Acting U.S. Attorney General Todd Blanche faced sharp criticism at a Senate Judiciary Committee hearing on Wednesday as lawmakers weighed his nomination to lead the Justice Department. The backlash centered on how the department has pursued— or deprioritized—crypto-related enforcement, particularly in cases involving the broader developer ecosystem.

Senator Dick Durbin, the ranking Democrat on the committee, used portions of his opening statement to accuse Blanche of weakening DOJ’s crypto enforcement capacity. Durbin referenced Blanche’s reported role in dismantling a DOJ crypto enforcement unit in April 2025 while he was deputy attorney general, arguing that the move left ongoing investigations effectively “shut down” during the Trump administration’s push toward different enforcement priorities.

Key takeaways

• Durbin’s criticism ties Blanche’s prior DOJ actions to a broader shift in crypto enforcement, including alleged “dismantling” of the department’s crypto unit.
• Questions from Republicans—including concerns about Changpeng “CZ” Zhao’s presidential pardon—highlight ongoing political scrutiny of crypto outcomes.
• Blanche signaled a framework that aims to avoid charging developers who are not implicated in third-party wrongdoing.
• The committee vote math remains tight, with the confirmation process dependent on the Senate session’s practical majority rules.

Durbin’s attack on Blanche’s crypto enforcement record

At Wednesday’s hearing, Durbin argued that Blanche’s decisions as deputy attorney general enabled President Donald Trump to benefit financially from ties to the crypto industry. Durbin referenced reports that Blanche helped disband DOJ’s crypto enforcement unit in April 2025, citing Fortune’s reporting on the restructuring.

Durbin also alleged that Trump’s business interests, including family-linked World Liberty Financial, were connected to deals involving cryptocurrency. He further accused Binance’s former CEO Changpeng “CZ” Zhao of “broker[ing] a deal to channel $2 billion” into World Liberty—an accusation Durbin tied to Zhao’s later presidential pardon. The hearing remarks referenced Zhao’s 2023 agreement to plead guilty to a felony charge related to the exchange’s Anti-Money Laundering (AML) compliance.

Blanche’s nomination comes as the political stakes around DOJ leadership and enforcement priorities remain high. In addition to crypto policy, Republicans and Democrats are also disputing DOJ’s broader approach to issues such as immigration enforcement and how the department is handling sensitive political matters.

Confirmation dynamics: narrow path in the Senate

Blanche’s path depends on committee progress and then a Senate confirmation vote if his nomination advances. As of the hearing, the Senate Republican leadership, including Senator Mitch McConnell, faced an operational challenge: McConnell was still hospitalized after a fall described by his team as resulting in pneumonia. That uncertainty contributes to a slim margin in the Senate—described as 52-47 in favor of Republicans—meaning procedural details about attendance could become decisive for confirmation.

While Republicans hold the majority needed for a confirmation if a simple majority of lawmakers present supports the nominee, the nomination also faces targeted scrutiny. The hearing record suggests that lawmakers are not only debating the technical enforcement posture toward crypto, but also broader concerns about whether DOJ leadership will align with the administration’s political goals.

Blanche’s response: avoiding cases against “coders” not tied to wrongdoing

In addition to the political debate, Blanche addressed how DOJ intends to treat crypto software developers. According to a DOJ memo referenced at the hearing and later described in related coverage, the administration’s approach was framed as moving away from enforcement that “regulates by prosecution,” with the memo focused on shifting how the DOJ engages with the crypto sector. The memo was published by DOJ (see this DOJ document).

Blanche told crypto holders shortly after taking the acting role that officials would not pursue cases into blockchain developers who were not responsible for illicit activity on platforms. In remarks carried during industry coverage—specifically at the Bitcoin 2026 conference—Blanche indicated that DOJ would not investigate software developers when the developer is not a third-party user and is not knowingly helping someone commit crimes.

As quoted in the underlying reporting, Blanche described the distinction as follows: if someone is developing software or coding as part of the process, and is neither a user nor knowingly enabling third parties who commit crimes, then DOJ would not investigate or charge them. That is a notable signpost for developers and open-source contributors, because it suggests DOJ’s enforcement posture may be more carefully calibrated around scienter and direct involvement rather than broader theories that could sweep in peripheral actors.

What remains uncertain: ongoing prosecutions and “platform” cases

Even with Blanche’s emphasis on limiting charges against uninvolved coders, the department is not abandoning crypto enforcement altogether. The reporting around the hearing notes that DOJ still has ongoing cases against developers tied to platforms allegedly used for illegal activities. In other words, the line Blanche drew in public comments appears designed to narrow where DOJ looks for culpability, rather than eliminate enforcement.

Federal prosecutors are also expected to retry Tornado Cash co-founder Roman Storm later this year after a 2025 jury failed to reach a verdict on two charges. That procedural detail matters because it indicates that core enforcement actions connected to sanctioned or laundering-linked services are continuing through the courts, even as lawmakers debate whether the DOJ’s approach to developers is shifting.

For readers, the next watchpoint is whether Blanche’s confirmation will lead to measurable changes in charging decisions—especially how prosecutors apply intent and involvement standards to developers. The hearing made clear that political conflict and enforcement strategy will run in parallel, but the real test will be in the cases that move forward and those that get narrowed or dismissed.

Ostium, a decentralized perpetuals trading protocol built on Arbitrum, has paused all trading after security firms reported what they described as an exploit tied to the protocol’s OLP liquidity vault. Blockaid and CertiK both said the incident appeared to stem from a compromise of Ostium’s oracle infrastructure, which feeds external price data into the platform.

Blockaid estimated losses at around $18 million, while CertiK put the figure closer to $22 million. Ostium said it identified an issue affecting the vault and is investigating, but it has not yet confirmed the cause or independently verified the loss estimates.

Key takeaways

• Ostium paused trading after reporting an issue in its OLP liquidity vault.
• Two security firms diverged on losses: Blockaid estimated ~$18M; CertiK estimated ~$22M.
• The suspected root cause is oracle compromise, according to Blockaid and CertiK.
• Ostium urged users to revoke approvals for its contracts while it investigates.

Trading halted and user action requested

On X, Ostium announced it was pausing all trading after identifying a problem affecting the vault. In a subsequent update, the protocol recommended that users temporarily revoke approvals for its contracts “until we can further investigate the recent incident,” framing the guidance around user security.

Ostium’s statements indicate the team has not concluded what happened. The protocol also said it is still investigating the matter and has not confirmed the precise cause behind the exploit or the size of the losses referenced by external security firms.

For traders and liquidity providers, these steps matter because approval management can be directly relevant to how funds could be moved or accessed by smart contracts. Until the protocol provides a more detailed technical assessment, users are essentially operating on partial information—security firm analysis on one side and Ostium’s ongoing review on the other.

Security firms point to oracles, not just smart-contract bugs

Blockaid and CertiK attributed the apparent incident to a compromise of Ostium’s oracle system. Oracles are the mechanism that translates external data—commonly asset prices—into onchain inputs. When an oracle is manipulated or fails, it can distort how a protocol prices assets or calculates settlement conditions, potentially enabling exploits even when core smart contracts are functioning as designed.

Blockaid’s estimate of roughly $18 million in losses and CertiK’s estimate of about $22 million underline that there may be uncertainty in how the damage is measured—particularly in DeFi incidents where attackers can move funds across multiple steps and venues before or after the exploit is detected.

The gap between the estimates also signals why protocols tend to pause operations quickly: with incomplete visibility, the safest near-term action is to stop new trading activity while the affected contracts and oracle pathways are examined.

What Ostium offers—and why the vault issue is central

Ostium is an onchain perpetuals platform for leveraged trading, offering exposure to 75 trading pairs across categories that include stocks, ETFs, commodities, indices, foreign exchange, and cryptocurrencies. Its deployment on Arbitrum places it within the broader wave of offchain-scale improvements offered by Ethereum-compatible networks, but security remains a cross-chain concern: the protocol’s onchain design still depends on offchain components such as oracle data.

The reported issue is specifically linked to Ostium’s OLP liquidity vault. Liquidity vaults are typically used to manage pooled assets that can back trading positions and related settlement flows. If an oracle compromise leads to incorrect accounting—such as mispricing, liquidation logic manipulation, or unfair transfers—vaults can become the conduit through which value is extracted.

DeFi hacks keep targeting infrastructure

The Ostium halt is another reminder that DeFi incidents continue to be persistent even as the industry invests in security tooling and formal best practices. DeFiLlama data cited by Cointelegraph indicated that crypto hacks caused nearly $630 million in losses during April, the highest monthly total since February 2025. DeFi protocols accounted for the majority of that figure, with exploits at KelpDAO and Drift Protocol contributing more than 80% of the April total.

In recent research and commentary, security observers have argued that the threat focus is shifting. Instead of only exploiting weaknesses in smart contracts directly, attackers increasingly go after offchain infrastructure—particularly oracle systems, privileged access controls, and key management processes. That pattern aligns with the Ostium incident as described by Blockaid and CertiK.

Concerns extend beyond immediate technical risk. The repeated occurrence of these incidents has fed questions about whether DeFi is ready to support institutional participation at scale. Earlier coverage highlighted that bridges and other connecting components remain a major security challenge for the sector, and that scaling DeFi for broader adoption requires more than yields—it requires credible operational resilience.

There are also economic constraints. As Cointelegraph previously reported, shrinking DeFi yields can make security costs harder to justify, and institutions may struggle to quantify hack risk versus expected returns. In a May conversation cited by Cointelegraph, the CEO of smart contract security firm Statemind and Symbiotic co-founder Misha Putiatin said institutions increasingly find it difficult to price hack risk, which can reduce appetite for sector exposure despite rising interest in blockchain-based finance.

What to watch next

Investors and users should monitor whether Ostium releases a fuller incident report that clarifies how the oracle system was compromised, which contracts or components were affected, and whether user funds remain recoverable. Equally important will be whether the protocol updates its oracle design or control mechanisms to prevent recurrence—and how quickly trading and liquidity operations can safely resume.

Investment giant Cantor Fitzgerald and cryptocurrency-focused broker-dealer Securitize (SECZ), are revamping initial public offerings (IPOs) with tokenization and blockchain technology, the companies said on Wednesday.

Under the agreement, Cantor will leverage its equity capital markets and trading capabilities, while Securitize will provide the tokenization infrastructure used to issue, distribute, and service tokenized securities, according to a press release.

Large traditional finance players are taking rapid steps towards the tokenization of capital markets. This week the Depository Trust & Clearing Corporation (DTCC) announced further plans to tokenize stocks with a range of partners including JPMorgan, Goldman Sachs, BlackRock and Vanguard.

The collaboration will enable public companies to raise capital and issue securities onchain with improved operational efficiency and modernized ownership records, while still operating within the established capital markets framework of traditional public offerings, the companies said.

Rather than focusing on tokenized funds or secondary trading, this partnership extends blockchain infrastructure directly into IPOs and follow-on offerings, a Securitize spokesperson said in an email.

XRP Ledger has entered the final two-week activation countdown for its fixCleanup3_2_0 amendment after validator support exceeded the network’s required 80% approval threshold.

According to XRP Ledger governance data, the bundled maintenance amendment currently has 85.71% validator support, with 30 validators voting in favor and five against.

Under the network’s governance rules, an amendment must maintain at least 80% support for two consecutive weeks before it can be activated on the mainnet. If support drops below that level during the countdown, the activation timer resets.

Validator approval has moved the amendment into its final activation stage

With the voting threshold now secured, the amendment has entered its activation phase and is currently scheduled to go live on July 29, 2026, at 09:57 UTC, provided validator backing remains above the required level throughout the waiting period.

XRPL validator Vet shared the update on X, noting that fixCleanup3_2_0 is now in its two-week activation window. Vet also said node operators will need to update their software before the amendment becomes active to ensure compatibility with the protocol changes.

Unlike feature-focused upgrades, fixCleanup3_2_0 combines several maintenance fixes into a single amendment. The package addresses precision and rounding issues affecting Single Asset Vaults and the Lending Protocol while also correcting behavior in Permissioned Domains and the Permissioned DEX introduced alongside XRPL v3.2.0.

Additional protocol changes validate non-canonical Multi-Purpose Token (MPT) amounts, introduce zero DomainID verification for permissioned domains, and correct an invariant governing valid Permissioned DEX offer deletions. The amendment also adds another ledger invariant designed to prevent account deletions from leaving directly accessible artifacts behind.

By grouping multiple maintenance updates into one amendment, the XRP Ledger governance process requires validators to approve a single package instead of voting on several independent protocol changes.

Recent ecosystem growth has expanded activity around the network

The maintenance vote comes as development activity on XRP Ledger continues to expand beyond core protocol updates. Earlier, the network surpassed 1 million AI-powered payments processed through the x402 protocol, highlighting increasing use of AI-enabled payment applications.

Ripple-backed t54.ai recently launched the XRPL AI Hub, a platform that brings together AI projects, autonomous agents, developer tools, payment services, and technical documentation in one place.

According to t54.ai, the hub was introduced with support from Ripple developers and the XRP Ledger Foundation to help developers discover and build AI applications on the XRP Ledger.

Although the AI Hub launch is separate from the fixCleanup3_2_0 amendment, both developments arrive as the network continues improving infrastructure for decentralized finance, tokenization, permissioned trading, and AI-powered payment services.

If validator support remains above the required threshold until the end of the activation window, fixCleanup3_2_0 will become the latest protocol update added to the XRP Ledger without requiring another round of governance voting.