Ledger fixed a vulnerability affecting certain clear signing flows in its Ethereum application before another security company disclosed the issue publicly, Chief Technology Officer Charles Guillemet said on Aug. 23.

Guillemet said Ledger Donjon, the company’s internal security research team, discovered the bug using an artificial intelligence vulnerability research system. Ledger deployed the fix approximately two weeks before his statement, according to his post.

Users with current Ledger firmware and applications are protected, Guillemet said. No independently verified reports of funds stolen through this specific vulnerability had emerged by Aug. 24.

Ledger Ethereum app bug affected clear signing

Clear signing is intended to show transaction details in a readable format on a Ledger device before the user approves them. It allows users to check amounts, addresses and smart contract actions instead of authorizing an unreadable transaction hash.

TestMachine, the security company behind the Azimuth artificial intelligence research tool, said the vulnerability could undermine this review process. According to the company’s public thread, a malicious application could allegedly send a competing command while a user was still reviewing the original transaction.

The reported issue involved Application Protocol Data Unit communication between the connected application and Ledger’s Ethereum app. TestMachine claimed this could let an attacker replace an expected transaction with another action before the user completed approval.

Under that scenario, a device could display one transaction while preparing another for signing. One possible result described by researchers involved replacing a limited transaction with a broader token approval.

Ledger acknowledged that a bug existed in “certain clear signing flows.” However, Guillemet did not publish a detailed technical description, affected version list or security advisory explaining the full attack requirements.

Ledger and TestMachine dispute the disclosure timeline

TestMachine said its Azimuth system found the issue during an autonomous scan and validated it on a Ledger Flex. The company also claimed that shared code made other models potentially relevant, including Nano X, Nano S Plus, Stax and Apex devices.

Those statements remain the company’s account of its research. A complete public proof of concept demonstrating fund theft across every named device was not available at publication time.

Guillemet disputed how the disclosure was presented. He said TestMachine contacted Ledger’s bounty program after the company had already shipped its fix. He further alleged that the researchers did not discuss the issue with Ledger’s bounty team before publishing claims that suggested it remained unresolved.

“It was fixed and deployed two weeks ago,” Guillemet said. He described claims that the problem remained active as “manufacturing fear for attention.” TestMachine, by contrast, said it shared and verified the finding with Ledger but declined a bounty.

Ledger’s public Ethereum application repository shows several security-related changes during August. These include fixes involving signing states, application context handling and message finalization. The available records do not clearly identify which change corresponds to the disclosed clear signing issue or confirm the precise deployment date across Ledger’s device application store.

Users should update firmware and the Ethereum app

Ledger users should update the Ledger Wallet software, device firmware and installed Ethereum application. Updating only the desktop or mobile interface may not replace an outdated application running on the hardware device.

Users should also verify transaction details directly on the secure device screen. Ledger’s guide warns that blind signing remains risky because the device cannot present every smart contract action in a readable format.

As previously reported, Ethereum introduced human readable transaction summaries through the ERC-7730 standard. Ledger helped develop the system before stewardship moved to the Ethereum Foundation.

The latest incident differs from the previously reported Zilliqa signing flaw that exposed private keys. Zilliqa said that vulnerability affected its own native Ledger application and could not be corrected for keys already exposed through recorded signatures.

Ledger has not announced any compensation process, emergency transaction suspension or asset migration related to the Ethereum app issue. Further confirmation would require a technical advisory naming the affected versions, patched release and precise conditions needed to exploit the flaw.

U.S. President Donald Trump said on Aug. 19 that his administration had discussed accumulating more Bitcoin or other cryptocurrencies but had not reached a decision.

Trump responded to a question during a White House gathering attended by technology executives, cryptocurrency industry leaders and federal regulators. He said he would likely rely on Securities and Exchange Commission Chair Paul Atkins and the broader policy team for recommendations.

“Well, it’s been talked about,” Trump said during the event. “I think I’d probably rely on Paul and the whole group for that.”

The president added that he would listen if the group submitted recommendations. He did not announce purchases, name a funding mechanism or provide a timetable for expanding federal cryptocurrency holdings.

Trump did not announce new U.S. Bitcoin purchases

Trump’s comments left open the possibility of further Bitcoin accumulation but did not change existing federal policy. The administration would still need to identify a lawful, budget neutral method before buying additional Bitcoin outside asset forfeiture proceedings.

Trump also claimed cryptocurrency had “taken a lot of pressure off the dollar” and had been “very, very good” for it. He did not provide data or explain the economic mechanism supporting that assessment. The statement therefore represents the president’s view rather than an independently established conclusion.

The comments came during a broader White House event focused on digital asset legislation, market regulation and U.S. technology competitiveness. Trump urged Congress to pass the CLARITY Act and said the administration wanted the country to remain ahead of China in cryptocurrency and other emerging technologies.

SEC Chair Paul Atkins attended alongside Commodity Futures Trading Commission Chair Michael Selig. Executives from Coinbase, Ripple, Robinhood, Kraken and other financial technology companies also participated.

Existing order permits budget neutral accumulation

Trump established the Strategic Bitcoin Reserve through a March 6, 2025 executive order. The reserve was designed to hold Bitcoin finally forfeited through criminal or civil proceedings.

Bitcoin transferred into the reserve cannot be sold and must remain a federal reserve asset, subject to limited legal exceptions. Agencies were also directed to provide Treasury with a full accounting of government controlled digital assets.

The order authorized the Treasury and Commerce secretaries to develop strategies for acquiring additional Bitcoin. Any strategy must remain budget neutral and cannot impose incremental costs on U.S. taxpayers.

As previously reported, Treasury’s existing authority does not include ordering banks to buy Bitcoin. Treasury Secretary Scott Bessent previously told Congress that the government would retain Bitcoin obtained through seizures while considering permitted budget neutral options.

Potential approaches discussed by outside advocates include converting other federal assets or using revenue generated from government holdings. The administration has not formally adopted those proposals.

Other cryptocurrencies face stricter acquisition limits

The March order created a separate U.S. Digital Asset Stockpile for cryptocurrencies other than Bitcoin. Like the Bitcoin reserve, the stockpile initially consists of assets obtained through completed forfeiture cases.

However, federal agencies cannot purchase additional non Bitcoin assets for the stockpile without further executive or legislative action. Treasury may determine whether to retain or sell those holdings under applicable law.

The distinction means Trump’s reference to “Bitcoin or other cryptocurrencies” does not itself authorize purchases. Expanding the non Bitcoin stockpile would require a separate policy decision and potentially congressional approval.

In related coverage, the reserve was initially expected to contain only legally forfeited holdings, since some government controlled cryptocurrency remains subject to victim restitution or unresolved legal proceedings.

What happens next for the Bitcoin reserve

The next development would likely come from Treasury, Commerce, the SEC or the administration’s digital asset working group. A concrete plan would need to specify the amount of Bitcoin, acquisition method, legal authority and safeguards for federal custody.

Atkins could advise the administration on securities regulation and market structure. However, the SEC does not ordinarily manage Treasury reserve assets or conduct federal Bitcoin purchases. Treasury and Commerce hold the explicit acquisition mandate under Trump’s order.

No new executive order, Treasury acquisition notice or congressional authorization accompanied Trump’s remarks. Until one of those actions occurs, the U.S. government’s accumulation policy remains centered on forfeited Bitcoin and possible budget neutral strategies still under consideration.

Cointelegraph is committed to providing independent, high-quality journalism across the crypto, blockchain, AI, and fintech industries.

All news, reviews, and analyses are produced with full journalistic independence and integrity. For more details on our standards and processes, please read our Editorial Policy.

Pakistan’s crypto regulator has formally moved from rulemaking to enforcement by opening its licensing portal for virtual asset service providers (VASPs). The Pakistan’s Virtual Assets Regulatory Authority (PVARA) notified regulations for crypto exchanges and a broader set of virtual-asset activities, setting a deadline for firms already operating in the country to apply for a no-objection certificate (NOC).

Under PVARA’s licensing website guidance, companies providing virtual asset services on or before March 5 must submit their NOC applications by Sept. 5; otherwise, continuing operations without an application will be treated as an offense. The regulator says the window is now “officially open,” laying out standards intended to bring consumer protection, governance, and compliance into the open for regulated market participants.

Key takeaways

• PVARA has opened its licensing portal after notifying the regulations that define how crypto services will be authorized in Pakistan.
• Existing operators have until Sept. 5 to apply for an NOC; operating past the deadline without applying can trigger enforcement.
• The framework covers a wide range of VASP activities, including exchanges, custody, broker-dealer services, lending, derivatives, asset management, token issuance, and mining-related services.
• Licensed providers must segregate customer holdings and face restrictions on lending or pledging those assets without written consent.
• Firms can pursue either a sandbox pathway for product testing or an NOC pathway as they prepare for full licensing.

A licensing regime built for enforcement

PVARA’s move is significant because it converts a regulatory framework into an action-oriented process with clear compliance steps for market participants. In a Saturday press release attributed to the Associated Press of Pakistan, PVARA said operating after the relevant deadline without submitting an application will be considered an offense.

In a separate statement on LinkedIn, PVARA described the launch as creating a “clear pathway” for businesses to enter Pakistan’s regulated virtual asset market. The regulator linked the licensing effort to defined expectations around consumer protection, governance, compliance, and market integrity—areas that typically become central when regulators shift from consultations and policy drafting to supervision and licensing decisions.

Which services fall under PVARA’s framework

The notification outlines a broad scope of activities that VASPs must address in their licensing pathway. According to PVARA’s described framework, it includes services such as exchanges and custody, broker-dealer activities, lending and derivatives, asset management, token issuance, and mining-related services.

PVARA also lays out options for how companies can engage with the regulator before they become fully licensed. The regulator states that providers may seek an NOC prior to incorporating locally, or they can enter a regulatory sandbox to test products under PVARA supervision before applying for full authorization.

That two-track design matters for companies trying to scale operations while navigating compliance requirements. The sandbox approach can reduce time-to-learning for new products, while the NOC pathway offers a structured route for firms preparing to establish a Pakistan-based presence.

Operating rules: segregation, cybersecurity, and AML/CTF controls

PVARA says licensed providers will have to meet specific operational and custody-related requirements. One of the most immediate implications for exchanges and custodial platforms is the requirement to keep customer holdings separate from their own assets.

The framework further restricts how those customer holdings can be used. PVARA states that providers cannot lend or pledge customer assets without written consent, a rule designed to reduce the risk of conflicts between customer interests and a platform’s own balance-sheet needs.

Beyond custody, the regulator’s framework also specifies governance and conduct expectations, cybersecurity requirements, operational resilience measures, and anti-money laundering and counter-terrorism financing controls. For operators, these obligations will likely determine not only whether a license is granted, but also how systems are architected—especially around risk monitoring, incident response, and compliance reporting.

From consultation to notified rules—and what it changes now

The licensing push follows a public consultation that ran from June 11 to July 2. PVARA said the final framework provides two routes to licensing: a sandbox for product testing and an NOC pathway for companies preparing to incorporate in Pakistan.

In practice, this turns previously described standards into enforceable requirements with dates attached. Companies that were waiting for the notified regulations to start applying will now need to treat licensing as a near-term priority, particularly because the NOC application deadline is tied to whether a provider was already offering services in the country on or before March 5.

Notably, PVARA has indicated it already issued NOCs to some firms. The regulatory groundwork includes preliminary approvals that allow certain exchanges to establish local subsidiaries and prepare full license applications—progress that now can move faster now that the rules have been formally notified through the portal process. PVARA’s earlier NOC issuances have included Binance and HTX, as previously reported by Cointelegraph.

How Pakistan’s broader crypto framework is taking shape

PVARA’s ability to run a licensing process stems from Pakistan’s legislative shift earlier this year. Cointelegraph previously reported that Pakistan’s parliament passed the Virtual Assets Act in March, establishing PVARA as the statutory regulator for the sector.

Regulatory coordination has also extended to banking access. Cointelegraph has reported that the State Bank of Pakistan allowed banks to provide accounts to licensed VASPs, including segregated client-money accounts. Combined with PVARA’s new requirements around separation of customer holdings, that creates a clearer compliance stack for licensed providers—addressing both operational custody rules and the banking plumbing required for regulated services.

Still, with licensing enforcement now starting in earnest, companies and users should watch how quickly applications are processed and what additional conditions—if any—are imposed as full licenses are granted. The regulations establish the baseline, but the practical effects will depend on PVARA’s implementation, including how sandbox participants are supervised and how quickly NOCs translate into full licensing.

For market participants, the next phase will likely center on whether existing VASPs can meet the Sept. 5 NOC deadline and how rigorously PVARA assesses custody separation, cybersecurity readiness, and AML/CTF controls. That timeline—and the regulator’s approach to granting first full authorizations—could determine how rapidly Pakistan’s regulated crypto market expands.

Pakistan’s Virtual Assets Regulatory Authority (PVARA) has opened its licensing portal after notifying regulations governing crypto exchanges and other virtual asset service providers (VASPs) operating in the country. 

Companies providing virtual asset services on or before March 5 must submit an application for a no-objection certificate (NOC) by Sept. 5 or cease operations, according to the PVARA licensing website. Operating after the deadline without submitting an application will constitute an offense, PVARA said in a Saturday press release published by the Associated Press of Pakistan.

“The licensing window is officially open, creating a clear pathway for businesses to enter Pakistan’s regulated virtual asset market, with defined standards for consumer protection, governance, compliance and market integrity,” PVARA said on LinkedIn. 

The launch moves Pakistan’s crypto framework from legislation into enforcement, requiring domestic and overseas VASPs to enter the formal licensing process or stop serving the market. 

New regulations clear path to full crypto licenses

The framework covers activities including exchanges, custody, broker-dealer services, lending, derivatives, asset management, token issuance and mining-related services. VASPs can pursue an NOC before incorporating locally or enter a regulatory sandbox to test products under PVARA supervision before seeking a full license. 

According to the press release, licensed providers will be required to keep customer holdings separate from their own assets and cannot lend or pledge them without written consent. The framework also requires covering governance, market conduct, cybersecurity, operational resilience and anti-money laundering and counter-terrorism financing controls. 

The rollout followed a public consultation held between June 11 and July 2. PVARA said the final framework provides two routes to licensing. This includes a sandbox pathway for firms testing new products and an NOC pathway for companies preparing to incorporate in Pakistan.

Related: Pakistan crypto chief seeks dialogue after scholar rules against crypto payments

PVARA has already issued NOCs to some firms, including Binance and HTX in December 2025. The preliminary approvals allow the exchanges to establish local subsidiaries and prepare full license applications, a process that can now advance following the notification of the regulations.

Pakistan’s parliament passed the Virtual Assets Act in March, establishing PVARA as the statutory regulator for the sector. The State Bank of Pakistan subsequently allowed banks to provide accounts to licensed VASPs, including segregated client-money accounts.

Magazine: MiCA cracks down on USDT in Europe… but no one else cares