El Salvador used no public resources to accumulate Bitcoin after the first review of its International Monetary Fund (IMF) financing program in June 2025, according to the lender. 

In a Thursday statement, the IMF said documents supplied by Salvadoran authorities verified that the accumulation came from private donations. According to the lender, the increase in El Salvador’s holdings therefore did not reflect additional Bitcoin purchases financed with government resources. 

The IMF also said majority ownership and operational control of the Chivo wallet had been transferred to a private operator, while the government retained a minority stake and custodial responsibilities. It said no further accumulation beyond documented donations is expected. 

The explanation addresses how El Salvador’s holdings grew after the first review, after the country said in November 2025 that it had acquired 1,090 BTC worth $100 million, renewing questions about compliance with its $1.4 billion IMF program. 

Bitcoin additions repeatedly raised questions

In December 2024, El Salvador agreed to limit public-sector involvement in Bitcoin under the IMF package. The agreement made private-sector Bitcoin acceptance voluntary, required taxes to be paid in US dollars and called for government involvement in Chivo to be unwound. 

In March 2025, the IMF issued new documents barring “voluntary accumulation” of Bitcoin by the public sector. President Nayib Bukele responded that the purchases were “not stopping” and said El Salvador would keep adding at least one BTC daily.

Related: IMF says El Salvador in talks to sell state-run Chivo Bitcoin wallet

Since then, El Salvador’s Bitcoin Office has often posted that it has continued to accumulate Bitcoin. In July 2025, the IMF offered an initial explanation, saying no new Bitcoin had been purchased since the December agreement. It attributed increases to consolidation among government wallets. 

The November announcement reopened the issue. An IMF representative previously told Cointelegraph that the lender would not provide “running commentary” on announcements and would assess compliance in due course.

According to the National Bitcoin Office’s official reserve tracker, El Salvador currently holds about 7,764 Bitcoin. At BTC’s current price of $80,900, according to CoinGecko, the stockpile is worth about $628 million. The balance remains higher than before the IMF agreement, reflecting additions attributed by the IMF to private donations. 

Magazine: El Salvador’s Bitcoin experiment turns 5: ‘It was for us, not them’

Ripple CEO Brad Garlinghouse said on Sept. 3 that making the United States the global center of the cryptocurrency industry remains “within reach,” while urging policymakers to complete the country’s regulatory framework.

Garlinghouse made the statement after Commodity Futures Trading Commission Chair Michael Selig discussed an August White House gathering involving executives from cryptocurrency, finance and technology companies.

“Making America the crypto capital of the world is within reach — let’s finish the job,” Garlinghouse said.

The comment represents Garlinghouse’s policy position rather than confirmation that the United States has achieved the administration’s stated objective.

The United States and the United Kingdom have announced a new joint law-enforcement effort aimed at dismantling “scam centers” that fuel crypto-related and cyber-enabled investment fraud. The U.S. Department of Justice says the initiative is structured as a first-of-its-kind international cooperation agreement designed to disable organized scam operations that move victims’ funds across borders.

In a statement released Thursday, the DOJ said the U.S. Attorney’s Office for the District of Columbia, the Crown Prosecution Service for England and Wales, and the UK’s National Crime Agency signed a memorandum of understanding outlining how the two countries will coordinate investigations. The agencies expect to identify shared targets, align investigative work, and determine which jurisdictions should prosecute specific cases.

Key takeaways

• The U.S. and UK signed a memorandum of understanding to coordinate investigations into crypto and cyber-enabled investment fraud run from scam centers.
• Agencies will conduct parallel investigations, share intelligence on organized crime groups, and discuss jurisdiction-specific prosecution strategy.
• The DOJ says overlapping cases have already been identified, with plans for an in-person disruption operation in London in early October.
• The announcement highlights rising U.S. losses tied to crypto investment fraud as reported to the FBI’s Internet Crime Complaint Center.
• The joint pact builds on the U.S. Scam Center Strike Force launched in late 2025 to target Chinese organized crime networks operating primarily in Southeast Asia.

U.S. and UK coordinate parallel investigations

According to the DOJ, the memorandum of understanding sets out a practical framework for cross-border cooperation. The partners plan to pursue common targets through parallel investigations, exchange information about organized crime syndicates, and coordinate which legal jurisdictions will take the lead on prosecutions.

The DOJ also linked the announcement to existing investigative overlap, stating that authorities have already identified common cases. As part of the next phase, the agencies plan an in-person “disruption operation” with private-sector partners in London scheduled for early October.

Crypto investment fraud losses keep climbing

The new cooperation comes as reported U.S. harm from crypto investment fraud continues to rise. The DOJ cited data indicating that losses reported to the FBI’s Internet Crime Complaint Center increased by 89% in 2025 to $8.65 billion, up from $4.57 billion in 2023.

That escalation matters for how law enforcement allocates resources. While scams can vary in their methods—sometimes using fake investment platforms and other times employing more direct criminal coercion—the scale of victim losses increases the urgency to disrupt the criminal infrastructure behind them, including money flows, recruitment networks, and the operational hubs that process or redirect funds.

Expanding the U.S. “Scam Center Strike Force”

The joint U.S.-UK pact expands the scope of the Scam Center Strike Force, a U.S. initiative launched in November 2025 by U.S. Attorney Jeanine Ferris Pirro. The DOJ described the effort as focused on Chinese organized crime networks operating scam centers primarily in Southeast Asia, where schemes can include crypto investment fraud.

In the DOJ’s account, these operations are frequently intertwined with other serious crimes, including human trafficking and money laundering. The force is therefore not limited to prosecuting individual fraudsters; it is also aimed at dismantling the broader systems that enable recruitment, victim control, and financial movement.

The Strike Force includes a multi-agency set of U.S. partners: the FBI, U.S. Secret Service, Internal Revenue Service Criminal Investigation, and Homeland Security Investigations, alongside Justice Department components. The DOJ added that the initiative also works with the U.S. Treasury and State Department and with private-sector partners to disrupt scam operations and pursue victim fund recovery.

Other international raids show the pattern

The alliance is part of a wider enforcement trend in which agencies coordinate across jurisdictions to target scam center networks and the infrastructure around them. For example, the DOJ previously reported a Dubai police-led operation conducted with the FBI and China’s Ministry of Public Security. That action, announced on April 29, resulted in 276 arrests and the closure of at least nine crypto scam centers, according to the DOJ. The DOJ also said six people were charged over schemes that allegedly used fake crypto investment platforms to solicit deposits.

These cross-border actions reflect an operational reality: scam networks often rely on fragmented control across countries—where perpetrators, intermediaries, and the mechanisms used to receive or transfer illicit payments may not all sit in a single legal jurisdiction. Coordinated enforcement can therefore reduce the time criminals have to adjust or move operations after early disruptions.

In Southeast Asia, policymakers have also moved toward harsher criminal penalties. On May 15, the Myanmar military government released draft legislation proposing sentences ranging from 10 years to life in prison for digital currency fraud, with the death penalty possible in cases involving coercion at scam centers where coerced workers were killed. Later, on July 28, Parliament approved the bill, though presidential assent was not confirmed at the time of reporting.

Elsewhere, the scam ecosystem continues to evolve in ways that increase the complexity of enforcement. Earlier coverage from Cointelegraph noted a Bitcoin extortion scam that used the name of a Chinese newspaper, underscoring how criminals may rely on branding, impersonation, and attention-grabbing tactics to draw victims into payment or disclosure schemes.

What to watch next from the London operation

For investors, traders, and everyday users, the practical value of agreements like this is not in public statements alone, but in operational follow-through—especially when authorities plan disruption actions that bring together multiple investigative and prosecutorial systems. With the DOJ saying overlapping cases have already been identified and an in-person disruption operation is planned in London in early October, the next sign readers should look for is whether authorities announce specific arrests, charges, or confirmed closures of targeted scam centers as the cooperation moves from paperwork to courtroom and enforcement outcomes.

Pocket Bitcoin said on Sept. 3 that its August security incident exposed additional personal and financial information involving 5,411 customers, expanding the scope described in its initial disclosure.

The Swiss Bitcoin services provider identified two distinct groups after completing its forensic investigation. One contained bank transaction information involving 5,120 customers. The other covered correspondence containing potentially more sensitive records from 291 customers.

Pocket Bitcoin breach exposed two data groups

The larger group consisted of transaction lists that partner banks sent to Pocket Bitcoin during compliance checks. Those lists contained customer names, residential addresses, transfer amounts and transaction dates. Some also included the IBAN connected to a transfer.

The smaller group involved correspondence Pocket Bitcoin sent to partner banks. Depending on the customer, the exposed material included names, postal addresses, public Bitcoin addresses, identity document copies and source-of-funds records.

The company said the information appeared in different combinations, meaning every customer in the 291-person group did not necessarily have every listed data type exposed. Pocket Bitcoin has contacted affected customers individually with details about their cases.

The two groups cover 5,411 customers combined. Other customers may have had email addresses or support conversations exposed under the company’s original disclosure, but Pocket said those without a new personal notification should continue relying on that initial notice.

Core databases and customer Bitcoin were unaffected

Pocket Bitcoin said attackers did not compromise its main customer or transaction databases. Instead, the records came from correspondence and bank-generated lists stored in a copied backup within the affected support system.

This distinction explains why data resembling transaction and identity records was exposed even though the underlying databases remained secure. The affected support material contained copies of information produced or received during regulatory compliance procedures.

Pocket Bitcoin operates as a noncustodial service and does not hold customers’ private keys. The company said Bitcoin balances were never accessible to the attacker, while buying and selling services continue to operate normally.

A disclosed Bitcoin address cannot authorize a transfer. However, linking a public address to a customer’s identity may allow another person to inspect its visible blockchain activity. Pocket noted that moving Bitcoin cannot erase the address’s existing transaction history.

Exposed records create physical phishing risks

Pocket Bitcoin said it currently has no indication that the exposed information has been misused. That statement reflects information available after its investigation and does not guarantee that misuse will not occur later.

“As things stand, we have no indication that any of the affected information has been misused,” Pocket Bitcoin said.

The company identified forged letters and other physical communications as particular risks because names and postal addresses were included. A fraudster could refer to a genuine bank transfer or Bitcoin transaction to make an impersonation attempt appear credible.

Email addresses and login credentials were not linked to the two newly identified data groups, according to Pocket Bitcoin. The company therefore said it does not see a direct targeted email-phishing risk arising specifically from those records.

The incident follows several disclosures involving customer information held outside core crypto systems. As crypto.news reported, three recent breaches exposed 253,487 records, raising concerns that residential and transaction data could support phishing or physical targeting years later.

A separate August incident at Bits of Gold potentially exposed customer identity, banking and wallet information through a third-party system. That investigation similarly found that customer funds and passwords remained unaffected.

Pocket Bitcoin notified regulators and police

Pocket Bitcoin reported the incident to Switzerland’s Federal Data Protection and Information Commissioner and Liechtenstein’s Data Protection Office. It also filed a police report but did not identify the suspected attacker or provide details about the investigation.

The company said the vulnerability behind the incident has been closed and additional safeguards have been installed. It is reviewing how bank correspondence and related compliance records are stored and transferred.

Pocket expects to publish more information about those changes in the coming weeks. It does not expect to identify further exposure categories, although it said it would notify customers if later findings changed that assessment.

Affected users should monitor bank activity and treat unexpected letters, calls or messages cautiously. Pocket Bitcoin said it will never ask customers to disclose a seed phrase or transfer Bitcoin through an unsolicited telephone call or letter.

Notional Finance may have suffered a $1.7 million exploit involving an escrow contract, blockchain investigators reported on Sept. 4. The reported losses include approximately $69,242 in DAI and $1.66 million in USDC.

Security firm PeckShield cited findings published by blockchain investigation group Specter. Neither report provided a complete technical explanation of how the assets left the contract.

“The Notional Finance escrow contract may have been exploited,” PeckShield said, preserving uncertainty about the incident’s status.

Notional Finance exploit report identifies two addresses

Researchers identified two Ethereum addresses allegedly connected to the movement of the assets. The first address is 0xC954…De69, while the second is 0xDaCC…Ce38.

The addresses were labelled as theft addresses by Specter. That description remains an investigator attribution rather than a finding confirmed by Notional Finance, law enforcement or a court.

The available reports do not identify the precise escrow function involved. They also do not establish whether the event resulted from a smart-contract vulnerability, compromised credentials, faulty permissions or another cause.

Stablecoins were reportedly converted into 689.2 ETH

The suspected attacker reportedly exchanged the DAI and USDC for approximately 689.2 ETH. The Ether was then deposited into Tornado Cash, according to Specter and PeckShield.

Tornado Cash is a set of Ethereum smart contracts designed to reduce the visible connection between deposits and later withdrawals. Its use can complicate blockchain tracing, although depositing assets into the protocol does not independently prove criminal ownership or intent.

The rapid conversion of stablecoins may also reduce opportunities for issuers or centralized platforms to restrict the assets. Both DAI and USDC can be followed publicly before conversion, while subsequent withdrawals from a mixer become harder to associate with the original address.

In related coverage, crypto.news reported that an address tied to the Drift Protocol exploiter moved $44 million through Tornado Cash after remaining inactive for several months.

No technical cause or official response is available

Notional Finance had not published a public incident report or confirmation through its official account when checked. The project had also not disclosed whether contracts were paused, whether remaining assets were secured or whether users needed to take protective action.

The lack of confirmation means the reported $1.7 million loss should remain described as preliminary. It is also unclear whether the affected assets belonged directly to users, the protocol treasury or another party using the escrow contract.

No verified market reaction can be attributed to the report. Without an official assessment, linking token-price movements or changes in deposited value directly to the suspected exploit would be premature.

Previous recoveries depended on rapid containment

DeFi projects commonly respond to suspected exploits by pausing vulnerable contracts, contacting stablecoin issuers and exchanges, tracing connected wallets and offering return agreements. Those options can become more limited after assets enter privacy protocols.

Some projects have still recovered positions or protected unaffected products after an attack. As crypto.news reported, Term Labs recovered its affected fixed-rate positions following an $8.5 million governance exploit, although several products remained closed.

Stake DAO also secured its Ethereum backing and closed a bridge after an unauthorized minting incident, according to related coverage. Those cases involved direct project responses that are not yet available for Notional Finance.

Meanwhile, Notional Finance operates as an Ethereum-based lending protocol focused on fixed-rate, fixed-term borrowing. Its documentation explains that deposited currencies can support borrowing obligations denominated in other currencies. 

This makes contract-level accounting and collateral controls central to maintaining solvent user positions. However, researchers have not established whether the reported escrow incident affected Notional’s primary lending system, a separate integration or an older contract.

DAI and USDC have long formed part of Notional’s supported lending markets. The protocol’s technical materials describe currency pairs connecting those stablecoins with their interest-bearing equivalents. 

The reported loss therefore involves assets used within Notional’s broader lending architecture, but the available evidence does not show that open loans, collateral balances or fixed-term positions were affected. An official contract identification is needed before the exposure can be measured accurately.

What happens next for Notional Finance

The next confirmed update would likely need to establish which contract was involved, how the transactions were authorized and whether other funds remain exposed. A post-mortem could also clarify the ownership of the lost assets.

Investigators may continue tracking any Ether withdrawn from Tornado Cash. Exchanges and blockchain analytics companies could monitor later transactions, but the reported mixer deposits make attribution and recovery more difficult. Until Notional publishes an assessment, the scale, cause and effect on users remain unresolved.

Curve DAO approved yRisk as its new risk-management provider for crvUSD and Llamalend on Sept. 2, assigning the mandate to two contributors who are also primary developers of Resupply.

The binding onchain vote closed with approximately 621.2 million veCRV supporting the proposal and 5.33 veCRV opposing it. The proposal was executed about 87 minutes after voting ended.

yRisk will receive 125,000 frxUSD and 568,181 CRV through separate revocable vesting streams lasting one year. The package represents the team’s requested annual budget of approximately $250,000.

Curve DAO gives yRisk a twelve-month mandate

yRisk will provide risk assessment and monitoring across crvUSD mint markets and Llamalend isolated lending markets. Its responsibilities include reviewing collateral, liquidity, oracle design, concentration and governance risks.

The team will also recommend debt ceilings, market parameters, PegKeeper limits and other risk controls. Curve governance and its emergency DAO retain authority over final decisions and execution.

According to its original proposal, yRisk plans to build public monitoring systems, dashboards, alerts and automated code-analysis tools. Work funded by the mandate will generally be released under an open-source license.

The team consists of contributors known as Wavey and Dudesahn. The proposal identifies both as core developers at Yearn and Resupply and describes them as Resupply’s primary developers.

Resupply exploit was absent from reviewed materials

Resupply suffered a donation attack in June 2025 that caused approximately $9.6 million in losses. A QuillAudits analysis attributed the incident to exchange-rate manipulation affecting a lending market.

The attacker donated assets to a nearly empty vault, causing an exchange-rate calculation to round toward zero. That manipulation allowed the attacker to borrow against artificially inflated collateral.

yRisk’s Curve proposal disclosed its contributors’ Resupply roles but did not mention the exploit. Curve’s comparative assessment also discussed their Resupply experience without referring to the incident.

The omission does not establish that yRisk violated a disclosure requirement. Curve’s call for proposals requested relevant experience, methodology, capacity and pricing, but the published requirements did not expressly demand disclosure of every incident involving a contributor’s previous projects.

Curve reviewers identified a staffing concern

Swiss Stake reviewed nine competing applications before Curve conducted its preference votes. Its assessment credited yRisk with practical knowledge of Curve, Llamalend, Yearn and Resupply.

The review also identified capacity as its main concern. It questioned whether two contributors with other responsibilities could monitor a growing number of markets and provide adequate incident coverage.

“It is not yet clear whether they can sustain that workload and provide sufficient incident coverage as the number of markets expands,” Swiss Stake said.

The statement described uncertainty rather than a finding that yRisk lacked the necessary resources. Swiss Stake recommended an initial limited mandate and a public review checkpoint for whichever provider Curve selected.

During a nonbinding preference vote, yRisk received approximately 536.97 million veCRV votes in favor and none against from 47 voters. That represented about 68.78% of the voting supply at the snapshot block.

yRisk replaces LlamaRisk across Curve markets

Curve began seeking a replacement after LlamaRisk ended its engagement early. LlamaRisk had renewed its mandate in April 2026 with plans to continue through April 2027.

The provider announced its departure on May 29 and stopped active work on June 30. It returned approximately 270,247 crvUSD in unvested funding to Curve’s treasury.

LlamaRisk described the departure as a structural decision about how it allocated resources, rather than criticism of Curve. Curve opened its replacement process on July 7.

The new mandate arrives as Curve expands Llamalend. Crypto.news previously reported that Llamalend v2 introduced isolated lending markets on Optimism before a planned Ethereum deployment.

Risk management has remained a central concern for the ecosystem. In March, an improperly configured oracle enabled an attacker to extract approximately $240,000 from a Llamalend market, as crypto.news reported in its coverage of the sDOLA-crvUSD pool exploit.

Public reporting will test yRisk’s delivery

yRisk must now review LlamaRisk’s existing reports, models, dashboards and repositories. The team will determine which resources should be retained, rebuilt or retired.

Its proposal commits to monthly progress reports, continuous monitoring and incident support. The revocable funding structure gives Curve DAO the ability to stop the remaining vesting streams before the twelve-month term ends.

A future public review would allow governance participants to assess whether yRisk has met its monitoring, reporting and response commitments. Curve has not announced a specific date for that checkpoint.