Near Protocol’s native token has jumped sharply this week as the network expands privacy-focused trading and related infrastructure. Over the past seven days, Near’s token traded around $4.29—up about 78.2%—according to CoinGecko, with CoinGecko also showing total cryptocurrency market capitalization up roughly 6% over the same period.

The rally appears tied to new privacy features launched for perpetual futures trading on near.com, alongside a growing ecosystem around Near Intents, a platform that coordinates cross-chain swaps by matching users with market makers.

Key takeaways

• CoinGecko data shows Near (NEAR) gained about 78% in seven days, outpacing a broader market that rose around 6%.
• Near says deposits and withdrawals for perpetual futures trading on near.com are now confidential by default, obscuring the connection between funding wallets and Hyperliquid trading accounts.
• Near.com’s confidential TVL surpassed $70 million, triggering the first snapshot under the NEAR@3.33 incentive program.
• According to the NEAR Intents Explorer, cumulative volume has reached about $29.3 billion, with $842 million recorded over the last seven days.

Confidential perpetual futures trading becomes the default

Near’s push into privacy accelerated this week after the protocol said on Thursday that deposits and withdrawals for perpetual futures trading through near.com are now confidential by default. In Near’s description, the feature is designed to hide the link between a trader’s funding wallet and a dedicated Hyperliquid trading account.

From an investor and user perspective, the practical effect is straightforward: traders who use near.com for perpetual futures can reduce exposure of wallet-to-account relationships that would otherwise be visible through on-chain flows or traceable account linkages. While the measure doesn’t necessarily prevent all forms of identification—market activity and other metadata can still reveal information—it directly targets a common privacy weakness in trading account structure.

The timing matters because the feature aligns with a broader industry narrative around privacy and confidentiality in finance. Near’s move effectively shifts attention from privacy as a niche value proposition toward privacy as a product feature for mainstream trading workflows.

Confidential TVL milestone and NEAR@3.33 incentives

On the same day, Near also reported that near.com’s confidential total value locked (TVL) crossed $70 million. The announcement said this milestone triggered the first snapshot under its NEAR@3.33 incentive program.

Near stated that the program set aside 333,333 milestone tokens for the first distribution. Under the program rules described in the release, the tokens unlock and convert to NEAR when the token’s three-day volume-weighted average price reaches at least $3.33.

This kind of condition can be significant for token-related expectations because it ties incentives to a price threshold rather than distributing immediately at the moment the TVL checkpoint is recorded. Traders and liquidity providers typically watch how these unlock mechanics may change selling pressure dynamics (for example, whether participants anticipate distributions once a price level is reached).

Near Intents keeps scaling volumes

Beyond trading privacy, Near’s ecosystem is also expanding through NEAR Intents, which enables users to request cross-chain swaps while market makers compete to execute them. On Monday, the NEAR Intents Explorer showed cumulative volume of roughly $29.3 billion.

The explorer also indicated $842 million in volume over the preceding seven days. For the prior 24 hours, privacy-focused Zcash wallet ZODL appeared as the third-largest referral source by volume, generating about $3.8 million across 458 transactions. The explorer also listed a large transaction involving roughly $613,000 worth of ZEC over the previous 24 hours.

While these figures reflect activity within the intent execution network rather than spot trading on a centralized exchange, they matter because higher intent volume can translate into stronger routing, execution competitiveness, and incentives for liquidity provision—factors that can make cross-chain execution more reliable for end users.

Why Zcash is showing up in the privacy narrative

Activity around ZEC in NEAR Intents has drawn commentary from researchers inside the ecosystem. Bitwise research analyst Camran Khosravi said Near and Zcash are “complements,” arguing that Near provides confidential cross-chain infrastructure and access to liquidity for ZEC holders.

Khosravi also cautioned about how TVL metrics can behave. He noted that NEAR Intents’ TVL can rise when the price of ZEC already held within the system increases, even if new deposits do not occur. That distinction is important for interpreting growth: TVL moving up doesn’t always mean user inflows are increasing at the same pace.

Near has continued extending its privacy focus beyond trading. In July, it introduced NEAR AI staking-based payments through near.ai, allowing users to stake NEAR to receive credits for confidential AI inference and agent hosting while keeping ownership of the underlying tokens.

Taken together, these announcements place privacy at the center of Near’s product strategy—spanning trading account confidentiality, cross-chain swap execution, and even confidential compute workflows.

Looking ahead, market participants are likely to watch two things closely: whether near.com’s confidential trading features and the NEAR@3.33 incentive mechanics translate into sustained liquidity growth, and how privacy-oriented assets like ZEC continue to contribute to NEAR Intents’ volume without relying solely on price-driven TVL increases.

After more than two years of lobbying for clearer rules in Washington, crypto policy took another hit this week. The U.S. Senate failed to advance the CLARITY Act on Tuesday, missing the 60 votes required to move the bill to the floor—an outcome that compresses an already tight legislative window ahead of the Nov. 3 midterm elections.

Strategists highlighted that the fallout may not be evenly distributed across the sector. In parallel, Wall Street research is making bold calls on layer-2 networks and staking yields, while industry executives are warning that artificial intelligence may be weakening crypto liquidity and increasing the security burden for smaller teams.

Key takeaways

• The Senate’s procedural failure to advance the CLARITY Act narrows the bill’s remaining path this year as election-season timing tightens.
• Saxo strategist Ruben Dalfovo argues Coinbase is more directly exposed than some peers because market-structure rules could affect registration, tradable assets, and platform participation.
• Standard Chartered expects Arbitrum to outperform other large crypto networks through 2030, attributing part of that view to evolving economics from major builders.
• Bitmine’s treasury strategy targets staking revenue from a large Ether position, projecting annualized income based on current staking rates.
• Phemex’s CEO says AI is becoming a “net negative” for crypto by pulling liquidity away and enabling attackers, raising security costs.

CLARITY Act stalls as Senate misses the procedural threshold

The CLARITY Act’s failure to clear the Senate procedural vote is a significant setback for the industry’s push for regulatory clarity. According to Cointelegraph’s report on the vote outcome, the bill did not reach the 60-vote threshold needed to bring it to the floor for debate.

Because the Senate calendar tightens ahead of the Nov. 3 midterm elections, the missed procedural step reduces the likelihood that the bill can be fully processed this year. For market participants, the immediate implication is that uncertainty around the timing and shape of potential federal rules may persist longer than many in crypto had hoped.

Why Coinbase could feel the setback more than others

Saxo Bank strategist Ruben Dalfovo argued in a note following the vote that Coinbase is among the most exposed names. As Cointelegraph reported in coverage of his view, Dalfovo said Coinbase’s trading business is directly tied to U.S. market-structure rules—meaning new requirements could influence registration obligations, the set of assets that can be traded, and who is permitted to participate on the platform.

Dalfovo’s comparison matters for investors because it distinguishes between forms of exposure. Cointelegraph noted that he viewed some other crypto-linked companies as less directly affected by market-structure rules, with their key sensitivities tied to different variables—for example, Circle’s exposure connected to USDC adoption and reserve-related economics, and Strategy’s emphasis on its Bitcoin holdings and related access to financing.

The market reaction described by Cointelegraph reflected this differentiation. Shares of Coinbase, Circle, and Strategy reportedly fell between 5% and 10% after the vote and remained lower the next day, indicating traders were repricing the near-term legislative probability and its potential effect on business models.

Standard Chartered doubles down on Arbitrum’s long-run upside

While U.S. regulatory timelines remain uncertain, analysts are looking to onchain infrastructure for a different kind of catalyst. Standard Chartered, in research highlighted by Cointelegraph, is projecting that Arbitrum could outperform Bitcoin and Ether through 2030.

The bank’s thesis, as summarized by Cointelegraph, centers on network economics. Geoff Kendrick, Standard Chartered’s global head of digital assets research, pointed to a revenue-sharing structure in which Arbitrum receives 10% of net protocol revenue from companies building on it. He also cited Robinhood Chain—launched in July—as a meaningful change to Arbitrum’s economics, with September revenue expected to reach $5 million, described as more than five times the prior level.

Standard Chartered’s base-case projection is ARB at $10 by 2030, which it frames as a roughly 70-fold increase from current levels around $0.14. Cointelegraph also noted that ARB had gained 86% over the prior month at the time of the report.

Investors should treat such projections as scenario-based rather than guarantees. Standard Chartered’s assumptions, according to Cointelegraph, depend on broader adoption—tokenized assets reaching $39 billion and forecasts of $4 trillion by 2028. The core uncertainty remains whether the pace of financial and institutional migration to tokenized onchain products can match these expectations, and whether Arbitrum’s revenue share meaningfully compounds as new builders launch and scale.

Bitmine’s Ether treasury turns staking into a recurring revenue bet

Another angle on the crypto business cycle is coming from balance-sheet strategy rather than regulation: Bitmine is positioning its treasury to earn recurring income through staking. Cointelegraph reported that the company projects $334 million in annualized staking revenue from its Ether holdings.

As described in the report, Bitmine said it added 27,180 ETH last week, bringing total holdings to 5.95 million ETH valued at $15.4 billion. The company claims that more than 5.06 million ETH is now staked, generating an estimated $334 million in annualized revenue at current rates.

Cointelegraph also contextualized the scale by noting that Bitmine’s staked amount represents roughly 4.9% of Ether’s circulating supply. The comparison to other treasury strategies is important: staking allows recurring income from crypto holdings, which can differ from treasury approaches focused on appreciation without an income stream.

Cointelegraph added that Grayscale Ethereum Staking ETF stakes 84.6% of its Ether, citing details on the fund’s webpage. The implication for readers is that staking-linked income models may increasingly be evaluated alongside pure exposure to price movements—particularly when volatility pushes investors to ask how returns are generated.

Phemex CEO warns AI is worsening crypto security and liquidity

The business side of crypto is also grappling with technology that cuts both ways. Federico Variola, CEO of Phemex, told Cointelegraph that AI has been a “net negative” for crypto—draining liquidity while empowering attackers to find and exploit weaknesses in protocols.

In Cointelegraph’s Chain Reaction discussion, Variola argued that AI has “empowered a lot of bad actors” and driven up cybersecurity costs, especially for smaller teams that may lack the resources to keep pace. He referenced an incident from July in which attackers drained roughly $116 million in Bitcoin from more than 5,200 addresses associated with a Coldcard hardware wallet flaw that has been widely believed to have been discovered through malicious AI use.

The CEO also highlighted a broader capacity gap: Cointelegraph reported that Coinkite CEO Rodolfo Novak warned AI-assisted code review can now outpace seasoned experts. Variola’s concern extends to user behavior as well—he suggested the scale of AI-enabled risk could make self-custody and DeFi less attractive to retail users, potentially pushing the ecosystem toward greater centralization.

Not all views are purely negative. Cointelegraph included a response from CertiK’s Natalie Newson, who suggested AI can also function as “one of the biggest defenses.” For readers, the practical takeaway is that AI’s impact is likely to be dual: it can accelerate both offensive tooling and defensive monitoring, raising the stakes for security engineering across exchanges, custodians, and protocols.

What to watch next is whether the CLARITY Act’s stalled momentum can be revived in the remaining Senate calendar, and—on the market side—whether onchain revenue narratives like Arbitrum’s can translate assumptions into measurable adoption and sustained network activity as policy uncertainty persists. Meanwhile, security teams should expect AI-driven threat modeling to become less optional and more foundational.

SHIB Knight argues that SHIB is not in its process of moving and is still early. The opinion is based on the analysis of the chart that displays prices close to long-term lower-ranges consolidation. However, the current structure of the chart does not show that a breakout from resistance occurred.

The extended timeframe shows a clear downtrend to $0.00000546. Before that happened, there was a sharp rise up to the level of $0.000045. Price had several attempts that resulted in failure at the levels of $0.000020 and $0.000030. It means that these levels were zones of active sales before.

The price began to fall slowly while being in the range of $0.000005-$0.000007. There are recent candles that are compressed at this lower level. It means that there is a transition from active selling to trading.

The current market chart displays the price at $0.000005416. The token rose by 0.4% over the past 24 hours shown on the chart. Trading activity was within the range of about $0.00000535 and $0.00000550.

Spot Flows Still Mixed Across Exchanges

$0.00000550 still looks like the nearest visible resistance point. Multiple attempts to reach this resistance point have not succeeded in sustaining a price advance there. In the meantime, the immediate downside reference for the range is $0.00000535–$0.00000540.

The spot-flow chart demonstrates many alternations of positive and negative flows. Both green and red bars have been seen all the way from November through September. No side showed any consistent behavior during the whole period.

There were several positive spikes in December and January. However, the price line kept deteriorating further despite these periods. This indicates that occasional inflows could not generate a consistent upward price formation.

The largest visible inflow was registered at the end of July. It was a green spike that exceeded $5 million and looked higher than the majority of other spikes. However, it had no effect on the subsequent price movement.

Resistance Defines The Technical Phase Ahead

Exchange volumes continue to be split between the large exchanges as well. There was trading of approximately $119.10K on Binance, whereas there was trading of about $84.04K on Upbit. Trading of about $44.08K and $34.64K was done on OKX and Bybit respectively.

The short-term technical analysis continues to see multiple attempts at recovering near $0.00000550. If the price manages to breach that level, it will change the immediate technical phase of the market and indicate that bulls have gained more power. Until then, price remains inside the defined consolidation phase.

The longer-term technical picture sees a possible rise towards $0.000010 and $0.000013. However, this is still speculative and price movement is needed to validate these moves.

There is also higher time frame resistance in the form of $0.000020 and $0.000030. In previous bullish waves, sellers emerged near both those levels. Any bullish wave will therefore have to navigate several resistance levels.

For the time being, SHIB continues to trade near its long-term base, with mixed flow in the spot market and resistance defining the current recovery phase. The reaction near $0.00000550 is an important technical level.

Aurora Intents has processed more than $19 million across 1,718 swaps for the zkSNARKS auction, accounting for over half of the assets converted and deposited into the ZEC-denominated sale.

Aurora Intents handled half of the auction volume

Aurora Labs CEO Declan Hannon told crypto.news that Aurora Intents processed just over $19 million of the $36.94 million deposited for the zkSNARKS auction, with the conversions completed through 1,718 swaps.

“It’s the value, the dollar value of assets converted into ZEC. Aurora Intents processed over 50% of the total volume swapped and deposited for the auction. Just over $19M out of $36.94M moved through us across 1718 swaps,” Hannon said.

The figure measures the value routed through Aurora’s cross-chain infrastructure, rather than the number of bids or completed NFT purchases. Some of the assets were attached to unsuccessful bids and later became eligible for refunds under the auction rules.

Auction results showed that participants submitted 16,971 bids for 8,000 available zkSNARKS assets. Total submitted volume reached 25,305 ZEC, worth approximately $36.94 million at the time, while the sale cleared at 1.5 ZEC per asset.

Under the sealed, uniform-price format, bidders placed offers without seeing the full order book. The 8,000 successful bidders paid the same clearing price, regardless of the maximum amount entered in their original bids.

Multiplying the clearing price by the 8,000 allocations gives 12,000 ZEC in completed sales. Approximately 13,309 ZEC, valued at about $19.43 million at the auction’s reported exchange rate, was allocated for refunds to unsuccessful bidders or for amounts submitted above the final price.

Stablecoins led cross-chain ZEC conversions

Stablecoins supplied much of the value that Aurora Intents converted into ZEC, according to Hannon. USDC alone accounted for 27% of the funds routed through the system and arrived from four networks, with Solana contributing the largest portion.

Native ETH ranked as the next-largest individual source asset, representing 21% of Aurora’s auction volume. Participants could also enter with BTC, SOL, BNB, and other supported assets rather than acquiring ZEC through a separate exchange transaction.

“Most people bidding on a ZEC-denominated auction don’t already hold ZEC and did not want to go buy some just to bid. Aurora Intents powered the cross-chain swaps,” Hannon said.

The source-asset mix placed stablecoins at the center of the conversion flow while also showing demand from users holding assets on other networks. Instead of bridging an asset manually, finding a ZEC market and making another transfer, each bidder could request a specified ZEC output through one transaction instruction.

Cross-chain access has also become part of NFT marketplace competition. In September, OpenSea added Solana NFTs to its OS2 platform, allowing users to trade supported collections within a marketplace that already covers more than 25 networks.

Stablecoin issuers have taken a similar multichain route. In June, Ripple expanded RLUSD access to more than 40 networks through Wormhole, including Base, Optimism, Ink, Unichain and the XRP Ledger EVM sidechain.

NEAR Intents solvers locked the quoted ZEC output

For the zkSNARKS auction, a bidder signed an intent stating how much ZEC the transaction should produce and the maximum source-asset amount the bidder was willing to spend. NEAR Intents solvers then competed to fill the request at the quoted rate, Hannon said.

“The user signs one intent—bid this much in ZEC up to the amount specified. Now the solver network, NEAR Intents, comes into play. Solvers compete to fill it at that quoted rate.”

According to Hannon, the rate was fixed before the user signed the transaction, while the quote included a minimum ZEC output. A market move beyond the approved range caused the transaction to fail instead of filling at a worse price.

“If the market moves past it, the trade simply doesn’t execute. If anything fails, funds return automatically to a refund address supplied up front,” he added.

Although the setup removed post-signature slippage, it did not remove every dependency from the transaction path. Hannon said users relied on the NEAR Intents settlement contract, market makers issuing quotes and bridges holding the underlying source assets.

Settlement took place through the NEAR Intents 1Click Swap API, which Hannon said has processed more than $30 billion. He added that 1Click did not take custody of user funds during the process, while Aurora neither acted as a counterparty nor handled the assets directly.

Non-custodial execution does not eliminate smart-contract, bridge, or liquidity-provider exposure. In Hannon’s description, each component still performed a specific role before the converted ZEC reached the auction.

For U.S. users, cross-chain execution does not settle whether an NFT sale or marketplace activity falls under federal securities rules. The U.S. Securities and Exchange Commission closed its OpenSea investigation in February 2025 without filing charges, but the decision did not create a blanket exemption for NFT issuers or trading platforms. The legal treatment of an asset can still depend on its sale terms, promised benefits, and promotion.

Zcash privacy started after source-chain activity

While the auction used Zcash for private settlement, Hannon drew a line between the shielded ZEC transaction and the activity that occurred before assets reached the network.

“Zcash’s shielded pool does what it says on the destination side; the bid itself isn’t visible,” Hannon said.

“What I won’t do is tell you the whole path is invisible, because the leg before it lands on a public chain, same as it would if you sent that asset anywhere else.”

A user entering with ETH, SOL, BNB, or a stablecoin first initiated a transaction on the asset’s source network. Public blockchains record wallet addresses, transferred amounts, and transaction times, leaving the initial leg visible even when the resulting ZEC bid enters a shielded pool.

On the Zcash side, shielded transfers use zero-knowledge proofs to verify that a transaction is valid without publishing the sender, recipient or transferred amount. The protection applies to the shielded ZEC transaction, not automatically to every preceding action on another blockchain.

The auction offered 8,000 assets from a 10,000-item zkSNARKS collection. Project information assigned another 1,000 assets to early Snarklist participants and reserved 1,000 for grants, contributors, artists, and the team.

Following the sale, on-chain investigator ZachXBT alleged that the project lacked practical utility and compared its structure with previous NFT “money grabs,” according to ChainCatcher. The report said he questioned the roughly $17 million retained after refunds, as well as the collection’s team allocation and royalty structure.

0G has launched its Ascend liquid staking product and introduced a five-step system that will let eligible users convert staked 0G tokens into credits for AI computing services.

In a Sep. 21 press release shared with crypto.news, 0G said that Ascend will serve as the first access point for Compute Finance, or ComFi, a system designed to link digital assets with usable AI computing resources.

The product gives users a0G when they stake the network’s native 0G token. Holders can keep using a0G across compatible decentralized finance applications while the underlying 0G remains staked, according to the announcement.

A second product, Infinite AI, is scheduled to launch on Sep. 29. Its iAI asset will connect the liquid staking position to compute credits accepted by selected services in the 0G ecosystem.

How 0G’s Compute Finance system works

Under the initial structure, a user stakes 0G through Ascend and receives a0G. The user can then deposit a0G to mint iAI before staking eligible iAI to earn compute credits.

The full process consists of five steps: stake 0G, receive a0G, mint iAI, stake iAI, and collect compute credits. Users can spend the credits on supported AI products rather than receive them as cash or a standard token reward.

At launch, a0G will be the only asset accepted for minting iAI, making Ascend the required starting point for the system. Minting iAI locks the underlying collateral, while burning the asset provides a route for unlocking it, subject to the final product terms.

0G described ComFi as a financial layer for AI compute, which is already produced, rented, and priced across global markets. The proposed system treats access to computing resources as the output generated by a digital asset position.

Instead of earning only staking tokens or interest, eligible users receive credits tied to services that require computing power. Their use will remain limited to approved products within the 0G ecosystem.

Michael Heinrich, co-founder and CEO of 0G, compared the model with earlier systems that gave asset holders or network participants a new form of value.

“Equity introduced dividends, proof of work introduced new ways to reward participation, and DeFi expanded what people could do with digital assets,” Heinrich said.

“Compute Finance explores a different model by connecting digital assets with access to AI compute.”

He added that Ascend and Infinite AI are the company’s first implementations of the concept.

iAI credits will have restricted uses

Under the initial parameters disclosed by 0G, eligible staked iAI is designed to generate compute credits carrying a stated usage value of more than $1 per day.

Actual credit amounts, eligibility rules, availability and permitted uses will depend on the terms and policies applied to the products. The company said the terms may change and plans to publish further details covering minting requirements and staking eligibility.

Compute credits will not represent cash, cash equivalents, or guaranteed financial returns. Users will only be able to apply them to eligible AI services, separating their stated usage value from a redeemable monetary payment.

0G identified Private Computer as one supported service. The platform is designed to provide private and verifiable AI access and is expected to offer more than 130 models at launch.

The credits will also be usable within the 0G App, a development platform where users can interact with AI models and build or launch applications. The company did not disclose how many credits each task will require or whether prices will vary between models and services.

Infinite AI is also expected to become available through Comfy.fun, 0G’s launchpad for agents and tokens. Access will depend on the terms applied when the product goes live.

The structure combines several functions normally offered separately: liquid staking through a0G, collateral-backed minting through iAI, and service access through compute credits. Each stage depends on the previous one, while the underlying collateral remains subject to the minting and burning process described by 0G.

Ascend keeps staked 0G available for DeFi

Ascend provides the liquidity component of the system by issuing a0G against deposited 0G. Liquid staking tokens generally let holders use a representation of their staked assets in DeFi instead of waiting for the original tokens to become available.

For Ascend users, a0G can remain active in compatible DeFi applications and also serve as the input for minting iAI. The same position can therefore support network staking and entry into the compute-credit system, according to the company’s design.

Use across DeFi can introduce risks that differ from standard native staking, depending on the protocols, smart contracts, and liquidity pools selected by a holder. 0G’s announcement focused on the product flow and did not state which external DeFi platforms will initially support a0G.

The company also framed ComFi as an open category for AI projects rather than a term reserved for 0G products. Its full thesis will describe a market in which participants can own claims on compute and earn, spend or trade access to computing resources.

Related work linking blockchain infrastructure with AI has included systems for recording machine decisions and permissions. In September, crypto.news covered blockchain verification for AI-driven financial tools, where RoboTech Frontier Hub founder Denis Saklakov said blockchains can record system states, decision conditions, and execution histories without running the AI itself onchain.

0G’s model uses blockchain infrastructure for a different task: connecting staking positions to access rights for AI products. The company operates an AI-focused EVM-compatible layer-1 network alongside encrypted storage, private computing tools and model-verification systems.

US access will depend on final product terms

For users in the United States, access to Ascend, iAI and related staking functions will depend on the eligibility rules released with the final documentation. The announcement states that credit availability, supported uses, and minting conditions will be governed by applicable terms and policies.

0G has not assigned the compute credits a cash value that users can redeem, and it describes them as units intended only for eligible AI services. The company also states that the credits do not provide guaranteed financial returns.

The treatment of a0G and iAI for US regulatory or tax purposes will depend on their final functions, distribution terms, and availability. The announcement does not name a US regulator, exemption or registration connected with either product.

Infinite AI remains scheduled for Sep. 29, when 0G plans to release the iAI asset and activate the next part of the staking-to-compute process. Additional documentation is expected to specify minting requirements, eligible iAI positions, supported services, and the rules for burning iAI to release locked collateral.

Immunefi CEO Mitchell Amador has said the Liquid Network attackers lost any claim to white-hat status by retaining 598.5 BTC after returning 3,400 BTC from the roughly 4,000 BTC exploit.

Immunefi founder and CEO Mitchell Amador told crypto.news that moving user assets without permission cannot be treated as a rescue when the researcher later keeps part of the funds or sets payment terms.

“Coordinated disclosure ends the moment you set the terms yourself,” Amador said. “The money was never yours to save, so moving it is not a rescue.”

His comments address the dispute left by the Liquid Network incident, in which unidentified actors withdrew roughly 4,000 BTC, valued at about $320 million at the time, before describing themselves as whitehats. They returned 3,400 BTC after Blockstream patched the affected bridge nodes but retained 598.5 BTC.

Blockstream has rejected the group’s demand for a 10% bounty and has said it will not pay for the return of the remaining Bitcoin. The company also rejected the attackers’ claim that the operation amounted to responsible disclosure.

Liquid Network attackers could not set their own terms

Amador said a security researcher must use private disclosure channels, preferably through a defined bug bounty program, instead of taking assets and negotiating a reward afterward.

“Keep a dollar of user funds, and it is theft, whatever the intent was at the outset. The path for a researcher is private disclosure, ideally within a well-defined program.”

The distinction rests on authorization rather than the researcher’s stated motive. Under Amador’s view, finding a real vulnerability does not give someone the right to move user assets, hold them as collateral, or decide what compensation is owed.

Blockstream took a similar position in its Sept. 11 response. As previously reported by crypto.news, the company said taking assets without permission and refusing to return them constituted theft rather than whitehat work.

The company said its earlier discussions with the actors were intended to recover user funds and protect the Bitcoin community. According to Blockstream, engaging in those talks did not mean it had accepted either the withdrawal or the later bounty demand.

A technical review of the exploit found that a cache-key collision in the confidential transaction verification logic allowed the actors to create unbacked L-BTC. They then used SideSwap’s peg-out service to obtain real Bitcoin from the federation reserve.

Federation keys were not compromised, according to Blockstream. The incident instead involved verification logic in the Elements codebase, while the federation nodes were running a release that did not contain the relevant fix.

Rescue terms should exist before an exploit

Rather than negotiating under pressure after funds have moved, Amador said serious protocols should decide their rescue conditions before an emergency occurs.

“Yes, rescue terms must exist ahead of an exploit,” he said. “All serious protocols should set these in advance.”

Predetermined rules can define which systems researchers may test, how they must disclose a vulnerability, and what actions they can take during an active incident. They can also state the maximum bounty, payment conditions, and legal protections available to researchers who remain within the approved scope.

Immunefi developed the Whitehat Safe Harbor framework to establish such conditions before a protocol faces an attack. Amador, who helped shape the framework and has participated in live exploit response teams, compared emergency action with saving a house from a fire: the need for help does not authorize every possible rescue method.

Advance agreements also give protocol teams a basis for distinguishing approved intervention from coercion. Without prior terms, an actor who controls user funds can demand payment while the project faces losses, service disruptions, and pressure from token holders.

Liquid’s actors initially communicated through messages placed in Bitcoin transactions and told Blockstream to patch the flaw before they returned the funds. After Blockstream confirmed that affected bridge nodes had been patched, the group sent 3,400 BTC back to the federation wallet.

No publicly disclosed agreement had allowed the group to retain the remaining 598.5 BTC. The amount also exceeds 10% of the approximately 4,000 BTC involved, although the reported demand centered on a 10% reward.

The 10% crypto bounty convention still has a role

While rejecting the Liquid actors’ attempt to impose their own terms, Amador defended the crypto industry’s informal practice of offering up to 10% of funds at risk as a whitehat bounty.

Without a common reference point, he said, each settlement would need to be negotiated from the beginning, giving an attacker more leverage during an active incident. A defined percentage gives researchers a legal payment route while allowing a protocol to recover most of the exposed assets.

“Ten percent of a $100M exploit is $10M earned legally, with nobody hunting you afterwards,” Amador said. “The alternative for them is moving nine figures onchain while every forensics firm watches.”

The 10% figure has appeared in several recovery offers, but projects usually state the terms themselves. In August, BTCPay Server supporters backed a reward equal to 10% of recovered funds after attackers obtained LND admin macaroon credentials. The proposed payout was capped at 3 BTC if all stolen assets were returned.

Cetus Protocol followed a different formula after its May 2025 exploit. A flaw in its automated market maker logic caused losses of more than $223 million, while the Sui Foundation coordinated with validators to freeze about $163 million. Cetus later announced a $5 million reward for information leading to the identification of the attacker, according to its post-exploit review.

Amador said the reward should generally reach up to 10% of funds at risk while remaining subject to a cap the protocol can afford. Setting the amount too low could make theft more attractive than disclosure, he said, while an excessive payout could leave the rescued project unable to continue operating.

“Price it too high, and paying out can kill the protocol you just saved, which helps nobody,” he said.

Projects may still pay above their stated cap when a report warrants a larger reward, Amador added. Under his proposed model, the protocol retains control over that decision instead of allowing a researcher to establish the fee after taking custody of user assets.

U.S. prosecutions show the risk of unauthorized exploits

For U.S.-based researchers, returning funds or offering to negotiate does not necessarily prevent criminal charges when the original access was unauthorized.

In December 2023, former security engineer Shakeeb Ahmed pleaded guilty to computer fraud after exploiting two decentralized exchanges and obtaining more than $12 million. According to the U.S. Justice Department, Ahmed negotiated with one platform and proposed returning the stolen funds except for $1.5 million if the exchange agreed not to contact law enforcement.

Federal prosecutors said Ahmed later agreed to forfeit more than $12.3 million, including about $5.6 million in fraudulently obtained cryptocurrency. In April 2024, a federal judge sentenced him to three years in prison and ordered the forfeiture of the stolen assets.

AfD ran on anti-immigration, opposition to Ukraine aid