Fidelity is preparing to add staking and quarterly cash payouts to its Fidelity Ethereum Fund (FETH), one of the largest spot ether ETFs in the U.S.

FETH, with $898 million in net assets, could stake as much as 100% of its ether under normal conditions, though Fidelity set no minimum, according to an amended registration statement. The fund would keep some ETH available for redemptions, expenses and other liquidity needs.

The shift follows an IRS safe harbor bulletin issued in November 2025 that lets qualifying crypto trusts stake assets without losing their grantor-trust tax status. Fidelity would join Grayscale and 21Shares in adding staking to existing ether funds. BlackRock took a different route by introducing a separate staking product.

Fidelity would retain 85% of gross staking rewards, while the remaining 15% would go to the fund sponsor, custodians and node operators. Blockdaemon, Figment and Galaxy are named as the trust’s node operators.

Net staking rewards would first cover fund expenses and would then be used for quarterly cash distributions. Funds must distribute net staking rewards at least quarterly, according to the IRS rules.

The fund may also sell some ETH to raise cash for payouts, Fidelity said.

Bitcoin treasury company Strategy has completed another Bitcoin sale, selling 1,690 BTC for $108.6 million, and using the proceeds to repurchase $109 million of its STRC preferred stock.

The company also sold $653 million in MSTR shares, using the proceeds to increase its dollar reserve by $650 million.

Strategy’s Latest Bitcoin Sale

The Michael Saylor-founded company disclosed the sale in an updated filing with the Securities and Exchange Commission (SEC). The sale is the latest by the Bitcoin treasury company to manage its dividend and interest obligations and leverage a portion of its holdings to fund a $5 billion reserve.

According to the filing, Strategy sold 1,690 BTC for $108.6 million, and repurchased $109 million worth of its STRC preferred stock. It also sold $653 million in MSTR common stock, using the proceeds to increase its dollar reserve.

Strategy swore by its Bitcoin purchases, spending billions to become the largest publicly traded holder of the flagship cryptocurrency, and spawning several other Bitcoin treasury companies. However, Strategy has pivoted away from its buy-and-hold approach in recent months due to macroeconomic and geopolitical headwinds. The company concluded a small sale of around 704 BTC in 2022. However, it switched to regular sales in late May and June, starting with a 32 BTC sale. It sold 3,588 BTC in late June and early July, and another 1,638 BTC at the beginning of August. The August 10 sale takes Strategy’s Bitcoin holdings down to 840,447 BTC.

Repurposing Its Bitcoin Holdings

Strategy has strategically sold BTC as its priorities pivot to meeting dividend, interest, investor, and capital obligations during a difficult phase for the broader market. The change in the company’s approach has been driven by a substantial decline in BTC’s value, forcing it to abandon its accumulation model to manage its balance sheet, including building a cash reserve and strategic sales to meet dividend obligations.

CEO Phong Le stated during a CNBC interview in May that Strategy could sell some of its Bitcoin holdings if it benefits shareholders.

“At the point where selling Bitcoin versus selling equity to pay a dividend is better for our bitcoin-per-share, we will do it.”

Saylor echoed similar thoughts, but stressed that Strategy would never be a “net-seller” of Bitcoin, a distinction made after intense criticism of the company’s selling.

“I’m very famous for saying ‘never sell your Bitcoin.’ That’s why the internet went crazy when we said we might sell it. But if I was being more precise: never be a net seller of Bitcoin. It just wouldn’t have been so viral.”

STRC Preferred Stock Declines

One of the primary drivers of Strategy’s recent selling is STRC’s declining share value. STRC, Strategy’s preferred stock, fell significantly below $100, hampering the company’s ability to issue new stock and fund Bitcoin acquisitions.

Strategy has attempted to get STRC back to $100 by introducing a new capital management framework that allows it to sell Bitcoin, build a cash reserve, and repurchase STRC.

Strategy has sold 6,948 BTC worth $432.5 million since May, using the proceeds to fund dividend and interest obligations. It introduced its Digital Assets Capital Framework in June, formalizing its strategy to sell a portion of its Bitcoin holdings. The framework allows the company to sell up to $1.25 billion in BTC to replenish its Dollar reserve, fund interest payments, dividends, and share buybacks.

Bitcoin Remains Primary Treasury Asset

Despite an uptick in selling, BTC remains Strategy’s primary reserve asset. The company currently holds 840,447 BTC, worth around $53.6 billion at current prices.

Le has insisted that Strategy will resume Bitcoin purchases over the course of the year, stating in a Fox interview,

“We’ll get back to buying more Bitcoin throughout the course of the year.”

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

A group of cryptocurrency companies has urged frontier artificial intelligence (AI) labs to give Bitcoin developers early access to their most capable models.

The letter, published by the Bitcoin Policy Institute (BPI) on Monday, said many digital asset defenders, including Bitcoin Core developers, lack access to lab cyber programs and can be blocked by guardrails on publicly available frontier systems, leaving them to rely on less capable open-weight models.

The signatories urged frontier AI labs to “establish or expand standing trusted-access programs for qualified defenders of open-source financial infrastructure.” 

The letter said open-source software supports critical digital and financial infrastructure, while Bitcoin (BTC) alone secures more than $1 trillion in value. It added that a vulnerability in open-source infrastructure can place life savings at risk.

The open letter was co-signed by multiple crypto companies and organizations, including the African Bitcoin Institute, Anchorage Digital, BitGo, Bitwise, Blockstream, Bull Bitcoin, MARA, Kraken, Ledger and Trezor, among others.

Related: Strategy-led group pledges $15M to quantum-proof Bitcoin network

Open-source defenders need access to frontier AI

The letter said frontier AI is changing the economics of security research and cyber operations because advanced models can search large codebases, identify potential weaknesses and accelerate complex technical work for both defenders and adversaries.

It said frontier AI could become one of the “most powerful defensive technologies ever developed,” adding:

“Without dedicated access programs, defenders may lack the tools needed to keep pace with evolving threats to the infrastructure they maintain.” 

The BPI said it received multiple independent reports from open-source maintainers describing sophisticated actors, including potential foreign adversaries, using advanced AI capabilities to sustain attacks.

Total crypto hacks by monthly sum, all-time chart. Source: DefiLlama

Hacking activity across the industry surged in April 2026, as malicious actors stole over $634 million from cryptocurrency platforms, the highest monthly total since the Bybit hack, which helped drive losses to roughly $1.4 billion in February 2025, according to DefiLlama data.

Advances in AI-assisted vulnerability discovery have raised concerns across the crypto security industry. New models such as Claude Opus 4.8 and ChatGPT 5.5 have contributed to what Mitchell Amador, CEO of bug bounty platform Immunefi, described as a “vulnerability apocalypse” for the crypto industry.

Magazine: Bitcoin’s quantum upgrade path: What BIP-360 changes and what it does not

That amount is smaller than the ETF outflows. But in financial markets, price is set at the margin. The most recent buyers and sellers, not the cumulative volume over months, determine where the price goes. In a downtrend, when buying interest is already weak, even relatively modest and steady selling can have an outsized impact.

“Early year sales from public miners are an underdiscussed contributing factor [in] Bitcoin’s poor price performance in 2026,” the research and analysis division of Blockware Solutions said in its latest newsletter.

Many of these companies are facing squeezed margins, with the average cost to produce one bitcoin at $74,300. In response, a growing number are pivoting into AI and using their secured high-voltage electrical capacity to support that shift.

At the same time, mining difficulty, the computational work needed to add a new block, has fallen about 18% from its November peak, marking the longest stretch of declining hashrate.

In other words, the exodus and AI pivot of several large miners has eased competition, making BTC cheaper to mine and boosting rewards for those still in the game, a classic free-market reset that could lure new miners back in.

“In other words, the rest of the miners are earning ~18% more Bitcoin now than they were 10 months ago. The exodus of the largest players in the industry is improving the economics for the miners that remain,” Blockware said.

FlightAware, the aviation data company behind real-time flight tracking and status updates, has sued Kalshi in New York federal court over Kalshi’s use of FlightAware’s “data and name” to power prediction market contracts tied to flight cancellations. The complaint, filed in the US District Court for the Southern District of New York on Monday, accuses Kalshi of continuing to list event contracts using FlightAware’s registered trademark and purportedly “verified” flight-cancellation information despite repeated demands to stop.

The lawsuit adds a reputational and safety dimension to the broader legal battle already surrounding prediction markets in the US. FlightAware argues that wagering tied to flight disruptions could create incentives for manipulation and even interfere with air travel, while also positioning FlightAware as being involved in alleged “illicit” activity through unauthorized branding and data use.

Key takeaways

• FlightAware sued Kalshi in New York federal court, alleging continued use of FlightAware’s trademark and flight-cancellation data in prediction market contracts.
• The complaint frames flight events as safety-relevant, arguing wagers could incentivize participants to interfere with cancellations or pressure aviation workers to cut corners.
• Regulatory pressure on prediction markets is escalating, with states and federal regulators already contesting whether event contracts function as illegal gambling.
• FlightAware says customers may assume involvement due to the way Kalshi presents “verified by FlightAware” information and FlightAware branding.

Trademark and data-use claims put FlightAware at the center

According to the Monday filing in the Southern District of New York, FlightAware contends that Kalshi kept publishing event contracts related to flight cancellations even after FlightAware demanded Kalshi stop using its registered trademark. FlightAware also claims Kalshi continued to advertise those markets as being “verified by FlightAware’s data,” effectively tying FlightAware’s brand and information to the trading activity.

FlightAware’s lawsuit asserts multiple legal theories, including trademark infringement, breach of contract, harm to its reputation, and unfair competition. The company characterizes the expansion of Kalshi’s trading into commercial flight operations—reported as starting in July—as amplifying the reputational stakes of unauthorized association.

“[T]here was widespread outrage and concern that the markets would incentivize unsafe tactics to impact cancellations, threatening public safety and creating the potential for massive disruption of air travel. Airlines condemned the markets,” said the lawsuit. “And due to Kalshi’s unauthorized use of FlightAware’s data and mark, customers immediately assumed that FlightAware was involved in the scheme.”

The complaint describes FlightAware’s requested remedy as preventing “harm to public safety” before any alleged damage grows—an argument that goes beyond branding disputes and into how flight-event markets might influence behavior.

Why flight-cancellation markets are central to the safety argument

While the lawsuit is anchored in trademark infringement and related business claims, it also makes a broader case that some prediction market structures can distort incentives—especially when participants may have information before it becomes public.

FlightAware’s filing points to concerns about manipulation in event contracts generally—particularly cases where traders might know more than the public until an event is formally disclosed. The filing references public reporting that has highlighted unusual betting activity in other contexts, including claims tied to political speech wording and allegations involving alleged nonpublic information.

On flight disruptions specifically, FlightAware argues Kalshi’s model risks creating incentives to affect outcomes that are operationally complex and safety-sensitive. In its complaint, FlightAware contends that:

“A market that allows the public to wager on whether flights will be delayed or cancelled creates an incentive for participants to interfere with air travel—including by causing or contributing to flight cancellations—to profit from their wagers.“

“Worse, wagers on flights being timely may incentivize airline, airport, or other aviation workers to cut corners to keep a flight on time.“

Advertisement

The practical implication for investors and users of prediction markets is that the debate is not only about legality; it’s also about whether these markets create behavioral pressures that regulators and consumers should treat differently from, say, entertainment-focused or purely informational forecasts.

Prediction markets face a wider legal showdown in the US

FlightAware’s suit arrives amid intensifying legal scrutiny of prediction markets such as Kalshi and Polymarket. The company’s complaint is described as another step in a pattern of court challenges where gaming authorities have asked judges to halt or block event contracts for residents in their states.

Earlier coverage cited in the source notes that Michigan has sought to block Kalshi’s sports betting contracts. More broadly, the continuing legal conflict is expected to develop into a standoff between federal regulators and state officials over whether certain prediction markets amount to illegal gambling under state law, with attention often focused on sports-betting-adjacent products.

Within that landscape, FlightAware’s complaint is notable for targeting the infrastructure behind a specific market type: the data feeds and branding used to connect aviation status information to tradable events. Even if a court ultimately decides the “wager” question in a different frame, the trademark and reputational claims could still materially affect how prediction markets partner with, or reference, data providers.

Market dominance and scale add pressure

The source also points to a report from Predicted’s “State of Prediction Markets – Q2 2026,” which says Kalshi and Polymarket combined controlled more than 90% of all prediction market volume, and together had more than $90 billion in second-quarter notional volume. While this figure is not part of FlightAware’s lawsuit, it helps explain why disputes involving major platforms and data sources attract immediate attention: the potential impact of any court outcome is amplified by the scale at which these venues operate.

At the same time, scale can cut both ways. For data providers and industry stakeholders, widely used prediction products increase the cost of getting the compliance picture wrong—especially when branding and “verified” claims link a company’s name to markets that may be perceived as encouraging unsafe interference or manipulation.

Cointelegraph reported that it reached out to Kalshi for comment on the lawsuit but did not receive an immediate response.

Readers should watch how courts address both strands of this conflict—whether event contracts are treated as wagers under relevant laws, and whether unauthorized trademark and data-use claims can force changes to how prediction platforms source and present verified information. The next developments in the case could determine how far prediction markets can go in partnering with real-world data providers without triggering safety and compliance concerns.

ARP Digital, a Bahrain-based institutional digital asset infrastructure provider, has obtained a broker-dealer license from Dubai’s Virtual Assets Regulatory Authority (VARA). The approval enables the firm to provide regulated conversions between digital assets and the UAE dirham for eligible clients in the United Arab Emirates.

According to ARP Digital, the license is designed for UAE-based corporates, capital markets participants and qualified investors, including conversions involving stablecoins and dirhams. The company also positions the approval as a regulated route for institutions to convert digital asset capital for deployment into local UAE investments.

Key takeaways

• ARP Digital secured a VARA broker-dealer license, allowing regulated digital asset-to-dirham conversions in Dubai.
• Conversions can include stablecoins and UAE dirhams, targeting corporates, capital markets players and qualified investors.
• The license expands ARP Digital’s regulated footprint in the Gulf, following its authorization in Bahrain.
• Dubai’s VARA continues expanding its licensed market structure, with additional broker-dealer approvals reported alongside this move.

Broker-dealer approval for regulated UAE conversions

ARP Digital said the VARA broker-dealer license authorizes it to offer regulated “conversions between digital assets and the UAE dirham.” In practical terms, that matters for institutions seeking compliant on-ramps and off-ramps, particularly where stablecoins are used as a bridge asset between fiat and crypto exposure.

The firm’s stated scope includes both sides of the process: converting between stablecoins and dirhams, and providing a structured pathway for institutions to repurpose digital asset capital into investments tied to the local UAE market.

Bahrain license underpins the Gulf expansion

The VARA approval is described by ARP Digital as its second regulated Gulf market access point. In Bahrain, the company says it is licensed by the Central Bank of Bahrain and has handled more than $3.5 billion in processed volume for over 450 institutional and corporate counterparties.

ARP Digital also claims fourfold year-over-year growth in 2025 in its Bahrain operations. While the figures are company-provided, the broader implication for investors and institutions is clear: the firm is leveraging an existing regulated track record to extend similar infrastructure capabilities into Dubai’s expanding regulatory framework.

Institutional infrastructure beyond conversions

ARP Digital’s offering is not limited to fiat-crypto exchange services. The company lists institutional capabilities including:

• Over-the-counter (OTC) liquidity for large trades
• Cross-border settlement
• Fiat on- and off-ramps
• Wealth management

This matters because regulated conversion licenses can be a prerequisite for broader institutional workflows—particularly those that involve clearing requirements, risk controls, and compliance-oriented client onboarding. For market participants, the ability to access regulated routes for stablecoin and digital asset exposure can reduce operational friction compared with ad-hoc counterparties.

Dubai’s regulatory momentum and related broker-dealer approvals

The news arrives as Dubai continues to widen the perimeter of its regulated digital asset sector. VARA, established in 2022, regulates the provision, use and exchange of virtual assets in and from Dubai. Earlier coverage from Cointelegraph noted that VARA issued its 50th virtual asset service provider license in July.

Competition and market depth are also being shaped by new approvals. On Tuesday, Flowdesk—described as a crypto market maker backed by Coinbase Ventures and BlackRock—received a full VARA broker-dealer license. That authorization enables Flowdesk to serve qualified and institutional investors in and from Dubai.

Taken together, the sequence suggests VARA is not only expanding the number of licensed entities but also deepening the institutional services available under its framework—an important factor for liquidity, pricing efficiency, and the maturation of regulated crypto rails in the UAE.

What to watch next

With ARP Digital now licensed to conduct regulated stablecoin and digital asset conversions into UAE dirhams, institutions active in the region will likely focus on how quickly the firm ramps operational capacity, expands counterparties, and integrates its conversion services with broader OTC and settlement offerings. Observers should also track how VARA continues to scale licensing and enforce requirements as the Dubai market grows more crowded with specialized broker-dealers.

A painstaking investigation into crypto-focused recruitment tactics has exposed how suspected North Korean IT workers operate when they think they’re joining a legitimate startup. In a ruse carried out over five weeks, researchers built a fictitious company called Ballena Azul and invited suspected operatives to develop software and complete tasks inside controlled virtual environments—allowing analysts to observe their day-to-day tooling, workflows, and infrastructure choices.

As described in reporting by Cointelegraph, the project was designed and executed by Mauro Eldritch, founder of cybersecurity firm BCA LTD, and Heiner García, a cyber threat intelligence analyst at Telefónica Tech and founder of NorthScane. The operation leveraged infrastructure from cybersecurity platform ANY.RUN, and Cointelegraph joined for one stage of the contact with the supposed hiring team.

Key takeaways

• Researchers used a fake crypto startup, Ballena Azul, to study suspected DPRK recruitment and working methods inside controlled virtual desktops.
• One of the most valuable findings was the use of external intermediary servers—some linked to earlier North Korean malware campaigns that were still active.
• The suspected workers often relied heavily on AI tools to compensate for technical gaps and to help with coding, writing, and document manipulation.
• The scheme showed how threat actors can pose as employees to gain access to internal systems, code, and credentials without deploying malware immediately.
• Earlier cases reported by US and industry entities indicate this approach is evolving, spanning remote access strategies and identity manipulation.

From recruitment to “startup” onboarding

The Ballena Azul operation began when García connected with a recruiter via GitHub, after the recruiter was associated with Famous Chollima, a threat group linked to DPRK IT-worker activity. According to García, the startup needed software developers, and the recruiter offered multiple names for candidates—at least two of whom presented US identification.

As the interviews and onboarding progressed, the researchers used aliases to maintain the deception. Eldritch took on the persona of co-founder “Leonardo Nelson,” while García posed as “Andy Jones,” the team lead. Developers were assigned programming tasks inside controlled virtual desktop environments, which enabled the researchers to monitor what tools they reached for, how they responded when problems appeared, and how they handled technical obstacles.

To test the candidates’ responses, the researchers deliberately introduced issues, including selective network outages and changes to user interaction cues such as disappearing mouse cursors. In García’s account, the biggest surprise wasn’t only the tooling—it was the lack of a uniform corporate process. Instead, he described a pattern of improvisation rather than a rigid playbook.

Infrastructure clues and the “reuse” problem

Beyond the day-to-day behavior of the operatives, the investigation highlighted the role of infrastructure “in-between” moments. During the ruse, analysts identified external servers that acted as intermediary points before suspected workers connected to the controlled virtual desktops used by the researchers.

García told Magazine that some of those servers were associated with malware families tied to prior North Korean campaigns, including InvisibleFerret and BeaverTail/OtterCookie. He said at least some of the intermediary servers were still active, suggesting that operational components can remain in use for extended periods—an issue that matters for defenders because long-lived infrastructure increases the window for compromise and detection evasion.

At the same time, García noted that other servers appeared entirely new from an intelligence perspective, “clean” and not previously documented in mainstream threat feeds or blocklists. That combination—some reuse of known infrastructure alongside previously unseen resources—underscores why investigations focused only on established indicators may miss portions of an operation.

“Some of the servers we found were tied back to distributing InvisibleFerret and BeaverTail/OtterCookie in prior years and were active to this day,” García said, adding that others were not previously tied to intelligence tracking.

AI-assisted impersonation and credential theft risk

The working environment also revealed how the operatives attempted to maintain productivity. The researchers found extensive use of AI tools for coding and other tasks that candidates struggled to complete on their own. According to García, they used ChatGPT for writing and coding, including help answering basic questions and finishing assignments. For image alteration and document forgery, García said the group showed a preference for Google Gemini.

The investigation also documented the wider operational toolkit suspected workers used: remote desktop software, crypto wallets, and services designed for sharing two-factor authentication codes. The implication is not simply that these actors can deploy malware, but that they may not need to—once hired, they can use legitimate access to reach sensitive internal information. Researchers described the long-term advantage as well: staying undetected allows threat actors to collect salaries for as long as they remain in place, which can support DPRK funding objectives.

Cointelegraph’s reporting situates this in a broader pattern of AI adoption across DPRK-linked activity. The same piece points to Reuters reporting that another North Korean hacking group, Kimsuky, uses AI locally to automate parts of cyberattacks and generate more convincing phishing materials. While those accounts involve different operators and likely different goals, together they suggest a trend toward integrating generative tools into cyber workflows.

How the ruse unraveled—and what stayed hidden

After weeks of tasks inside the controlled environments, researchers staged an internal disruption to force the operatives to react. They introduced a new persona—“Benito Camella,” a co-founder who supposedly had been busy in Milan while hiring accelerated. When Camella “returned,” the confrontational sequence was meant to expose inconsistencies in identity and documentation.

During the confrontation, the chat room rapidly emptied. One developer, Espree, left the video call first, while another, Anderson, stayed longer before realizing the scheme was collapsing. Even after the meeting ended, the researchers maintained the facade through company communications: the fake CEO accused “Andy Jones” of bringing in “illegal workers,” and “Jones” responded that he was pressured to build quickly and believed he was not being compensated adequately.

That staged dispute ended with “termination” of the working relationship and friendship, framing the collapse as the result of a hiring disaster. Afterward, one suspected operative contacted García privately to apologize and check whether he was okay. Researchers said they never heard from the rest of the group again, and—importantly—believe the operatives remained unaware that they had spent weeks helping analysts extract intelligence.

Why this matters for crypto and broader cybersecurity

North Korea-linked IT-worker schemes have increasingly been linked to threats against the cryptocurrency sector and beyond. Cointelegraph notes industry and government-linked reporting that shows how these operations can involve recruiting developers through intermediary channels, using remote-access pathways to appear legitimate, and targeting organizations for access to internal systems and sensitive data.

Earlier examples referenced in the same reporting include ConsenSys’ statement in July that it engaged a North Korea-linked developer through a third-party service provider before cutting off access. The piece also highlights a US Justice Department case alleging nearly $1 million in cryptocurrency theft by four North Korean nationals charged in connection with remote job fraud using false identities. Separately, the US Treasury has stated that North Korean IT-worker schemes generated nearly $800 million in 2024 to support the regime’s weapons-of-mass-destruction programs.

For crypto investors, operators, and builders, the practical takeaway is that supply-chain and workforce risk remains as relevant as direct hacking. Even without an immediate malware payload, credential exposure and internal access can provide a pathway to funds and sensitive operational data—especially when attackers use “legitimate work” as cover for months-long persistence.

As defenders analyze what the Ballena Azul ruse exposed—especially intermediary server reuse and AI-enabled workflow patterns—the next step for organizations will be to tighten verification and monitor remote-access and identity controls continuously, not only when known indicators appear. The most uncertain element for now is how quickly threat actors will adapt their operational tooling and infrastructure in response to investigations like this one.