Dollar-linked stablecoins already account for roughly 90% of crypto transaction volume in Brazil, most of it used for payments and settlement, according to tax authority data.

Brazil processes between $6 billion and $8 billion in crypto each month, much of it using dollar-denominated stablecoins instead of the country’s own currency.

However, even as dollar stablecoins have proliferated, Brazil’s central bank has moved to limit their role in regulated cross-border payments. Resolution 561, effective October 1, is set to bar payment firms from settling cross-border payments in stablecoins or other crypto, closing a back-end channel that had routed reais through dollar tokens. The central bank has cast stablecoins as a threat to monetary sovereignty, tax enforcement and anti-money laundering controls.

Pix now faces pressure from both sides after Washington named it a trade barrier, while Brazilian regulators shield it from growing competition from dollar-backed stablecoins.

Pix, however, may not be competing with stablecoins.

“In practice, they are complementary,” Rodrigo Caggiano, founder of Brazilian real-world asset monitoring platform RWA Monitor, told CoinDesk. “Pix has addressed domestic instant payments well, while stablecoins expand what is possible by operating on blockchain networks.”

U.S. pressure is likely to accelerate Brazil’s regulatory debate on stablecoins and digital financial infrastructure, Caggiano said, as the central bank builds its own tokenized-settlement system, Drex, on similar programmable rails.

Around 54% of liquidity in positions below $1,000 was out of range, compared with 26% for positions above $1 million. Yet positions worth more than $1 million accounted for 47% of all idle capital, or roughly $260 million.

While contract-managed positions stayed within a more consistent range, individual wallets accounted for between 82% and 94% of the attributed idle capital on Uniswap v3, depending on the chain. That suggests liquidity deposited directly by users and requiring manual adjustments is more likely to go unattended and fall out of range.

Dune estimated that these out-of-range providers, that are sitting idle, could be missing roughly $150 million in fees each year, based on a blended in-range fee APR of about 35%.

Liquidity providers deposit token pairs that decentralized exchanges use to complete swaps. They earn a share of the fees paid for trades using that liquidity pool while their positions remain in the range they set.

However, the research said that the figure is not guaranteed recoverable income. Keeping positions active can add transaction costs, execution risk and exposure to unfavorable price movements.

1inch commissioned the research ahead of the planned launch of Aqua, a new liquidity protocol. Dune said it developed the methodology and reached its conclusions independently.

“This week we have seen some large blocks in BTC topside call spreads,” Jean-David Péquignot, chief commercial officer at Deribit, told CoinDesk.

Options flow of this size and repetition often reflects institutional positioning rather than retail activity, given the capital required and the precision of the strike selection.

The timing is notable for two reasons. First, it suggests confidence in bitcoin’s recent bounce to $64,000 from under $58,000 earlier this month. More importantly, the trade targets the July 31 settlement, two days after the Federal Reserve’s July 29 interest rate decision. The call spread flow suggests that at least some large traders expect the meeting to serve as a catalyst for a move toward $72,000.

Fed funds futures currently point to a hold at the July meeting, with most trackers putting the probability of the central bank keeping its benchmark rate unchanged at 3.5%-3.75% in the 75%-80% range. The remaining odds are split between a rate hike and, to a lesser extent, a cut.

Rate-hike fears have ebbed following June inflation data, which showed a sharp deceleration in price pressures at both the consumer and producer levels. Much of the relief traces to a sharp pullback in oil prices during the month, tied to a ceasefire between the U.S. and Iran; core inflation, which strips out food and energy, was flat.

On December 1–2, 2026, in Dubai, alongside Blockchain Life 2026 — one of the world’s largest events for Web3, crypto, mining, and AI — the all-new AI Future Forum takes the stage.

Expect visionary founders, global investors, breakthrough AI projects, robotics, and the technologies that will shape the next decade of the digital economy.

With 15,000+ attendees from 130+ countries and 200+ industry-leading speakers, the AI Future Forum is set to become the world’s premier destination where AI, Web3, and crypto leaders come together to shape what’s next.

What awaits participants?

🔹 A full week of live networking with key players from around the world: 2 days of the forum, hundreds of side events, exclusive meetings, and the Formula 1 Grand Prix Final.

🔹 200+ top speakers: leading AI experts, founders of technology companies, investors, representatives of top AI startups, and leaders of the digital industry. The focus will be on the practical application of AI, its integration with crypto and business, and the technologies shaping the new digital economy.

🔹 A large-scale expo zone: 200+ leading companies in robotics, AI development, Web3 projects, and the most progressive startups.

🔹 The legendary AfterParty at one of Dubai’s top clubs with a globally known headline artist.

🔹 Startup Pitch – an opportunity to present your project to the international community and attract attention from investors and funds.

🎟️ One ticket. Two world-class events.

Exclusive limited offer! AI Future Forum ticket includes full access to Blockchain Life 2026.

🔥 Get 10% off with promo code WEB3DIGITAL before the prices go up: 

https://ai-future.com/ 

On Wednesday, DTCC completed its first live production trades involving tokenized securities, marking a major step toward bringing blockchain technology into traditional financial markets.

Broadridge’s findings suggest those efforts are influencing the broader industry. Sixty-eight percent of respondents said tokenization will at least partially reshape financial markets within the next three to five years, while nearly one-third plan to increase investment in tokenization projects by 26% to 50% or more over the next two years.

The survey also found firms are not preparing for an all-onchain future. Instead, 92% expect digital and traditional assets to coexist for the foreseeable future, and 69% plan to integrate tokenization into existing infrastructure rather than build separate blockchain-native systems.

That mirrors the approach taken by many large financial institutions, which have generally focused on connecting blockchain networks to existing trading, custody and settlement systems instead of replacing them.

Adoption remains uneven across the industry. Forty-four percent of capital markets firms said they already have tokenization initiatives in production or operating at scale, compared with 20% of asset managers and 9% of wealth managers.

The survey also pointed to where firms expect tokenization to gain traction first. About 80% of respondents believe tokenized mutual funds and money market funds will play a meaningful role within five years, reflecting the rapid growth of tokenized Treasury products. By comparison, only about half expect tokenized equities to achieve similar adoption over that period.

Cybersecurity researchers are flagging a fresh wave of malware tactics aimed at people who hold, build, and advise on crypto-related software. Kaspersky, for instance, says it has discovered a new malware framework—dubbed OkoBot—that targets cryptocurrency investors by combining social engineering with data theft capabilities.

At the same time, SlowMist warns of a separate intrusion campaign that targets Web3 developers through seemingly legitimate recruitment messaging on LinkedIn, pushing victims to run poisoned code hosted on GitHub. Together, the incidents underscore how attackers are increasingly using everyday work routines—interviews, code trials, and app installs—as delivery mechanisms for malware.

Key takeaways

• OkoBot is designed to steal crypto-related data by harvesting wallet files, browser information, credentials, and injected browser or extension activity.
• Kaspersky says it has observed multiple OkoBot-linked attacks since January 2026, and that the framework evolved from an earlier campaign called TookPS.
• OkoBot’s infrastructure reportedly routes all payload delivery through an SSH tunnel, enabling remote data transport to attacker-controlled systems.
• SlowMist reports LinkedIn-based “recruiter” scams that deliver malicious GitHub repositories disguised as technical interview tasks for Web3 developers.
• The recruitment workflow mirrors legitimate developer interviews closely enough to lower suspicion, increasing the chance victims will run the malicious code.

OkoBot targets crypto holders through wallet and browser theft

In a report released this week, Kaspersky described OkoBot as a malware framework that kickstarts an infection chain using social engineering and “malicious app” delivery tactics. According to Kaspersky, the initial entry includes tricks such as ClickFix, which aims to persuade users to execute harmful commands, as well as trojanized GitHub applications that can introduce a backdoor to a compromised device.

Once a system is under attacker control, Kaspersky says OkoBot is capable of collecting sensitive information that is directly relevant to crypto ownership. The company reports that the malware can:

• Harvest cryptocurrency wallet files.
• Extract browser data and user credentials.
• Inject malicious extensions.
• Capture wallet application windows, potentially enabling theft through on-screen or session-related data.

Kaspersky also stated that it identified multiple attacks using this malware family since January 2026. For investors, the practical concern is not only that wallets could be accessed, but also that browser activity and stored authentication data can be used to move faster toward account takeovers or transfer operations.

How the infrastructure works: payload orchestration via SSH

A notable detail in Kaspersky’s analysis is that OkoBot allegedly differs from prior campaigns by how it manages its malicious payloads. Kaspersky said the framework orchestrates all 20 malicious payloads via an SSH tunnel, which supports remote transport of data from compromised computers to systems controlled by attackers.

That matters because it points to an operational model where the attacker retains strong control over follow-on stages after initial compromise. Instead of relying solely on static behavior, a tunneled architecture can help attackers adapt to victims and collect information more reliably, depending on what the malware finds on each host.

Kaspersky also described OkoBot as an evolution of TookPS, a malware campaign first identified in 2025 that distributed a Trojan downloader through fake software websites. By evolving from an earlier delivery approach and adding more coordinated payload handling, the OkoBot framework appears positioned to increase both infection success and post-compromise effectiveness.

LinkedIn recruitment scams push Web3 devs into running poisoned repositories

Separate research from SlowMist focuses on a different target set: Web3 developers. In a report published on Saturday, the firm said attackers are reaching developers through LinkedIn messages that impersonate Web3 recruiters.

SlowMist’s description of the workflow suggests attackers are deliberately choosing a high-trust, familiar entry point. After initial contact, victims are sent what appear to be fake GitHub repositories, framed as a “minimum viable product” that the developer should install and try before an interview.

The technique is effective, SlowMist argues, because it resembles a real technical interview process. The report notes that a legitimate developer workflow often involves pulling code, installing dependencies, and launching a project—steps victims naturally perform while preparing for an interview. In that environment, malicious code can be less obvious, especially if the victim does not expect a security risk from a repository “connected” to a recruiting conversation.

What attackers aim to steal from developer systems

SlowMist said the end goal is to deliver a complete remote access trojan to the victim’s device. Once established, the malware could enable attackers to steal sensitive materials associated with development and operations, including project keys, cloud credentials, or data tied to wallet extensions.

SlowMist also emphasized that the recruitment approach is part of a broader pattern: attackers are increasingly leveraging scenarios such as recruitment, code reviews, and project collaborations to trick developers into running malicious repositories. In other words, this is not only about deception, but also about timing—waiting for the moment a developer is likely to execute code as part of normal work.

Importantly, this LinkedIn-focused warning came after SlowMist reported another campaign targeting macOS users. That earlier effort, as SlowMist described it, aimed to steal credentials and hijack Telegram sessions in order to coerce victims into submitting wallet recovery phrases through fake websites. While the TTPs differ between the campaigns, both point to the same underlying threat: attackers are methodically chaining social engineering and credential theft to ultimately compromise crypto access.

Going forward, both reports suggest readers should watch for more “legitimate-looking” pathways into compromise—especially where code execution is requested via recruiters, interview workflows, or third-party repositories. For investors and developers alike, the immediate question is not only whether malware is present, but whether attackers can leverage everyday trust and authenticated sessions to reach wallet-relevant secrets quickly.