A painstaking investigation into crypto-focused recruitment tactics has exposed how suspected North Korean IT workers operate when they think they’re joining a legitimate startup. In a ruse carried out over five weeks, researchers built a fictitious company called Ballena Azul and invited suspected operatives to develop software and complete tasks inside controlled virtual environments—allowing analysts to observe their day-to-day tooling, workflows, and infrastructure choices.

As described in reporting by Cointelegraph, the project was designed and executed by Mauro Eldritch, founder of cybersecurity firm BCA LTD, and Heiner García, a cyber threat intelligence analyst at Telefónica Tech and founder of NorthScane. The operation leveraged infrastructure from cybersecurity platform ANY.RUN, and Cointelegraph joined for one stage of the contact with the supposed hiring team.

Key takeaways

• Researchers used a fake crypto startup, Ballena Azul, to study suspected DPRK recruitment and working methods inside controlled virtual desktops.
• One of the most valuable findings was the use of external intermediary servers—some linked to earlier North Korean malware campaigns that were still active.
• The suspected workers often relied heavily on AI tools to compensate for technical gaps and to help with coding, writing, and document manipulation.
• The scheme showed how threat actors can pose as employees to gain access to internal systems, code, and credentials without deploying malware immediately.
• Earlier cases reported by US and industry entities indicate this approach is evolving, spanning remote access strategies and identity manipulation.

From recruitment to “startup” onboarding

The Ballena Azul operation began when García connected with a recruiter via GitHub, after the recruiter was associated with Famous Chollima, a threat group linked to DPRK IT-worker activity. According to García, the startup needed software developers, and the recruiter offered multiple names for candidates—at least two of whom presented US identification.

As the interviews and onboarding progressed, the researchers used aliases to maintain the deception. Eldritch took on the persona of co-founder “Leonardo Nelson,” while García posed as “Andy Jones,” the team lead. Developers were assigned programming tasks inside controlled virtual desktop environments, which enabled the researchers to monitor what tools they reached for, how they responded when problems appeared, and how they handled technical obstacles.

To test the candidates’ responses, the researchers deliberately introduced issues, including selective network outages and changes to user interaction cues such as disappearing mouse cursors. In García’s account, the biggest surprise wasn’t only the tooling—it was the lack of a uniform corporate process. Instead, he described a pattern of improvisation rather than a rigid playbook.

Infrastructure clues and the “reuse” problem

Beyond the day-to-day behavior of the operatives, the investigation highlighted the role of infrastructure “in-between” moments. During the ruse, analysts identified external servers that acted as intermediary points before suspected workers connected to the controlled virtual desktops used by the researchers.

García told Magazine that some of those servers were associated with malware families tied to prior North Korean campaigns, including InvisibleFerret and BeaverTail/OtterCookie. He said at least some of the intermediary servers were still active, suggesting that operational components can remain in use for extended periods—an issue that matters for defenders because long-lived infrastructure increases the window for compromise and detection evasion.

At the same time, García noted that other servers appeared entirely new from an intelligence perspective, “clean” and not previously documented in mainstream threat feeds or blocklists. That combination—some reuse of known infrastructure alongside previously unseen resources—underscores why investigations focused only on established indicators may miss portions of an operation.

“Some of the servers we found were tied back to distributing InvisibleFerret and BeaverTail/OtterCookie in prior years and were active to this day,” García said, adding that others were not previously tied to intelligence tracking.

AI-assisted impersonation and credential theft risk

The working environment also revealed how the operatives attempted to maintain productivity. The researchers found extensive use of AI tools for coding and other tasks that candidates struggled to complete on their own. According to García, they used ChatGPT for writing and coding, including help answering basic questions and finishing assignments. For image alteration and document forgery, García said the group showed a preference for Google Gemini.

The investigation also documented the wider operational toolkit suspected workers used: remote desktop software, crypto wallets, and services designed for sharing two-factor authentication codes. The implication is not simply that these actors can deploy malware, but that they may not need to—once hired, they can use legitimate access to reach sensitive internal information. Researchers described the long-term advantage as well: staying undetected allows threat actors to collect salaries for as long as they remain in place, which can support DPRK funding objectives.

Cointelegraph’s reporting situates this in a broader pattern of AI adoption across DPRK-linked activity. The same piece points to Reuters reporting that another North Korean hacking group, Kimsuky, uses AI locally to automate parts of cyberattacks and generate more convincing phishing materials. While those accounts involve different operators and likely different goals, together they suggest a trend toward integrating generative tools into cyber workflows.

How the ruse unraveled—and what stayed hidden

After weeks of tasks inside the controlled environments, researchers staged an internal disruption to force the operatives to react. They introduced a new persona—“Benito Camella,” a co-founder who supposedly had been busy in Milan while hiring accelerated. When Camella “returned,” the confrontational sequence was meant to expose inconsistencies in identity and documentation.

During the confrontation, the chat room rapidly emptied. One developer, Espree, left the video call first, while another, Anderson, stayed longer before realizing the scheme was collapsing. Even after the meeting ended, the researchers maintained the facade through company communications: the fake CEO accused “Andy Jones” of bringing in “illegal workers,” and “Jones” responded that he was pressured to build quickly and believed he was not being compensated adequately.

That staged dispute ended with “termination” of the working relationship and friendship, framing the collapse as the result of a hiring disaster. Afterward, one suspected operative contacted García privately to apologize and check whether he was okay. Researchers said they never heard from the rest of the group again, and—importantly—believe the operatives remained unaware that they had spent weeks helping analysts extract intelligence.

Why this matters for crypto and broader cybersecurity

North Korea-linked IT-worker schemes have increasingly been linked to threats against the cryptocurrency sector and beyond. Cointelegraph notes industry and government-linked reporting that shows how these operations can involve recruiting developers through intermediary channels, using remote-access pathways to appear legitimate, and targeting organizations for access to internal systems and sensitive data.

Earlier examples referenced in the same reporting include ConsenSys’ statement in July that it engaged a North Korea-linked developer through a third-party service provider before cutting off access. The piece also highlights a US Justice Department case alleging nearly $1 million in cryptocurrency theft by four North Korean nationals charged in connection with remote job fraud using false identities. Separately, the US Treasury has stated that North Korean IT-worker schemes generated nearly $800 million in 2024 to support the regime’s weapons-of-mass-destruction programs.

For crypto investors, operators, and builders, the practical takeaway is that supply-chain and workforce risk remains as relevant as direct hacking. Even without an immediate malware payload, credential exposure and internal access can provide a pathway to funds and sensitive operational data—especially when attackers use “legitimate work” as cover for months-long persistence.

As defenders analyze what the Ballena Azul ruse exposed—especially intermediary server reuse and AI-enabled workflow patterns—the next step for organizations will be to tighten verification and monitor remote-access and identity controls continuously, not only when known indicators appear. The most uncertain element for now is how quickly threat actors will adapt their operational tooling and infrastructure in response to investigations like this one.

Milwaukee County Executive David Crowley has won the Democratic primary race for Wisconsin’s governorship, toppling his Democratic socialist opponent, Francesca Hong, who had surged in the polls leading up to Tuesday.

What turned out to be a razor-thin contest wasn’t called by the Associated Press until early Wednesday morning, after a delay in tabulating votes from Milwaukee. Earlier in the night, Hong had urged her supporters to unite behind the eventual winner for the November general election against Republican nominee, Rep. Tom Tiffany, who has been backed by President Donald Trump. “No matter who’s on this ballot, y’all, we are going to fight to win for one another,” Hong said.

Crypto.com has launched tokenized stock derivatives tied to 1,500 U.S. equities and ETFs, giving eligible users access to the products from $1 with trading available around the clock.

According to Crypto.com’s official announcement on Wednesday, the Tokenized Stocks offering is available through its app to eligible users in the European Economic Area and other approved jurisdictions, with products tracking companies including Nvidia, Tesla and Apple.

The initial selection also covers exchange-traded funds such as SPDR Gold Shares and iShares Silver Trust, which provide exposure to gold and silver, respectively. Crypto.com said the products support fractional positions, fast settlement, and 24/7 trading outside the normal hours of U.S. stock exchanges.

Unlike buying shares through a traditional broker, however, Crypto.com users are not purchasing the underlying stocks. The Tokenized Stocks are derivative financial instruments designed to follow the price performance of the corresponding equities or ETFs.

As a result, holders do not receive legal or beneficial ownership of the securities or the shareholder rights attached to them. Eligible users may instead receive dividend-equivalent adjustments under the terms of the products.

Crypto.com tokenized stocks provide synthetic U.S. equity exposure

The structure means a Tokenized Stock referencing Apple is designed to move with the underlying Apple share price without turning the buyer into an Apple shareholder.

Crypto.com said the underlying assets supporting its Tokenized Stocks are held in custody with Alpaca, a U.S.-regulated self-clearing broker-dealer. According to the exchange, Alpaca provides infrastructure supporting more than 90% of the tokenized U.S. stock and ETF market.

The products are issued by Foris Capital CY Limited, the entity behind Crypto.com’s regulated investment services in Europe. Crypto.com acquired the Cyprus-based firm in May 2025, securing a Markets in Financial Instruments Directive license that allowed it to expand its regulated financial product offering across the European Economic Area.

Alongside 24-hour access, the exchange is offering zero-commission Tokenized Stocks trading to eligible users for a limited introductory period. Crypto.com cautioned that other foreign-exchange charges or spreads can still apply.

Kris Marszalek, co-founder and CEO of Crypto.com, described the product as another part of the company’s multi-asset strategy, saying users would receive “instant access to U.S. equity and ETF exposure.”

“Money never sleeps. Market access shouldn’t either,” Marszalek said.

The launch takes Crypto.com further outside its core cryptocurrency trading business as crypto platforms compete for users who want stocks, commodities and digital assets through the same trading interface.

Tokenized stock platforms are using different ownership models

Crypto.com’s derivative structure is one of several models now being used to offer stock exposure through crypto platforms.

Some products provide synthetic exposure to the price of a security, while other structures tokenize securities backed by actual shares and can preserve ownership rights attached to the underlying asset. The distinction determines whether a holder owns a security or simply holds an instrument designed to follow its price.

In June, Binance launched its bStocks product with tokenized versions of Nvidia, Tesla, Circle, Micron and SanDisk. The exchange said those assets are backed 1:1 by underlying U.S. securities and can be converted into direct stock positions without conversion fees.

Robinhood followed with another structure in July when it launched the public mainnet of its Ethereum Layer 2 network alongside tokenized stock trading. As crypto.news previously reported, eligible Robinhood Wallet users across more than 120 countries were given access to tokenized equities through supported decentralized exchanges.

Backpack also entered the market in July with 24/7 trading for tokenized U.S. stocks across more than 150 countries. Its tokenized stock offering was launched with direct ownership of selected equities and instant settlement, including exposure to companies such as SpaceX, Micron, and SanDisk.

The different structures have made ownership rights an important part of the tokenized equity market. Derivative products can follow the economic performance of a stock without transferring shareholder status, while tokenized securities can be structured to carry claims and rights associated with the underlying shares.

Tokenized equities draw more crypto platforms

Demand for onchain equity products has increased as exchanges, wallets, and tokenization companies add U.S. securities for investors outside the United States.

RWA.xyz data cited in the supplied report put the tokenized stock market at about $2.49 billion, representing an increase of roughly 600% over the previous year. Citi has estimated that tokenized securities could become a $5.5 trillion market by 2030, including about $2.6 trillion in tokenized equities.

Crypto trading firms have also started expanding how tokenized stocks can be used after purchase rather than limiting them to simple price exposure.

In July, Kraken allowed eligible users to use 10 xStocks assets as collateral for futures and margin trading on Kraken Pro. The collateral expansion lets traders support leveraged cryptocurrency positions with selected tokenized stocks and ETFs without first selling those holdings.

Bitget Wallet had already integrated more than 130 xStocks products in May, adding U.S. equities and ETFs to the same self-custodial interface used for crypto storage, swaps and trading. Other platforms, including Bybit, have also introduced forms of tokenized equity exposure for users outside the United States.

The market has consequently developed beyond one standard product design, with platforms using derivatives, fully backed tokens, custodial structures and blockchain-based securities to provide different forms of stock exposure.

Traditional market operators test tokenized securities

Established U.S. securities infrastructure providers are developing their own systems as crypto platforms add tokenized stocks.

The Depository Trust & Clearing Corporation has been working on a regulated tokenization service covering securities held in Depository Trust Company custody. In May, crypto.news reported that more than 50 traditional finance and crypto firms had joined a DTCC industry working group, including BlackRock, Goldman Sachs, JPMorgan, Morgan Stanley, Circle, Robinhood, Ondo Finance, Nasdaq and NYSE Group.

DTCC said potential assets for its tokenization work include Russell 1000 stocks, major index ETFs and U.S. Treasury securities. The Depository Trust Company received a no-action letter from the U.S. Securities and Exchange Commission in December 2025 allowing it to provide a defined tokenization service to participants and their clients for three years.

The infrastructure provider subsequently selected the Stellar public blockchain as part of its multi-chain strategy for tokenized securities. Under the plan announced in May, DTC custody assets eligible for tokenization include Russell 1000 components, major index ETFs, U.S. Treasuries and certain corporate and other bonds, with deployment on Stellar targeted for the first half of 2027.

NYSE has separately filed a proposed rule change with the SEC that would allow eligible tokenized securities to trade alongside traditional shares on the same exchange order book. Under the proposal, eligible tokenized assets would retain the same ticker, CUSIP, rights and privileges as their conventional counterparts, while clearing and settlement would continue through DTC.

US Senate Majority Leader John Thune has moved the Digital Asset Market Clarity (CLARITY) Act toward a potential September floor vote by filing for cloture just before the chamber left for a month-long recess, according to Cointelegraph’s earlier reporting. The bill is widely seen as a key attempt to formalize crypto market rules, but advocates say the path to enactment remains narrow as senators return with limited calendar time before multiple breaks tied to the November election.

The Senate is scheduled to come back from recess on Sept. 14. Even if lawmakers manage to schedule a cloture vote in September, they would have only about two weeks in session before another pre-election recess—and then a further stretch of time ending near the end of the year. In that compressed window, lawmakers would still need to resolve several disputed provisions rather than simply advancing the bill as-is.

Key takeaways

• John Thune filed for cloture to advance the CLARITY Act after the Senate broke for a month-long recess, setting up a possible September procedural vote.
• The Senate’s return on Sept. 14 leaves a short session window—about 14 days—before additional election-related recesses.
• Major sticking points reportedly include ethics language tied to President Donald Trump’s digital asset relationships and added restrictions around stablecoin rewards offered by crypto firms.
• If CLARITY stalls, regulators such as the SEC and CFTC have signaled they may proceed with rulemaking rather than waiting for Congress.

A rushed legislative runway after a long wait

Congress took more than a year to reach this point. Cointelegraph notes that the Senate had 13 months to consider the CLARITY Act after it was passed by the House last year. During that period, lawmakers faced political and procedural disruptions, including more than one government shutdown, while industry groups pushed for clearer market rules and some Democratic lawmakers raised concerns that earlier versions could enable what they described as “crypto corruption.”

Thune’s cloture filing is intended to keep momentum going, but it doesn’t eliminate the practical challenge: even under the best-case timeline, senators would still need to settle outstanding issues quickly. According to Cointelegraph, those issues include ethics-related provisions affecting the US president’s ties to digital assets and additional restrictions on crypto companies offering stablecoin rewards.

That matters because procedural progress does not guarantee final passage. Should the Senate attempt a September cloture vote, the bill would still face the reality of remaining only a matter of days to address unresolved language before the chamber breaks again for the pre-election period.

Uncertainty grows around the November election

Even if the Senate clears procedural hurdles in September, election politics could complicate negotiations afterward. Cointelegraph’s reporting highlights that after November—when 33 Senate seats and all 435 House seats would be up for election—members of Congress could shift priorities or face turnover, potentially pushing resolution into the next legislative cycle.

For crypto market participants, that uncertainty is not just about timelines. Regulatory certainty can affect everything from compliance planning to product rollouts and institutional participation. When legislation is left in limbo, firms often continue to operate under existing frameworks—or in some cases under enforcement risk—until Congress or regulators provide clearer boundaries.

Regulators signal they won’t wait indefinitely

As the CLARITY Act remains in limbo for at least another month, attention is turning to regulators that can act without waiting for Congress to pass the bill. Cointelegraph notes that financial agencies such as the Commodity Futures Trading Commission (CFTC) and Securities and Exchange Commission (SEC) have been publicly signaling their readiness to move.

The legislation is expected to expand the CFTC’s authority to oversee and enforce rules affecting digital assets. But with the bill still under consideration, both agencies have suggested they can proceed with their own regulatory approaches if Congress does not act.

In a July interview reported by CNBC, SEC Chair Paul Atkins said the agency was “ready, willing, and able to come out with rules” to address crypto if Congress fails to pass CLARITY. Earlier, in April, CFTC Chair Michael Selig told Cointelegraph that the commission was “ready to take responsibility” for overseeing crypto markets, referencing lawmakers passing the market structure bill.

Cointelegraph also points to coordination efforts between the agencies. The SEC and CFTC have reportedly taken steps to align oversight across financial markets, a sign that regulators are attempting to reduce duplication and inconsistent enforcement even when the legislative endgame remains uncertain.

What still needs to be solved in the bill

While supporters view CLARITY as a path to clearer rules for market structure, the bill’s most contentious elements appear to remain unresolved. Cointelegraph highlights two areas of debate: ethics language tied to President Donald Trump’s digital asset relationships, and additional restrictions for crypto companies offering stablecoin rewards.

These issues are consequential in different ways. Ethics provisions can determine how lawmakers structure guardrails around public officials’ exposure to digital asset activities, while stablecoin-reward restrictions could affect product design and customer incentives for certain crypto platforms. Both types of provisions can influence whether companies believe a bill would improve predictability—or instead impose new constraints.

For investors and builders, the practical takeaway is that even a “September vote” scenario may not be sufficient by itself. What will matter is whether senators can agree on the remaining language quickly enough to complete the legislative path before recesses and election-related disruptions narrow the window further.

As Sept. 14 approaches, market watchers should focus less on the idea of a vote being scheduled and more on whether negotiators can close the gaps on the ethics and stablecoin-reward provisions—because if CLARITY slips, the SEC and CFTC have already signaled that rulemaking may not wait for congressional resolution.

Binance Chief Security Officer Jimmy Su said current quantum computers cannot break the cryptography protecting major digital assets, including Bitcoin and Ethereum, while warning that the industry needs to prepare before that changes. 

Su addressed the issue in an Aug. 11 Binance post covering five common questions about quantum computing.

Su said “current quantum computers are nowhere near the scale and reliability needed to break the cryptography protecting digital assets.” He described quantum computing as a long term security concern rather than an immediate threat to users.

Google research lowered the estimated quantum resources needed

The concern centers on Shor’s algorithm, which a sufficiently capable quantum computer could use to solve the mathematical problem behind elliptic curve cryptography. In theory, an attacker could derive a private key from an exposed public key and forge transactions. No quantum computer capable of doing that currently exists.

Google Quantum AI sharpened the debate in March. Its research estimated that breaking a 256 bit elliptic curve could eventually require fewer than 500,000 physical qubits and take minutes under specified hardware assumptions. That represents roughly 20 times fewer physical qubits than an earlier estimate, reflecting algorithmic improvements rather than a comparable leap in existing quantum hardware.

Su said “we’re talking about quantum now not because there’s an emergency today, but because waiting until there is an emergency could be much too late.”

Binance says ordinary security threats remain more urgent

For users, Binance is not recommending an immediate change in custody practices because of quantum computing. Su said phishing, malware, social engineering, compromised credentials and weak wallet security remain more immediate threats. He advised users to protect recovery phrases, use trusted software, keep applications updated and avoid unnecessary address reuse.

Su also cautioned against adopting untested products simply because they advertise themselves as quantum proof. 

“You could actually introduce more security risk today trying to protect yourself against a future threat,” he said. 

Binance said it is monitoring quantum developments and evaluating post-quantum security standards while preparing its infrastructure for eventual blockchain migrations.

Post-quantum work is already moving beyond research

The cryptographic tools needed for that transition already exist. The U.S. National Institute of Standards and Technology finalized ML-KEM, ML-DSA and SLH-DSA in 2024 and says organizations should begin migrating toward quantum-resistant cryptography now. Its current standards roadmap targets the eventual removal of vulnerable algorithms from NIST standards by 2035.

Crypto companies are also funding Bitcoin work. As previously reported, Strategy, BlackRock, Coinbase and six other firms pledged $15 million over three years to Bitcoin security research, with post-quantum cryptography among the consortium’s priorities. Galaxy separately committed up to $5 million for Bitcoin quantum readiness research and developer grants.

Ethereum is moving in the same direction. Its updated technical roadmap has moved quantum security higher among its development priorities, while researchers are testing account-level post-quantum protections.

Sui has gone further by announcing specific deployment targets. Its Aug. 6 roadmap plans quantum-safe vaults for mainnet in 2026, ML-DSA-65 accounts on testnet by year-end and native post-quantum account authentication on mainnet in the first quarter of 2027. The dates remain subject to audits and testing.

What happens next for crypto quantum security

The harder issue may be migration rather than designing algorithms. Bitcoin, Ethereum and other decentralized networks would need developers, wallets, exchanges, custodians and users to coordinate changes without stranding funds protected by older cryptography. Questions also remain over how networks should handle dormant or lost coins that cannot migrate voluntarily.

For now, Binance says no emergency action is required from ordinary holders. The industry’s growing research funding and network roadmaps instead point toward a gradual transition intended to finish before cryptographically relevant quantum computers become practical.

Bitwise Asset Management has cut 14% of its workforce, reducing its global team to about 155 employees as the crypto asset manager operates through a prolonged market downturn.

According to recent media reporting Bitwise CEO Hunter Horsley confirmed the layoffs in an emailed statement, saying the staff reduction was completed last week and leaves the company positioned to continue expanding its business.

Horsley said the adjustment “equips us well for the ongoing growth we’ve seen this year and expect to continue as crypto further integrates into the global economy.”

Bitwise layoffs reduce global team to about 155

The 14% reduction means Bitwise entered August with a smaller workforce even as the company continued building its investment and staking businesses.

Market conditions have put pressure on some of the products managed by the firm. The Bitwise 10 Crypto Index Fund, or BITW, recorded a 31% drop in net assets during the first seven months of 2026, according to data cited by The Block.

BITW provides exposure to a basket of major cryptocurrencies, making the decline in its assets one measure of how the prolonged downturn has affected investment products tied directly to crypto prices.

Bitwise has continued launching and operating products despite the weaker market. In May, the company’s Hyperliquid exchange-traded fund recorded about $19 million in inflows during a single trading day, its largest daily inflow at the time.

Horsley said the fund generated roughly $22 million in trading volume that day, meaning most of the activity came from purchases. As previously reported by crypto.news, the Bitwise Hyperliquid ETF had launched on the New York Stock Exchange on May 15 with a 0.34% sponsor fee, which was waived for the first month on the first $500 million in assets.

Demand has also emerged for some of the company’s other altcoin products. In June, Horsley said Bitwise’s XRP exchange-traded products in the U.S. and Europe had collected more than $200 million in inflows since the beginning of 2026.

The inflows came while Bitwise continued expanding the range of regulated crypto investment products it offers, even as falling digital asset prices weighed on parts of its existing portfolio.

Acquisitions continue despite weaker crypto conditions

Alongside its fund business, Bitwise has used acquisitions to add services for institutional crypto investors.

In February, the asset manager completed its acquisition of Chorus One, an institutional staking provider. The transaction expanded Bitwise’s staking operations at a time when the company was continuing to build services beyond its core crypto investment products.

The workforce reduction therefore follows a period in which Bitwise has been adding businesses and launching investment vehicles while managing the effects of lower crypto prices.

Earlier in February, Horsley disclosed that one Bitwise wealth management client invested $11 million in Bitcoin during a market correction after spending roughly two years in contact with the company without previously buying crypto.

As covered in a February crypto.news report, Horsley said the purchase represented the client’s first crypto investment and argued that some institutional and high-net-worth investors were treating lower prices as an entry opportunity rather than simply reducing their exposure.

Bitwise’s latest staff cuts, however, place the company alongside several other crypto businesses that have reduced headcount during 2026.

Crypto layoffs have continued through 2026

In June, crypto custody and infrastructure company BitGo cut nearly 15% of its workforce as it redirected resources toward security, trading, stablecoins, settlement and artificial intelligence infrastructure.

BitGo CEO Mike Belshe described the reduction as a one-time action and said the company did not expect further cuts. The firm’s 2025 annual report listed 603 full-time employees at the end of that year, meaning a 15% reduction based on that figure would represent roughly 90 positions.

The company continued recruiting for selected positions after the cuts, with 51 roles listed across engineering, compliance, finance, sales, security and other departments. BitGo had also entered the public market in January after pricing its initial public offering at $18 per share and raising about $212.8 million. The June staff reduction came as its shares remained well below the IPO price.

Coinbase made a similar reduction in May, announcing plans to cut about 14% of its workforce while lowering costs during weaker crypto market conditions.

CEO Brian Armstrong linked the decision to both the market cycle and the company’s increased use of artificial intelligence. He said smaller teams were able to complete work faster with AI tools and outlined plans to limit the organization to five management layers below the CEO and chief operating officer.

Coinbase also planned to remove roles focused solely on management and test smaller teams in which employees could work across product, design and engineering functions. Coinbase announced the cuts while continuing to develop new products and expand its use of internal AI systems.

Kraken also reportedly cut around 150 positions in May as the exchange increased its use of AI across its operations. Bloomberg reported that the reductions could affect the timing of Kraken’s planned U.S. public listing, potentially pushing it into 2027.

Dune Analytics reduced its workforce by 25% during the same month, with CEO Fredrik Haga citing AI tools as the main reason for the restructuring while the blockchain data company concentrated resources on its core products.

Polygon Labs followed with another round of layoffs in July while working to complete its acquisition of Coinme and reorganizing its business around payments. The company had already been building a payments operation around Coinme, Sequence and its Open Money Stack after spending more than $250 million on the Coinme and Sequence deals.

Bitwise CIO sees signs of a Bitcoin bottom

While Bitwise has reduced staff, its investment team has remained positive about the direction of the crypto market.

Bitwise Chief Investment Officer Matt Hougan told Bloomberg on Tuesday that Bitcoin’s reaction to recent negative developments could mean the bear market has already reached its bottom.

Hougan pointed to Bitcoin’s ability to hold up despite delays involving the CLARITY Act and Bitcoin sales by Strategy. His view followed a July episode in which Bitcoin recovered after Strategy disclosed the sale of 3,588 BTC for about $216 million.

Horsley responded to that recovery at the time by writing that “Bitcoin wants to be higher.” Bitcoin had briefly fallen before moving back toward the $63,000 area, while Strategy said the sale was used to fund dividends tied to its Digital Credit securities.

Hougan also told Bloomberg that large wealth management platforms could become the “quiet catalyst” for the next crypto bull market, placing institutional distribution among the factors he expects to influence the market after the current downturn.

H100 Group appointed Peter C. Warren as chief investment officer on Aug. 12, placing the veteran markets executive in charge of derivatives and risk management after the Swedish company nearly tripled its Bitcoin treasury through a Norwegian acquisition, according to a release.

Warren previously managed approximately 2,450 BTC with H100 Chief Executive Eirik Grøttum through Moonshot AS and PDI AS. Those businesses entered H100 two days earlier when the company completed its acquisition of NSD AS, bringing 2,455.37 BTC into the group and raising total holdings to 3,506.4 BTC.

Warren will lead H100’s Bitcoin derivatives strategy

The group said Warren will develop its derivatives investments and risk management capabilities, including the active strategy operated through PDI. The company says that strategy is intended to preserve capital, manage downside risk and generate additional cash flow while maintaining exposure to Bitcoin.

Warren has more than 45 years of capital markets experience as a trader, market maker, fund manager and chief investment officer, according to the group. He said the objective is to “manage risk and generate additional cash flow while retaining exposure to Bitcoin’s long-term potential.” That is the company’s stated investment objective rather than a promised return.

Appointment follows H100’s 2,455 BTC acquisition

As previously reported, H100 completed its acquisition of 2,455.37 BTC on Aug. 10 through its purchase of NSD AS, which owns Moonshot and PDI. The transaction raised the company’s treasury to 3,506.4 BTC from roughly 1,051 BTC and brought Warren’s existing investment management work inside the listed group.

The group paid no cash for the acquisition. It issued 790,534,666 new shares to the sellers at SEK 1.86 each, creating roughly 70% dilution based on the share count when the deal closed. The group said basic sats per share were unchanged because the transaction used a Bitcoin for Bitcoin valuation, while fully diluted sats per share increased about 5%.

The transaction was completed at 1.0x mNAV using a July 31 Bitcoin reference price of SEK 598,926.69, or about $62,900. The target had no outstanding financial debt, according to the group. Principal seller Geir Harald Hansen also agreed to a 12 month lockup on his consideration shares, subject to specified exceptions.

The enlarged treasury was worth about $223 million at Bitcoin’s price near $63,637 on Wednesday. The company has built the position rapidly since its first treasury purchase in May 2025. It later raised $54 million for its Bitcoin treasury strategy and cross listed its shares in Frankfurt.

H100 shares had already advanced before Warren’s appointment. S&P Global Market Intelligence data show the stock closed at SEK 1.198 on Aug. 11, up 11.55%, after gaining 11.99% on Aug. 10. Those moves followed the acquisition announcement and preceded Wednesday’s CIO news.

Shareholders will vote on Warren’s board seat August 28

Warren’s executive appointment comes one day after the group called an extraordinary general meeting for Aug. 28. Shareholders representing more than 10% of the company’s shares and votes have proposed electing Warren, Geir Harald Hansen, Donald Ewer and Daniel Nyberg as new directors, while re-electing Sander Andersen as chairman, according to the notice.

The notice says Warren owns 2,472,692 H100 shares, including shares issued through the Aug. 10 transaction. It classifies him as dependent on both company management and major shareholders because he is an H100 employee and sits on the board of majority shareholder Geir Harald Hansen’s family office.

For the meeting, shareholders must be entered in the Euroclear Sweden register by Aug. 20 and notify H100 of participation by Aug. 24. The company also expects the 790.5 million consideration shares from the NSD acquisition to begin trading on NGM Nordic SME as soon as practicable.

The next test for the strategy will be how the company deploys PDI’s derivatives capabilities across its larger treasury. The company has not disclosed specific options positions, target yields or risk limits. Any cash flow or downside protection from the strategy will therefore depend on future execution and market conditions.

The U.S. Commodity Futures Trading Commission (CFTC) has invoked emergency authority to keep prediction market operator Kalshi running, arguing that New York’s efforts to restrain the platform amount to a market emergency. In an order issued Tuesday, the regulator said the federal government must ensure continuity in derivatives markets and prevent a “patchwork” of state rules from disrupting national price discovery.

The move keeps Kalshi operating while a separate legal fight continues over whether federal law—specifically the Commodity Exchange Act—preempts state gambling enforcement when event contracts are traded on federally regulated venues.

Key takeaways

• The CFTC ordered Kalshi to continue operating, citing an emergency created by New York’s request for a temporary restraining order.
• New York argues Kalshi is operating an illegal, unlicensed gambling business tied to sports, elections, culture, and other events, seeking substantial damages.
• The CFTC says the Commodity Exchange Act requires a uniform national derivatives market and gives it exclusive jurisdiction over certain transactions involving swaps on designated contract markets.
• The dispute is ongoing and does not resolve whether federal law preempts New York’s gambling enforcement.
• The CFTC said it is litigating similar jurisdictional questions beyond New York, including cases involving eight other states.

CFTC emergency order keeps Kalshi live

In the order, the CFTC said New York’s enforcement action and the state’s request for a temporary restraining order together triggered what the agency characterized as a market emergency. The regulator directed Kalshi to keep operating under its normal practices and in line with the Commodity Exchange Act’s core principles.

Importantly, the CFTC emphasized continuity in trading. It argued that major disruptions can undermine orderly markets and impede price discovery—especially in derivatives markets meant to function as a cohesive national system.

CFTC Chair Michael Selig said Congress did not intend derivatives exchanges to face a fragmented set of state gaming rules. The commission tied its emergency authority to concerns that a state-by-state approach could destabilize federal derivatives oversight.

New York’s restraining order seeks nationwide operational limits

New York’s request, as described by the CFTC, would bar Kalshi from operating in connection with contracts tied to sports, culture, elections, and other events in or from New York or directed to people in the state. The CFTC warned that because Kalshi is based in New York, the restrictions could effectively prevent the platform from offering all event contracts nationwide.

According to the CFTC, New York is seeking at least $36 billion in compensatory damages pending an accounting. The underlying state lawsuit, filed July 31, alleges Kalshi runs an illegal, unlicensed gambling business through its event-linked contracts. New York seeks restitution, disgorgement, damages, and penalties, including a penalty equal to three times Kalshi’s alleged gains and $100,000 for each unauthorized sports wagering offer or attempt in New York.

New York’s case reflects a broader theory that state gambling law applies to prediction-market style contracts—an issue that has become a central legal battleground for the emerging event-contract space.

Federal preemption and the jurisdiction fight

Kalshi has argued that states cannot shut down a federally licensed exchange. The CFTC, by contrast, maintains that the Commodity Exchange Act gives it exclusive jurisdiction over transactions involving swaps traded on designated contract markets, including event contracts that Kalshi lists as swaps.

This is not a new legal question. In a separate New York case, a federal judge denied Kalshi’s request for a preliminary injunction on July 7. At that stage, the judge found that New York gambling laws were not preempted by the Commodity Exchange Act as applied to Kalshi’s sports-event contracts.

Previously, the CFTC also sued New York in federal court in April, seeking to block the state from applying its gambling laws to CFTC-registered contract markets. In that earlier action, Judge Jed Rakoff denied without prejudice the agency’s emergency request for a temporary restraining order. The court found the CFTC had not shown a high likelihood of success on the merits or a likelihood of irreparable harm.

While Tuesday’s order directs Kalshi to continue operating, it does not decide the underlying jurisdictional dispute. The CFTC itself characterized the order as separate from a final judicial determination on whether federal law preempts state enforcement.

A nationwide regulatory dispute across multiple states

The Kalshi controversy is also being framed by the CFTC as part of a broader effort to defend federally granted authority. The agency said in its order that it has sued eight other states in addition to New York to protect what it views as congressionally granted jurisdiction.

That means the outcome of the Kalshi litigation could carry implications beyond a single company. If courts ultimately endorse the CFTC’s preemption theory, state regulators may face tighter limits when attempting to apply gambling statutes to event contracts traded on designated contract markets. If courts reject that position, enforcement could become more decentralized, potentially pushing operators to navigate divergent state regimes.

For market participants—exchanges, traders, and institutions—the practical stakes are straightforward: disruptions to listings, contract availability, or trading access can directly affect liquidity and price formation. The CFTC’s focus on “orderly trading and price discovery” suggests the regulator is trying to prevent a compliance or shutdown cascade while the legal questions play out.

For Kalshi and similarly structured platforms, the key uncertainty remains judicial. Tuesday’s CFTC order preserves operations in the short term, but it does not substitute for a court ruling on the scope of federal preemption versus state gambling enforcement.

Readers should watch next for how courts handle the preemption question on the merits and whether any additional federal or state rulings narrow (or expand) what event-contract platforms can offer during the litigation. The emergency posture may keep the platform running for now, but the core jurisdictional disagreement is still unresolved.

Strategy CEO Phong Le says the firm plans to resume adding Bitcoin later this year, even after recent asset sales that have triggered renewed scrutiny from investors and market observers.

In a Monday interview with FOX Business, Le said Strategy purchased about 175,000 BTC since the start of the year while selling roughly 7,000 BTC, describing the activity as “about 25 times more” buying than selling. He also said Strategy has moved from being the world’s second-largest institutional Bitcoin holder to the largest.

Key takeaways

• Strategy says it intends to restart accumulating Bitcoin later this year, after a year-to-date pattern of heavy net buying.
• According to Le, Strategy bought ~175,000 BTC since January and sold ~7,000 BTC year-to-date—netting a large imbalance toward accumulation.
• The company has sold Bitcoin on four occasions since May, with the latest reported sale totaling 1,690 BTC.
• BitcoinTreasuries.NET data suggests public companies collectively hold more BTC than exchange-traded products and other funds, but the treasury “premium” financing model is under strain.

A pledge to buy more, after sales drew questions

Le told FOX Business that Strategy expects to “get back to buying more Bitcoin throughout the course of the year.” That statement comes after the firm shifted part of its approach—at least temporarily—from its long-standing narrative of avoiding Bitcoin sales whenever possible.

While Strategy’s sales have remained small relative to its total stash, the decision to sell has been closely watched because it represents a departure from the “never sell” stance that helped establish its credibility with long-term Bitcoin-focused shareholders.

Strategy has accumulated more than 840,000 BTC, but it has reportedly sold Bitcoin on four occasions since May. The most recent sale, according to the interview context, totaled 1,690 BTC. Le’s broader argument appears to be that the company can still prioritize net accumulation while meeting other corporate obligations.

Why Strategy’s sales matter to investors

Even limited selling can have outsized signaling effects for a company built around a Bitcoin treasury strategy. The concern is not only about the immediate numbers, but about what the sales suggest regarding internal trade-offs.

The proceeds from Strategy’s recent Bitcoin sales have been used to support preferred stock dividends, share repurchases, and its U.S. dollar reserve. That mix highlights a core tension for any public company holding large BTC reserves: management must balance capital preservation and growth with shareholder payouts, equity-market expectations, and liquidity requirements.

Le’s “25 times more” framing underscores that Strategy’s year-to-date behavior still leans toward accumulation. However, the very fact that the company has made multiple sales since May suggests conditions have required more flexibility than the firm’s earlier messaging implied.

Earlier coverage from Cointelegraph noted that Strategy’s earlier capital and balance-sheet approach aimed to preserve Bitcoin exposure while also addressing returns to shareholders, including through a capital framework designed to fund dividends. The latest remarks reinforce that Strategy is trying to maintain that direction while navigating the pressures of public-company financing constraints.

The broader corporate treasury model faces a tougher environment

Strategy’s challenge fits into a larger pattern across the corporate Bitcoin treasury sector. Corporate holdings have continued to grow, but weaker market conditions make the traditional economics of the model harder to sustain.

According to BitcoinTreasuries.NET, public companies hold more than 1.26 million BTC, while trailing exchange-traded funds and other funds hold more than 1.6 million BTC. The size of the holdings suggests institutional accumulation remains active, but it does not automatically solve the capital question that determines how quickly companies can keep buying.

NOVAQUE Research has previously described the financing cycle that powered rapid expansion: when Bitcoin treasury companies traded at premiums to the net asset value of their BTC holdings, they could raise capital through equity or debt and then deploy proceeds to purchase more Bitcoin. That premium effectively reduced the dilution cost for shareholders because the market was valuing the companies above the value of their BTC.

In more difficult market regimes, that cycle becomes harder to maintain. When shares trade below net asset value, new fundraising can dilute existing holders more than it would in a premium environment—making continued aggressive accumulation financially less straightforward. Cointelegraph previously noted this shift in market dynamics in an analysis of how trade and holdings trends have changed for funds and BTC-holding entities.

What to watch next for Strategy

Strategy’s stated plan to resume accumulating Bitcoin later this year will likely be judged against two practical signals: whether future BTC purchases appear to outweigh any continued liquidity needs, and whether management’s willingness to sell—however small—persists as market conditions evolve. With the corporate treasury model sensitive to share-price-to-NAV dynamics, investors may also watch whether Strategy can keep access to capital on terms that don’t force meaningful dilution.