H100 CEO Eirik Grøttum has increased his exposure to the Swedish Bitcoin treasury company through purchases totaling 407,163 shares for SEK 621,887, while H100 continues to report 3,506.4 BTC on its balance sheet.

H100 Group said in its Sept. 17 primary-insider disclosure that Kode Oslo AS carried out the purchases, with 405,663 shares acquired on Sept. 15 at an average SEK 1.53 and another 1,500 shares acquired on Aug. 19 at SEK 1.40. The combined average price was SEK 1.53 per share.

H100 CEO purchase lifts related holdings above 5.3 million

Kode Oslo now owns 2,771,787 H100 shares following the disclosed transactions. Grøttum serves on Kode Oslo’s board, owns 20% of the company and participates in its investment decisions, according to H100’s regulated notice.

A second associated entity, Olav Grøttum Holding AS, owns another 2,627,677 H100 shares. Grøttum owns that company entirely. Combined, the two businesses hold 5,399,464 H100 shares after the latest purchases.

The transaction concerns shares in H100 Group, not a new Bitcoin purchase by the company. H100’s disclosed Bitcoin position therefore remains separate from the CEO-related equity purchase.

Grøttum became H100’s chief executive on Aug. 11, one day after the company completed its large Norwegian Bitcoin-related acquisition. He previously served as CEO of Moonshot AS and had worked with H100 Chief Investment Officer Peter C. Warren managing Bitcoin holdings belonging to Geir Harald Hansen through Moonshot.

H100 said Grøttum’s background covers software development, quantitative trading, asset management and fintech. His appointment moved former CEO Johannes Wiik back into the chief operating officer role.

H100 still reports a 3,506.4 BTC treasury

H100’s latest company disclosures continue to place its treasury at 3,506.4 BTC. The position increased sharply on Aug. 10 when H100 completed its acquisition of NSD AS, which through a reorganization held Moonshot AS and PDI AS.

The transaction brought 2,455.37 BTC into the group, taking H100 from 1,051.03 BTC at the end of June to 3,506.4 BTC. H100 said the acquired companies had no outstanding financial debt.

No cash was paid for that acquisition. H100 issued 790,534,666 new shares to the sellers at SEK 1.86 each, representing consideration of approximately SEK 1.47 billion. The new shares increased H100’s outstanding share count to 1,128,931,358 immediately after the transaction.

The share issue represented roughly 70% of H100’s outstanding shares after closing. Geir Harald Hansen received a controlling position of approximately 69.2% through 781,676,551 shares following the deal, according to H100’s interim report.

H100 described the transaction as “the largest M&A transaction ever completed in the European Public Bitcoin Equity sector” and the first public-market acquisition completed on a Bitcoin-for-Bitcoin basis. Those descriptions are company claims and were not independently established across all European and global public-market transactions.

As crypto.news previously reported, the agreed valuation used Bitcoin at SEK 598,926.69, roughly $62,900, based on the Coinbase BTC/SEK spot price at the specified July 31 reference time. The figure was an acquisition valuation benchmark, not an open-market purchase price for 2,455.37 BTC.

Bitcoin exposure has become central to H100’s balance sheet

H100 began its Bitcoin treasury strategy on a much smaller scale. Its first purchase in May 2025 involved 4.39 BTC, after which the company raised equity and convertible financing to build its holdings.

By June 30, 2026, the company held 1,051.03 BTC before the Norwegian acquisition nearly tripled that amount. H100 describes itself as a technology company serving health and longevity providers while running an active Bitcoin treasury strategy.

The Bitcoin exposure has made H100’s reported earnings sensitive to cryptocurrency prices. Its second-quarter report showed an operating loss of SEK 88.7 million and a pre-tax loss of SEK 98.2 million. H100 said SEK 93.3 million of the pre-tax loss consisted of items that did not affect cash flow.

For the first half of 2026, the company reported a SEK 253.6 million pre-tax loss, while operating cash flow was negative SEK 12.7 million. Its equity ratio stood at 86% at June 30.

As crypto.news reported after the results, much of the quarterly accounting loss was linked to a non-cash write-down associated with Bitcoin’s lower valuation during the reporting period.

Grøttum wrote in the interim report that simply raising funds to accumulate Bitcoin was “unlikely to be sufficient on its own” for treasury companies. He said H100 planned to use capital allocation, capital-markets activity, acquisitions and operating cash flow alongside its Bitcoin holdings. The statement describes management’s strategy and does not guarantee future returns.

H100 is considering future share buybacks

The insider purchase follows a separate H100 announcement on Sept. 16 concerning new Swedish share-repurchase rules. Starting Dec. 5, Swedish public companies whose shares trade on multilateral trading facilities will be permitted to repurchase and hold their own shares. The change covers NGM Nordic SME, where H100 trades.

Grøttum said repurchases could become one of several capital-allocation options, particularly when H100 shares trade below net asset value. His comments describe a potential future tool, not an announced repurchase program.

H100 explicitly said no decision has been taken to repurchase its own shares. Any future program would require authorization from shareholders followed by a board resolution and disclosure under the applicable rules. The company’s Sept. 17 insider filing did not announce a change to its Bitcoin treasury, leaving the latest disclosed balance at 3,506.4 BTC.

The UK Financial Conduct Authority has targeted three London premises suspected of running illegal peer to peer crypto trading businesses, extending an enforcement campaign against unregistered digital asset activity.

According to the FCA, the operation was carried out on Sept. 10 alongside HM Revenue & Customs and the Metropolitan Police Service. Cease and desist letters were issued at all three locations, requiring traders to stop any suspected illegal crypto business.

Peer to peer crypto trading involves people buying and selling digital assets directly with one another. Personal transactions do not require FCA registration, but anyone conducting the activity by way of business in the UK must have the appropriate registration. No peer to peer crypto trading businesses are currently registered with the regulator.

The FCA said unregistered operators can provide a route for criminals to move and launder illicit funds because businesses operating outside its registration system avoid controls designed to detect and prevent money laundering.

“Working with partners, we continue to track and disrupt illegal crypto activity,” Steve Smart, executive director of enforcement and market oversight at the FCA, said. “Anyone running an unregistered peer-to-peer crypto business should assume we are looking at them.”

FCA expands crackdown on illegal peer to peer crypto trading

The latest operation extends enforcement activity that began earlier this year. In April, the FCA and partner agencies targeted eight London locations suspected of hosting unregistered peer to peer crypto businesses, crypto.news previously reported.

During the April 22 operation, the FCA worked with HMRC and the South West Regional Organised Crime Unit. Cease and desist letters were issued at all eight locations, while evidence collected during the inspections was retained for criminal investigations.

The regulator said evidence gathered during that operation is now being used to support ongoing criminal investigations and other enforcement action. Like the September action, the earlier inspections were conducted under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.

FCA officials have focused their enforcement efforts on businesses conducting crypto activity without the registration required under the existing anti money laundering framework. The regulator has been responsible for supervising relevant UK crypto businesses for compliance with anti money laundering and counter terrorist financing requirements since 2020.

Detective Sergeant Sathish Alalasundaram of the Metropolitan Police Service said investigators face challenges because cryptocurrencies allow funds to move rapidly across jurisdictions.

“Law enforcement and partner agencies are working significantly hard to tackle criminal activity involving digital assets,” Alalasundaram said. “The complex nature of cryptocurrency, combined with the speed at which funds can be moved across jurisdictions, presents ongoing challenges for those investigating.”

He said the Metropolitan Police continues to adapt its investigative capabilities and disruption methods as criminals change how they use digital assets.

FCA has previously pursued unregistered crypto businesses

The London operations follow several enforcement cases involving crypto businesses operating without FCA registration.

One of the regulator’s earlier cases involved Olumide Osunkoya, who pleaded guilty in September 2024 to offenses linked to an illegal crypto ATM network that processed £2.6 million in transactions between December 2021 and September 2023.

Osunkoya admitted operating crypto ATMs without the required registration, along with offenses involving false documents and criminal property. He was later sentenced to four years in prison, becoming the first person in the UK to receive a criminal sentence for unregistered crypto activity.

Separate enforcement action in June 2024 resulted in two London residents being arrested on suspicion of operating an illegal crypto exchange. Authorities believed more than £1 billion in unregistered cryptoassets had been bought and sold through the business.

The FCA inspected offices connected to the suspects, while Metropolitan Police officers searched two residential properties and seized several digital devices. Both individuals were interviewed under caution and released on bail while the investigation continued.

Enforcement continued in July 2025 when the FCA and Metropolitan Police searched four premises in southwest London. Seven crypto ATMs were seized and two people were arrested on suspicion of money laundering and operating an illegal cryptoasset exchange.

UK cryptoasset businesses providing services covered by the existing Money Laundering Regulations must register with the FCA and comply with applicable financial crime controls. Operating covered services by way of business without the required registration can lead to enforcement action.

UK crypto oversight will expand in October 2027

The Sept. 10 operation comes shortly before the FCA opens applications for the UK’s incoming crypto authorization framework.

Under final FCA guidance published on Sept. 16, applications for the new regime will open on Sept. 30, 2026. Firms seeking transitional arrangements must apply by Feb. 28, 2027, before the framework becomes mandatory on Oct. 25, 2027.

The incoming system will expand FCA oversight beyond the anti money laundering and financial promotion requirements that currently apply to much of the sector. Activities covered by the new framework include operating cryptoasset trading platforms, safeguarding cryptoassets, dealing and arranging transactions, issuing qualifying stablecoins and arranging cryptoasset staking.

Existing registration under the Money Laundering Regulations will not automatically convert into authorization under the new system. Companies already registered with the FCA will need to assess their activities and seek the relevant permissions if they intend to continue providing regulated services after the new rules take effect.

The regulator finalized key crypto rules in June covering financial resilience, market integrity, stablecoins and consumer requirements. Firms supporting customers who buy, trade or hold crypto will face standards including capital requirements and stress testing, while market integrity provisions will cover conduct such as insider trading and market manipulation.

Until Oct. 25, 2027, crypto remains largely outside the UK’s full financial services regulatory framework apart from areas including anti money laundering requirements and financial promotions. The FCA advises consumers to use its Firm Checker to establish whether a crypto business has the required registration or permissions before dealing with it.

Revolut said Thursday it had received no direct contact from those claiming responsibility for a customer data breach despite multiple public ransom demands.

A group calling itself “IAmNotAVillain” publicly demanded 6,000 Monero (XMR), worth about $3 million, from Revolut within 24 hours, threatening to sell the customer records to other criminal groups, the Financial Times reported Wednesday.

“Revolut has not received any direct contact or demand from the individuals or group making these claims,” a Revolut spokesperson told Cointelegraph.

The public ultimatum is the latest development in a data breach Revolut first disclosed last week, with Italian authorities now widening their investigation into how a government email account was allegedly used to obtain customer data.

One breach, multiple ransom demands

Revolut’s claim that it has received no direct contact adds to uncertainty over who is behind the public ransom demand, as “IAmNotAVillain” is not the only name linked to claims of responsibility for the incident. Its website, iamnotavillain.xyz, was unavailable when checked by Cointelegraph at the time of publication.

An earlier group calling itself “Revolut Smilik” reportedly demanded 10,000 Bitcoin, worth about $780 million at the time, vastly more than IAmNotAVillain’s current $3 million Monero demand.

IAmNotAVillain disputed the competing claim in a notice on its website, alleging that a former associate had received only a small sample of the data before taking credit for the breach. The site warned others not to deal with the rival claimant.

Cybersecurity-focused account Dark Web Informer also flagged another website, revoloot.lol, associated with a separate actor claiming responsibility, further complicating efforts to establish who controls the stolen customer records. The revoloot.lol website was also unavailable when checked by Cointelegraph.

Italian authorities widen Revolut data breach probe

Italy’s National Anti-Mafia and Anti-Terrorism Directorate is also now involved because the suspected intrusion concerns a government entity, Italian news agency ANSA reported Wednesday.

Related: Italy investigates government email breach linked to Revolut data leak

Prosecutors in Reggio Calabria have opened an investigation into unauthorized access to a computer system of public interest, while investigators work to establish whether the institutional email account was breached or cloned.

Italy’s privacy regulator has separately asked banks to urgently review the security of their access systems and is examining whether other banks or financial institutions may have been involved.

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it

A New York federal judge has denied Susquehanna’s bid to freeze nearly $100 million tied to dozens of traders accused of profiting from alleged insider information before China announced a crackdown on cross border trading platforms.

According to a Sept. 14 opinion and order from the U.S. District Court for the Southern District of New York, Judge Arun Subramanian found that Susquehanna Securities and Susquehanna Investment Group had not shown they were likely to suffer irreparable harm without a preliminary injunction.

Susquehanna filed the lawsuit on June 29 against 100 unnamed defendants, alleging violations of Section 20A of the Securities Exchange Act of 1934 and unjust enrichment. Citadel Securities later joined the case as an intervenor.

The dispute centers on trading before a May 22 announcement concerning the Chinese government’s crackdown on cross border trading platforms. Susquehanna alleged that the defendants traded using material nonpublic information before the news caused a sharp decline in certain securities.

The market maker initially targeted 100 defendants but narrowed its request for a preliminary injunction to 40. It asked the court to prevent them from transferring, encumbering, removing or otherwise disposing of proceeds held at third party brokerage firms that Susquehanna claimed came from insider trading.

As an alternative, the company sought an attachment order that would allow assets to be seized to secure a potential judgment.

Susquehanna failed to show an imminent risk to the funds

Subramanian found that Susquehanna had not produced enough evidence to establish that the defendants were likely to dissipate or conceal their assets before a judgment could be enforced.

Susquehanna argued that the defendants’ allegedly suspicious trading created a significant risk that the proceeds could be moved beyond the court’s reach. The judge rejected the argument, finding that accepting it would effectively allow asset freezes as a matter of course in many insider trading or fraud cases.

The court separately considered defendants living in the United States, foreign defendants who had appeared in the case and foreign defendants who had not appeared.

For domestic defendants, Susquehanna pointed to their failure to appear as part of its argument that the funds could be dissipated. The court found no evidence showing that their absence meant they intended to frustrate enforcement of a future judgment, noting that some apparently had not yet been formally served.

Susquehanna raised a similar concern over defendants living outside the United States, arguing that their assets could be moved beyond the jurisdiction of U.S. courts. Subramanian found that the possible difficulty of enforcing a judgment overseas was not enough by itself to establish irreparable harm.

The company did not identify a pattern of defendants hiding funds, making fraudulent transfers or engaging in evasive conduct, according to the order. Some foreign defendants who had appeared in the case submitted evidence indicating that they had enough funds to satisfy a potential judgment.

Susquehanna came closest to establishing a potential risk when it said in a reply filing that one defendant, identified as John Doe 3, appeared to have removed more than $10 million from a relevant account before a freeze took effect.

The court found that the claim lacked supporting evidence and said moving money from an account did not necessarily show an attempt to avoid a judgment. Funds used for active trading could have been reinvested elsewhere or could have belonged to a fund, employer or client.

Trading patterns did not establish likely insider trading

Susquehanna faced another problem because the court found that it had not demonstrated a likelihood of success on the merits of its claims.

To prevail on its Section 20A claim, the company would need to establish that someone owing a fiduciary duty of trust and confidence used material nonpublic information to profit from trading or tipped the confidential information to others.

Susquehanna submitted trading charts that it said showed defendants buying highly risky, short dated put options expiring on or shortly after the May 22 announcement. The company argued that there was no plausible explanation for the pattern other than trading based on material nonpublic information.

One defendant, Zhengfei Li, offered a different explanation. His trading records showed two equally sized positions, with half expiring before May 22 and the remainder afterward.

Li said the pattern was consistent with repeated speculation based on market signals instead of precise knowledge of an announcement. He told the court that unusually heavy put option activity visible through public market information and investor discussions led him to buy his own put options.

Evidence submitted by Li showed a put to call ratio of roughly 49 to 1 on May 21, the day he entered positions expiring after the announcement. Another defendant said she bought put options for similar reasons and submitted messages showing her reaction when the Chinese crackdown became public.

The court said defendants could have noticed unusual market volatility or publicly available posts suggesting that negative news was approaching and traded on those signals. Information available publicly would not qualify as nonpublic information under the insider trading claim.

Subramanian noted that some defendants’ trading records appeared more suspicious than Li’s. Susquehanna, however, brought the defendants together in one lawsuit and relied on broad arguments instead of providing detailed individual treatment of each trader.

The judge pointed to the scale of the original case, which accused 100 defendants of receiving insider information even though Susquehanna later stopped seeking a preliminary injunction against more than half of them.

Susquehanna had not identified the alleged tipper, the fiduciary duty that person owed or the personal benefit received for providing the information. The court found that the large number of investors who were not connected to each other could support explanations other than insider trading.

China crackdown triggered the trading dispute

The May 22 regulatory action at the center of the case involved Chinese scrutiny of overseas trading services offered to mainland investors.

crypto.news previously reported that Chinese securities regulators had targeted cross border brokerage activity involving firms including Tiger Brokers, Futu and Longbridge. The action concerned companies providing mainland clients access to overseas markets without regulatory approval.

China had already tightened restrictions on crypto and real world asset tokenization in February, extending restrictions to offshore entities serving mainland users and maintaining limits on virtual currency related financial services.

Days after the May 22 development, China’s Supreme People’s Court said judicial authorities would study rules for virtual currency disputes and cases involving cross border financial activity.

Enforcement involving overseas fund movements continued in July, when a Shanghai court sentenced five people over an illegal foreign exchange network that prosecutors said used cryptocurrency to move more than $29.4 million abroad. Authorities said the network helped domestic clients transfer more than 200 million yuan overseas over three years.

Court rejects alternative request to attach assets

Susquehanna’s failure to establish likely success on the merits affected its alternative request for an attachment order.

Federal Rule of Civil Procedure 64 allows courts to seize property to secure a potential judgment when the remedy is available under the law of the state where the court sits. In New York, a party seeking attachment must show, among other requirements, that it is probable to succeed on the merits.

Susquehanna relied on the same arguments it presented in support of the preliminary injunction. Subramanian found that the company had not demonstrated likely success on either its Section 20A claim or its unjust enrichment claim.

The unjust enrichment allegation was based on the same underlying claim that defendants had engaged in illegal insider trading. The court found that Susquehanna had not clearly shown that the defendants traded using material information unavailable to the market.

Questions remained over the extent of Susquehanna’s losses because the market maker acknowledged using hedging strategies. The court said the record did not establish how much of the defendants’ alleged gains, if any, came at the plaintiffs’ expense.

Subramanian stressed that the ruling did not decide whether Susquehanna had adequately pleaded plausible claims for relief, an issue the court had not yet addressed. The higher standard required to freeze funds totaling just under $100 million had not been met.

The court denied both the preliminary injunction and the alternative attachment request. An earlier order restricting the funds was set to dissolve at 5 p.m. ET on Sept. 16.

What higher Fed rates mean for everyday Americans

The Celsius bankruptcy estate has filed a lawsuit in the U.S. Bankruptcy Court for the Southern District of New York accusing several companies tied to BitMEX of fraud, market manipulation, and wrongful liquidation activity during the March 2020 crypto crash.

According to court filings, the estate alleges that BitMEX liquidated Celsius positions and seized Bitcoin collateral during the sell-off—actions it says were driven by an exchange “liquidation engine” that controlled liquidation trigger prices, executed orders, and received proceeds into an insurance fund. The complaint was filed on Sept. 12 by Celsius entities acting through the estate representative Blockchain Recovery Investment Consortium (BRIC), and was submitted just days before BitMEX is scheduled to stop exchange services on Sept. 23.

Key takeaways

• The lawsuit alleges BitMEX liquidated Celsius-related positions on March 12–13, 2020, seizing 1,325.84 BTC and additional collateral linked to an investment fund.
• The estate claims liquidation triggers and order placement on BitMEX were set in ways that produced deeper-than-necessary sell pressure during the crash.
• The filing seeks roughly $490 million in Bitcoin recovery based on the value described at the time of writing, along with various forms of damages and fees.
• BitMEX says it was hit by distributed denial-of-service (DDoS) attacks on March 13, a disruption the estate points to as evidence that its forced-selling mechanism suppressed prices.
• The court filing leaves several damages figures to be determined at trial, rather than specifying all claimed amounts up front.

A complaint targeting BitMEX-linked entities

The Sept. 12 complaint names five defendants alleged to be connected to BitMEX: HDR Global Trading, ABS Global Trading, Shine Effort, 100x Holdings, and HDR Global Services. It was filed in the Celsius bankruptcy proceedings and can be viewed in the PDF court docket submission provided with the report: https://cases.stretto.com/public/x191/11749/PLEADINGS/1174909152680000000029.pdf.

In the filing, the estate alleges BitMEX wrongfully liquidated Celsius collateral on March 12, 2020, seizing 1,325.84 BTC. It further alleges that, the next day, BitMEX liquidated 5,034.33 BTC from the investment fund JST. The complaint says JST later assigned related claims to the estate.

The lawsuit seeks recovery of Bitcoin worth nearly $490 million at the time of writing. It also requests actual damages of at least 6,360.16 BTC (or its current equivalent), along with either return of the Bitcoin in kind or payment of an equivalent market value. Additional requested relief includes statutory damages, punitive damages, treble damages where applicable, profits the estate says BitMEX earned from the liquidations, and legal fees and costs. The complaint does not quantify some of these additional claims, stating that amounts should be determined during trial.

Allegations of liquidation mechanics that worsened the crash

A central theme in the estate’s allegations is that BitMEX controlled key parts of the liquidation process. The complaint asserts that BitMEX determined the prices used to trigger liquidations, provided the “engine” that executed them, and managed the insurance fund that received proceeds from certain liquidated positions.

More specifically, the estate alleges that some liquidation sell orders were placed at prices more than 24% below the next-best ask available on the platform. The estate also claims that during the intensified liquidation cycle, Bitcoin traded at a lower price on BitMEX than on competing exchanges.

The court filing argues that these mechanisms contributed to downward price pressure, not merely reflected it. In the estate’s view, the timing of events around March 13, 2020 is particularly telling: it claims liquidation orders stopped when BitMEX became unavailable, and Bitcoin’s price then recovered. That pattern is presented as evidence that the exchange’s forced-selling activity had been suppressing the market price.

DDoS disruptions cited on March 13

The estate points to a March 13 service disruption as part of its argument that BitMEX’s liquidation activity intensified the sell-off. In support of the timing, the filing references statements by BitMEX indicating that the exchange experienced distributed denial-of-service (DDoS) attacks on March 13.

As described in BitMEX’s published response at the time, the exchange reported two DDoS attacks occurring at 02:16 UTC and 12:56 UTC on March 13: https://www.bitmex.com/blog/how-we-are-responding-to-last-weeks-ddos-attacks.

For investors and market participants, the practical question embedded in the litigation is straightforward: if exchange liquidation systems were operating in a way that pulled prices lower—potentially more aggressively than the prevailing order book suggested—then the impact of liquidations during crises may not be limited to “necessary” risk reduction. Instead, it could reflect specific matching and execution behavior inside a particular venue.

Why the timing and targets matter

The filing’s timing is notable. The complaint was submitted on Sept. 12, according to the report, and it arrives shortly before BitMEX is scheduled to stop exchange services on Sept. 23. That proximity raises the stakes for the bankruptcy estate, which is attempting to recover assets allegedly lost during a historic stress period for crypto markets.

The case is also not the first legal action tied to BitMEX’s liquidation behavior during the same window. Earlier coverage referenced in the source material noted that, on July 23, BKX Services and David Namdar filed a separate proposed class action alleging combined losses of 622.66 BTC from forced liquidations. That earlier complaint, as described in the source, alleged an internal trading desk could access private customer information and continue trading during server freezes.

In response to the July case, the source states that a BitMEX spokesperson told Cointelegraph the claims were an “opportunistic claim with no basis” and that BitMEX would defend itself. The report also notes that this statement was about the July lawsuit and not a response to the Celsius complaint.

What comes next for the Celsius estate

With the lawsuit seeking both direct recovery of Bitcoin and a broader set of statutory, punitive, and treble damages—while leaving some claimed amounts for trial—the Celsius bankruptcy estate’s next challenge will be substantiating the alleged liquidation mechanics and linking them to specific losses during the March 2020 crash. Market watchers should focus on how the court handles proof related to execution quality during stress periods and whether the alleged price discrepancies and timing around the March 13 disruptions are sufficient to support the estate’s fraud and market manipulation theories.

Upbit has delayed the start of JPYC trading by three hours on Sept. 17, moving the yen-backed stablecoin’s scheduled launch from 12:00 p.m. to 3:00 p.m. KST across its KRW, BTC and USDT markets.

Upbit said in its Sept. 17 listing notice that the original support plan covered both JPY Coin (JPYC) and PayPal USD (PYUSD), with trading initially set to begin at noon. The exchange updated the notice at 11:50 a.m. KST and changed only JPYC’s start time. Upbit did not give a specific reason for the delay in that update.

At 1:58 p.m. KST, the latest public update reviewed still showed JPYC trading scheduled for 3:00 p.m. KST. Upbit had not posted a second postponement at that point. Public listing trackers had already registered JPYC/KRW, JPYC/BTC and JPYC/USDT as newly added pairs, but the exchange’s notice sets the official start of trading support.

JPYC trading on Upbit moves to 3 p.m. KST

The delay affects all three JPYC markets announced by Upbit. Once trading begins, customers will be able to trade JPYC against the South Korean won, Bitcoin and Tether. Upbit said deposits and withdrawals will use the Ethereum network, with other JPYC networks outside the scope of the listing notice.

Upbit identified the supported Ethereum JPYC contract 0xE7C3D8C9a439feDe00D2600032D5dB0Be71C3c29. The exchange warned customers to verify the network and contract before transferring funds because unsupported deposits may require a lengthy return process.

For pricing controls, Upbit used CoinMarketCap data when setting its initial trading restrictions. Its notice showed JPYC at 8.81 won at 9:40 a.m. KST on Sept. 17, compared with a previous closing reference of 8.78 won. Those figures were reference prices published before Upbit JPYC trading began and do not represent a post-listing market reaction.

Upbit’s general trading guidance explains that new assets do not have a previous Upbit closing price on their first trading day. Once trading starts, the platform uses the first executed price when calculating the day’s change for newly supported assets.

PYUSD schedule remained unchanged after JPYC delay

PayPal USD appeared in the same original listing announcement, but Upbit’s 11:50 a.m. update named only JPYC when changing the schedule. PYUSD therefore retained the noon start time stated in the original notice, with KRW, BTC and USDT markets included.

Deposits and withdrawals for PYUSD are limited to Ethereum under this Upbit listing. The exchange identified the supported token contract as 0x6c3ea9036406852006290770bedfcaba0e23a0e8.

PayPal describes PYUSD as a dollar-denominated stablecoin redeemable 1:1 for U.S. dollars.PayPal’s current PYUSD information says Paxos issues the token and backs it with U.S. dollar reserves and cash equivalents. PayPal’s terms list Ethereum, Solana, Arbitrum and Stellar among supported PYUSD networks, though Upbit is accepting only Ethereum transfers for its new markets.

PayPal, M0 and MoonPay had launched the PYUSDx framework, which lets businesses issue customized tokens backed by PYUSD. The report said Saturn, Concrete and Cap were the first projects using the platform.

Upbit limits early orders and Ethereum transfers

Upbit applies several controls during the opening period for newly listed assets. The exchange said buy orders are blocked for roughly five minutes after trading starts. Sell orders priced more than 10% below the previous closing reference are restricted for roughly the same period.

For approximately two hours after launch, only limit orders are available. Upbit blocks other order types and conditions during that window. The rules apply when each asset’s trading support begins, meaning JPYC’s restrictions start from its revised opening time.

Upbit requires customers to use supported virtual asset service providers or personally verified wallet addresses for deposits subject to its travel-rule procedures. Large deposits with unclear origins can lead to requests for information about the source of funds, according to the exchange notice.

The exchange’s trading guide lists minimum orders of 5,000 won in its KRW market, 0.00005 BTC in its Bitcoin market and 0.5 USDT in its Tether market. Upbit calculates its daily market data from midnight UTC, corresponding to 9:00 a.m. KST.

JPYC arrives after Japan’s regulated stablecoin rollout

JPYC Inc. received registration as a funds-transfer service provider under Article 37 of Japan’s Payment Services Act on Aug. 18, 2025. The company lists its registration as Kanto Local Finance Bureau No. 00099.JPYC’s registration announcement said the status allowed it to issue a yen-linked electronic payment instrument redeemable against Japanese currency.

The company formally launched the current JPYC stablecoin and its JPYC EX issuance and redemption service in October 2025. JPYC said the token is designed to track the yen at 1:1 and is backed by yen-denominated deposits and Japanese government bonds.

JPYC has since expanded beyond issuance and redemption. The issuer said on July 10 that on-chain circulation had passed 2 billion yen, while an earlier June update put cumulative JPYC EX account openings above 19,000 and cumulative issuance above 3 billion yen.

Retail payment tests have provided another use case. Japanese convenience-store operator Lawson expanded a stablecoin payment test in August to include JPYC, USDC and USDT at Tokyo stores. The trial used existing point-of-sale systems to process wallet-based payments.

In another JPYC deployment,crypto.news reported in July that AZ-COM Maruwa Holdings planned to use the yen stablecoin for payments involving roughly 2,300 business partners, including transport contractors.

JPYC Inc. says its regulated token is available across Ethereum, Avalanche and Polygon. Upbit’s Sept. 17 support, however, accepts only the Ethereum version for deposits and withdrawals, with JPYC trading scheduled to begin at 3:00 p.m. KST following the three-hour postponement.

Ethereum Classic node operators have been urged to avoid a disputed Core Geth v1.13.0 release after several mining pool nodes briefly adopted the software before returning to the maintained Argos client.

Classix said in a Sept. 16 incident report that the ethereumclassic/core-geth repository released v1.13.0 on Sept. 14 before the @ETC_Network account promoted it as an Ethereum Classic security update and told node operators to migrate. Similar messaging appeared on CoinMarketCap, while mining pools received emails from an ethereumclassic.com address.

The report described the release as a rogue version because the existing Core Geth maintainers had not reviewed it and the maintained etclabscore/core-geth repository had not issued the update. Classix recommended that operators continue using Argos v1.12.23, the current release from the repository that has maintained Core Geth since 2020.

Rogue Core Geth release reached some ETC mining nodes

Development of the disputed version accelerated during the days before its release. According to Classix, 96 commits containing 13,422 added lines and 3,977 deleted lines were pushed within 56 hours directly to the fork’s main branch without pull requests or outside review.

The ethereumclassic/core-geth repository itself had been forked from etclabscore/core-geth in December 2024. Activity increased on Sept. 12, 2026, when v1.13.0-rc1 was tagged. Six more release candidates followed before v1.13.0 was labeled stable at 15:06 UTC on Sept. 14. The @ETC_Network account published the migration request the following morning.

The software reached part of Ethereum Classic’s mining infrastructure before operators reversed the migration. Four 2Miners nodes were running CoreGeth v1.13.0 at 12:09 UTC on Sept. 15, according to node status data cited by Classix. By 23:35 UTC, all four had returned to Argos v1.12.23. Other listed mining pools remained on versions in the 1.12 series.

Some individual nodes continued running the disputed software. Etcnodes.org showed 11 v1.13.0 nodes at 07:33 UTC on Sept. 15, with the number falling to 10 by Sept. 16. Three of the remaining nodes matched bootnode IP addresses hardcoded into the new client, according to the report.

No blocks were lost, no chain reorganizations occurred, no funds were affected and no service interruption was recorded during the incident, Classix said. The report classified the event as high severity but low impact because the software altered consensus behavior while producing no recorded economic or transaction losses.

Ethereum Classic has faced chain reorganizations before. As crypto.news previously reported in its coverage of Ethereum Classic majority attacks, ETC suffered three majority attacks in August 2020, including reorganizations involving thousands of blocks.

Classix disputes v1.13.0 security claims

The v1.13.0 release told operators that every node running v1.12.x should upgrade and claimed each release in that series contained unpatched security issues, including a vulnerability allegedly used against Ethereum Classic bootnodes in March.

Classix challenged that description after reviewing seven security issues cited by the release. Five had already been addressed in maintained Core Geth releases between March and August, while the other two did not affect Ethereum Classic’s peer to peer path, according to the report.

CVE-2026-22862 and CVE-2026-26315 were among the vulnerabilities Classix said had been fixed in Aegis v1.12.21. Hermes v1.12.22 subsequently addressed other cryptographic issues, while Argos v1.12.23 incorporated delayed peer to peer message decoding from go-ethereum to address CVE-2026-26313.

Another listed issue, CVE-2026-22868, concerned KZG proof verification. Classix said it did not apply to Ethereum Classic because KZG proofs are associated with blob transactions introduced through Ethereum’s Cancun upgrade, which ETC has not activated. The report said a separate GraphQL query depth issue was not part of the peer to peer or consensus path and required GraphQL to be enabled manually.

Classix said Core Geth maintainer Diego López León reviewed the remaining differences and found no exploitable flaw in Argos that v1.13.0 corrected.

Core Geth changes included MESS and new bootnodes

Beyond its security claims, v1.13.0 changed how participating nodes could select chains and discover peers.

One modification reenabled Modified Exponential Subjective Scoring, or MESS, by removing the configuration that deactivated it at block 19,250,000. Ethereum Classic introduced MESS in 2020 as protection against chain reorganizations before disabling it through ECIP-1110 after Ethereum moved from proof of work to proof of stake.

Classix warned that different consensus clients could behave differently if only Core Geth nodes used MESS. Besu, Nethermind and Getc do not implement the mechanism, according to the report.

Historical reorganizations remain a particularly relevant issue for ETC. A crypto.news review of blockchain reorganization history described how miner consensus and competing chain histories can determine the outcome of reorganizations on proof of work networks.

The disputed client changed node discovery infrastructure as well. A commit replaced a DNS tree signing key maintained by etclabscore contributors since 2020 and hardcoded three new bootnode IP addresses. Two older discovery trees, blockd.info and etcdisco.net, were subsequently removed.

Three replacement domains were hosted through the same Cloudflare account, according to the report, while the repository acknowledged that an issue affecting the single account could remove all three paths. Operators following the migration instructions were not told who controlled the new signing key, Classix said.

The migration guide separately instructed operators to rotate their P2P node keys, citing CVE-2026-26315. Classix said Aegis had already fixed the underlying issue in March. Rotating a key changes a node’s network identity and forces it to rebuild peer connections through discovery infrastructure.

Ethereum Classic operators urged to return to Argos

Classix recommended that operators avoid ethereumclassic/core-geth v1.13.0 and continue running etclabscore/core-geth Argos v1.12.23. Operators that had already migrated were told to move back, restore their previous node key if it had been rotated and check their MESS configuration.

The report said Ethereum Classic operators should consider running different clients instead of concentrating network hash power on Core Geth. Nethermind, Besu and Getc remain available alternatives.

Client diversity has become a recurring security consideration across blockchain networks. Ethereum development, for example, continues to test upgrades across multiple execution and consensus implementations before deployment. Recent Glamsterdam testnet preparations included another private devnet after testing exposed consensus and execution implementation bugs ahead of the planned Sepolia activation.

Classix asked administrators of the ethereumclassic GitHub organization to tighten repository controls, require proposals and reviews before new repositories are created, protect default branches and identify maintainers for repositories distributing software. It separately requested that ethereumclassic/core-geth be removed or archived, or carry a warning explaining that it is not an official client.

Ethereum Classic itself does not designate an official developer, maintainer, website or client, according to the project’s website disclaimer quoted in the report. Classix said the maintained etclabscore repository derives its standing instead from its six year public history, active maintenance and adoption among ETC nodes.

The report is intended to serve as both an initial notification and an interim incident report. Classix said it would update the document if the remaining nodes are verified, organization maintainers respond or other material developments emerge.