Sony Pictures breach and the WannaCry ransomware attack that affected computers across at least 150 countries.

U.S. authorities have also acted against services used to process funds tied to the group. In 2022, the Treasury sanctioned the virtual currency mixer Blender.io after saying it had handled more than $20.5 million from the roughly $620 million Ronin Network theft. The FBI later attributed the Ronin attack to Lazarus Group and APT38.

In August 2023, the FBI separately warned crypto companies about movements involving Bitcoin stolen by North Korean TraderTraitor actors. The agency said the group could attempt to cash out more than $40 million in Bitcoin and published six wallet addresses for private companies to examine.

Solana validators have approved a change to the network’s token supply schedule that accelerates how quickly inflation is reduced. In finalized governance results, the “Double Disinflation” proposal (SGP-0002) won 67% support, with 25.16% voting against and 7.84% abstaining, based on the participation of 60.7% of eligible stake.

The decision increases Solana’s annual disinflation rate from 15% to 30% while keeping the network’s long-term inflation target at 1.5% unchanged. That adjustment is expected to shorten the time to reach “terminal inflation” from about 5.7 years to roughly 2.8 years, according to Solana Compass reporting.

Key takeaways

• SGP-0002 passes: 67% of voting stake supported doubling Solana’s disinflation rate to 30%.
• Participation matters: 60.7% of eligible stake voted, setting the approval turnout for the first binding governance cycle.
• Terminal inflation arrives sooner: Solana Compass estimates ~2.8 years versus ~5.7 years under the prior schedule.
• Lower projected issuance: The change implies about 18.9 million fewer SOL to be issued over the next six years.
• Trade-offs for staking: Faster supply reduction may also reduce staking rewards for validators and delegators compared with the earlier plan.

What validators approved and what it changes

The approved proposal, identified as SGP-0002 (“Double Disinflation”), modifies how Solana reduces inflation over time. Per the finalized vote results published on Solana’s governance portal, the annual disinflation rate is set to rise from 15% to 30%, with Solana’s long-term inflation target remaining at 1.5%.

Practically, that means the network expects to reach its terminal inflation rate considerably faster. Solana Compass reported that the new schedule would bring the 1.5% target in about 2.8 years rather than the previously estimated ~5.7 years.

Impact on issuance, dilution, and staking economics

Supply changes tend to reshape incentives across the ecosystem, and SGP-0002 is no exception. Along with the timing shift, the proposal is expected to reduce future SOL issuance. The article’s figures cite an estimate of 18.9 million fewer SOL issued over the next six years, which would lower dilution pressure for existing holders.

At the same time, faster disinflation can also change the staking payoff profile. The updated approach is expected to reduce staking rewards for validators and delegators relative to what the slower schedule would have produced—an important consideration for participants who rely on rewards as part of their broader returns.

First binding governance cycle: Constitution passes, other fee proposal rejected

SGP-0002 was voted on as part of Solana’s first binding governance process. Alongside the supply change, the process also approved a proposed Solana Constitution, while rejecting a separate proposal related to resource and inclusion fees.

This broader package matters because it shows how Solana’s governance framework is being tested not only on monetary policy, but also on the rules that shape how future decisions are made and how the network structures certain operational costs.

Major voters were split—Kraken’s position shifted during the vote

Finalized governance data show that even large participants did not uniformly align behind the supply change. Figment—reported as the largest voter shown in the finalized dataset with 17.1 million SOL staked—voted entirely against SGP-0002, while other major stakeholders such as Helius and Jupiter overwhelmingly supported the measure.

Another notable development was Kraken’s changing stance. Solana Compass reported that Kraken initially voted against SGP-0002 at 12:33 UTC, which temporarily pushed support below the required threshold. By the end of voting, more than 90% of Kraken’s roughly 8.9 million SOL voting stake backed the proposal.

For investors and delegators, these splits highlight a key dynamic: while the final outcome was clear, major market participants evaluated the supply schedule trade-offs differently during the process.

Governance decision arrives alongside ETF momentum

Solana’s governance vote also landed as US-listed Solana investment products continue to pull in capital. According to an X post by Bloomberg ETF analyst Eric Balchunas, Bitwise’s Solana ETF recently surpassed $1 billion in assets, becoming the first Solana ETF to reach that milestone.

The post also claimed that US Solana ETFs have accumulated roughly $1.7 billion in cumulative net inflows, with little sustained outflow since launch, even as SOL’s performance earlier in the year lagged relative to broader expectations.

While ETF flows are not directly tied to validator voting, both developments reflect the same underlying question for Solana: how governance outcomes around monetary policy can influence long-term holder incentives at the same time that traditional investment access expands.

Next, market participants will likely watch how the faster path to 1.5% terminal inflation affects staking yields and validator incentives over time, and whether future governance proposals continue to settle contentious economic questions with similar turnout and stakeholder alignment.