Ripple Chief Legal Officer Stuart Alderoty pushed back on the idea that cryptocurrency remains a niche dominated by young men, pointing to survey data showing 67 million Americans now hold digital assets. 

His Aug. 7 comments responded to a Wall Street Journal editorial that referred to supporters of crypto regulation as “the crypto boys.”

Alderoty argued that the label mischaracterizes a group of users. He cited Americans working in education, construction, health care and small business. His argument comes as Washington debates the CLARITY Act, giving the demographic question a dimension rather than leaving it as a dispute over industry image.

Survey data supports a broader crypto demographic

The 67 million estimate comes from the National Cryptocurrency Association’s 2026 State of Crypto Holders report, conducted with The Harris Poll. The research surveyed 10,000 U.S. crypto holders between Feb. 12 and March 3 and reported that roughly one in four American adults owns cryptocurrency, up from one in five a year earlier.

The demographic findings are nuanced than the shorthand used in Alderoty’s post. Among people who first bought crypto in 2025 or 2026, 42% identified as women, compared with 34% among earlier adopters. Meanwhile, 28% of recent purchasers were 55 or older, versus 18% who were between 18 and 24. The report found more than half of holders had household income below $150,000.

Those figures support Alderoty’s claim that crypto ownership is not confined to one age, gender or profession. However, the report measures people who already hold crypto, and its findings should not be treated as evidence that public opinion toward the industry is equally broad or favorable.

Ripple has a stake in the adoption debate

Alderoty occupies two roles relevant to the argument. He is Ripple’s chief legal officer and president of the National Cryptocurrency Association. The group launched in March 2025 with a $50 million grant from Ripple and says its mission is to improve crypto education and public understanding across the United States, as detailed in earlier coverage.

That relationship provides context for the survey’s use in Washington. The NCA says the 2026 study was conducted with The Harris Poll and carries a 95% confidence level with sampling precision of plus or minus 0.7 percentage points for the surveyed population. Still, the organization is backed by a major crypto company that has advocated for clearer federal rules.

As previously reported, Alderoty made a similar argument in July, saying 67 million holders meant Washington could no longer treat crypto users as a fringe constituency. Ripple has also joined an industry campaign urging Senate leaders to advance the CLARITY Act after months of negotiations.

CLARITY Act fight moves from demographics to policy

The legislation would create a federal digital-asset market structure and clarify how oversight is divided between the Securities and Exchange Commission and Commodity Futures Trading Commission. The Senate Banking Committee advanced the measure 15-9 in May, with two Democrats joining Republicans. Updated merged text was released July 22.

Yet support has become harder to secure. Democratic lawmakers have sought stronger ethics, consumer protection, illicit-finance and market-integrity provisions. Senate Banking Committee Democrats have separately argued in an advisory that parts of the proposal could leave national-security vulnerabilities. Those criticisms remain disputed by Republican sponsors and crypto industry supporters.

The Wall Street Journal editorial that prompted Alderoty’s response also questioned stablecoin reward provisions and exemptions involving decentralized networks. Blockchain Association CEO Ji Kim rejected parts of that criticism as containing “factual and legal inaccuracies.” The competing arguments show that ownership numbers do not resolve disagreements about how the industry should be regulated.

September becomes the next test for crypto legislation

The political timetable tightened on Aug. 6, when Senate Majority Leader John Thune confirmed that a pre-recess CLARITY Act vote would not happen. He said the measure would be queued when lawmakers return in September, while blaming Democratic resistance for the delay.

That postponement matters because the legislation generally needs 60 votes to invoke cloture and overcome a filibuster before final passage can become realistic. Republicans cannot reach that threshold alone, making Democratic support necessary unless the procedural landscape changes. Ethics provisions and other unresolved sections will therefore remain central during the recess.

For Ripple and Alderoty, the 67 million figure strengthens an advocacy argument that lawmakers are regulating a large and varied constituency. It does not prove that those holders share Ripple’s preferred policy approach. The next test will come in September, when senators must decide whether negotiations have produced enough bipartisan support to move the CLARITY Act toward a floor vote.

SkyBridge Capital founder Anthony Scaramucci said on Aug. 7 that crypto adoption may reach its most important stage when consumers use blockchain infrastructure without knowing it is there. 

Responding to an X user who argued ordinary people would never use crypto, Scaramucci wrote that they “will soon use crypto/blockchain without even realizing it.”

The claim is a forecast, not evidence that mass adoption has already arrived. Still, current payment and tokenization data provide examples of the model he describes: blockchain increasingly operates behind familiar interfaces while users interact with cards, wallets, brokerages and payment applications rather than raw addresses, gas fees or network settings.

Stablecoins already show how invisible crypto could work

Stablecoins provide the clearest existing test. Visa research using adjusted blockchain data estimated $10.2 trillion in stablecoin transaction volume over the previous 12 months, after filtering activity such as bots and internal exchange movements. Visa said adjusted volume was up 63% year over year, showing that blockchain settlement has expanded beyond speculative trading.

The Federal Reserve has also documented the trend. In an April note, researchers said stablecoin market capitalization grew about 50% during 2025, while transaction volume and decentralized finance use increased. They identified accelerating retail adoption through digital wallet partnerships as one development reshaping the sector, while warning that broader use could create new financial stability risks.

As crypto.news reported in its stablecoin payment expansion, Visa, Mastercard, Stripe, PayPal and other established firms are adding blockchain settlement without requiring customers to understand the underlying rails. That model closely matches Scaramucci’s argument: users may choose a card, app or dollar balance while blockchain infrastructure handles settlement behind the interface.

Advertisement

Tokenized assets are moving toward familiar interfaces

Tokenization offers another example. Rather than asking consumers to learn decentralized finance first, platforms are increasingly placing blockchain representations of traditional securities inside products that resemble brokerage or wallet applications. Tokenized stock transfers rose 105% over one month to $8.41 billion in July, according to RWA.xyz data cited in related tokenization coverage.

The shift is also reaching traditional market infrastructure. The Depository Trust & Clearing Corporation has been testing tokenized securities, while crypto platforms have expanded access to tokenized equities and exchange traded funds. In tokenized equities coverage, products tied to familiar stocks increasingly appear alongside conventional digital assets, reducing the distinction visible to users.

Scaramucci ties adoption to simpler user experiences

Scaramucci’s position reflects a longstanding technology pattern: infrastructure becomes more widely useful when consumers no longer need to understand its mechanics. Internet users routinely rely on protocols, cloud services and encrypted connections without choosing technical standards for each interaction. He expects blockchain systems to follow a similar path.

That view does not mean every crypto product will disappear from view. Bitcoin, self-custody wallets and decentralized applications can still require users to interact directly with digital assets. Instead, the “invisible” thesis applies most clearly to services where blockchain functions as settlement, recordkeeping or transfer infrastructure beneath a conventional customer experience.

Advertisement

Scaramucci has also linked adoption to clearer U.S. rules. In July, he described the CLARITY Act as imperfect but “ten times better” than the regulatory status quo and urged stakeholders to accept compromise. The Senate has since delayed a floor vote until September, leaving broader market structure legislation unresolved.

Regulation could decide how quickly adoption disappears backstage

The U.S. already has one major piece of federal crypto legislation in place. The GENIUS Act, signed in July 2025, created a regulatory framework for payment stablecoins. Federal Reserve research notes that agencies are still implementing core rules, including reserve transparency, redemption rights and customer identification requirements for eligible issuers.

Those rules matter to Scaramucci’s thesis because invisible infrastructure still requires visible accountability. If consumers do not know which blockchain settles a payment, responsibility shifts toward issuers, wallets, exchanges, banks and payment companies to manage custody, fraud, disclosures and compliance correctly.

There is also a scale gap between crypto infrastructure and everyday consumer finance. Federal Reserve payments data show U.S. consumers and businesses made 236.6 billion noncash payments in 2024, with cards representing more than three quarters by number. Stablecoins are growing quickly, but much blockchain volume still reflects trading, treasury movements and settlement rather than retail purchases.

Advertisement

Domestic-currency stablecoins intended to curb reliance on dollar-backed tokens could instead make it easier for users to move funds into digital dollars, according to a senior International Monetary Fund (IMF) official.

On Friday, IMF First Deputy Managing Director Dan Katz said that once local and dollar stablecoins operate on the same blockchain infrastructure, users can convert between them through decentralized exchanges, liquidity pools or peer-to-peer swaps. 

In a speech at the University of Cape Town, Katz said the shift could move foreign exchange activity away from banks and currency dealers, reducing the friction that gives authorities tools to monitor and manage capital flows. 

“In this way, local-currency stablecoins might even accelerate the adoption of FX stablecoins,” he said.

Katz pointed to South Africa, where dollar-backed stablecoins have gained limited traction but rand-linked tokens have attracted even less demand. 

While it was too early to draw firm conclusions, he said many users may favor dollar tokens because of their liquidity, network effects and acceptance across platforms and borders. 

Katz said the risks vary by country. Stablecoins may largely replace existing dollar holdings in highly dollarized economies but could increase foreign-currency demand in countries where access to dollars is restricted and economic frameworks are weak. 

He urged authorities to bring onramps, offramps and onchain exchange points within regulatory frameworks. 

Related: Dollar stablecoins could improve FX access but amplify currency runs: IMF

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Efforts to promote stablecoins pegged to local currencies in order to reduce dependence on dollar-backed tokens may end up doing something quite different: making it easier for users to switch into “digital dollars,” according to a senior International Monetary Fund (IMF) official.

In remarks delivered at the University of Cape Town, IMF First Deputy Managing Director Dan Katz said that if local- and dollar-denominated stablecoins are deployed on the same blockchain infrastructure, conversion between the two could become routine through decentralized exchanges, liquidity pools, or peer-to-peer swaps. The implication, he suggested, is that stablecoin design aimed at curbing dollar exposure could inadvertently improve access to FX stablecoins.

Key takeaways

• IMF First Deputy Managing Director Dan Katz warned that local-coin stablecoins could also facilitate conversion into dollar-backed tokens if both run on shared blockchain infrastructure.
• Once interoperability is built, Katz said users may be able to exchange between stablecoin types via decentralized exchanges, liquidity pools, or P2P swaps.
• He argued that this could shift foreign-exchange activity away from traditional intermediaries such as banks and currency dealers.
• Katz highlighted that outcomes are likely to differ by country, depending on dollarization levels, market access, and economic institutions.
• He urged regulators to ensure onramps, offramps, and onchain exchange points are integrated within regulatory frameworks.

Why interoperability changes the stablecoin story

The IMF official’s central point is not merely about what stablecoins are pegged to, but about how easily they can be moved and swapped once they share technical rails. Katz argued that if local and dollar stablecoins “operate on the same blockchain infrastructure,” users would have multiple pathways to convert between them—effectively reducing the practical difference between holding a rand-linked or a dollar-linked token.

This matters because stablecoin adoption is often shaped by more than the peg. According to Katz, even when local-currency tokens are available, many users may still prefer dollar tokens due to factors like liquidity, network effects, and acceptance across platforms and borders. In other words, the attractiveness of dollar stablecoins may be structurally reinforced by where activity and market depth already exist.

When those advantages are paired with interoperability, the “local-currency” intention can be diluted: users may treat pegged tokens as interchangeable short cuts rather than as separate ecosystems.

Potential impact on FX markets and capital-flow monitoring

Katz also framed the issue from the perspective of how FX activity and capital flows are handled. He said that routing conversion and movement through decentralized venues could move foreign-exchange activity away from banks and currency dealers.

The policy consequence, in his view, is that the usual frictions—those gaps that authorities can sometimes leverage to observe, measure, and manage capital flows—may be reduced. If stablecoin trading and exchange become more direct and automated, regulators may find it harder to rely on the traditional chokepoints that exist in bank-led FX systems.

At the same time, Katz argued that the direction of travel could be consistent with broader adoption dynamics: “In this way, local-currency stablecoins might even accelerate the adoption of FX stablecoins.” That is a key tension running through his remarks—efforts meant to localize currency exposure could end up making FX stablecoins more accessible.

What the IMF official cited from South Africa

Katz pointed to South Africa as an example where dollar-backed stablecoins have seen limited traction, while rand-linked tokens have attracted even less demand. He noted that it was “too early” to draw firm conclusions, but the pattern underscores the possibility that local-pegged products have struggled to achieve the same pull as dollar-denominated alternatives.

For investors and market participants, the takeaway is straightforward: liquidity and ecosystem maturity can matter as much as the peg itself. If dollar stablecoins already circulate across a wider set of venues and users, interoperability could channel demand toward the assets that offer the easiest conversion and deepest markets.

Country-by-country risks: dollarization versus restricted access

While Katz did not present a one-size-fits-all forecast, he argued that the risks vary across countries. He suggested that stablecoins could largely replace existing dollar holdings in highly dollarized economies—meaning the shift would be more about substitution of what people already hold.

In contrast, he warned that in countries where access to dollars is restricted and economic frameworks are weaker, stablecoins could increase foreign-currency demand. In those settings, the accessibility gains from onchain conversion may become economically consequential, potentially shifting how households and businesses seek to hedge or transact.

That distinction is important for policymakers who might otherwise assume that “local-currency stablecoins” automatically reduce cross-border currency pressures. Katz’s framing implies that the broader macro effect depends on whether stablecoin adoption replaces existing behavior or changes the feasibility of accessing foreign currency in the first place.

Regulators may need onramps, offramps, and onchain exchange points

Rather than advocating for a simplistic approval or prohibition approach, Katz urged authorities to build regulatory coverage around the full stablecoin lifecycle—specifically onramps, offramps, and onchain exchange points. His comments imply that supervision cannot stop at issuing rules for pegged tokens; it also has to address where conversions happen and how users enter and exit stablecoin positions.

From a market-structure standpoint, this is a crucial policy challenge. If decentralized exchanges and liquidity pools become the primary route for swapping between stablecoin types, regulation that only targets centralized issuers may miss the most active venues for price discovery and asset conversion.

What to watch next is whether jurisdictions pursuing local-currency stablecoins also take interoperability and exchange routing seriously in their regulatory designs. If local and dollar stablecoins become technically unified, Katz’s warning suggests demand may flow toward the tokens with the deepest liquidity and widest acceptance—potentially changing both the mechanics of FX access and the practical tools available to monitor cross-border financial activity.

XRP Ledger developers released xrpld version 3.3.0 on Aug. 6, moving several protocol changes closer to possible mainnet activation. 

The official GitHub release confirms work on ConfidentialTransfer, BatchV1_1, Sponsor and DynamicMPT, alongside fixes and other protocol changes. The software release itself does not activate those features on the network.

The distinction matters because some reports describe six upgrades as already live. Under the XRP Ledger amendment process, new protocol features require validator support before activation. An amendment must maintain more than 80% support from trusted validators for two continuous weeks before taking effect.

XRP Ledger 3.3.0 adds privacy and atomic transaction tools

ConfidentialTransfer is designed to add privacy for Multi-Purpose Tokens, or MPTs. XRPL documentation says the amendment uses cryptography to shield individual balances and transfer amounts while preserving mechanisms that let authorized parties, including issuers or auditors, verify information needed for compliance.

The feature remains subject to amendment activation, so private MPT transfers should not yet be described as active on XRPL mainnet.

BatchV1_1 is another major component. The XLS-56 standard allows multiple transactions to be packaged and processed together, including transactions involving different accounts. Atomic execution can help settlement workflows where several actions must succeed together rather than leaving one leg completed while another fails.

Revised features follow earlier security findings

Batch has an important history. An earlier version was disabled before mainnet activation after a security issue was discovered in transaction-signing logic. The XRPL Foundation later moved toward BatchV1_1 as the corrected replacement. As previously reported in XRPL security coverage, developers have increased formal review around recent upgrades.

Permission Delegation followed a similar path. XRPL disclosed in September 2025 that a bug in the earlier amendment could have allowed an unauthorized transaction to charge fees to another account under specific conditions. Validators were advised to vote no, and the vulnerable feature never activated. PermissionDelegationV1_1 was developed as its replacement.

The revised concept lets an account grant defined transaction permissions without handing over its main private key, supporting operational wallets with limited authority.

Sponsor and DynamicMPT target institutional onboarding

Sponsor, based on XLS-68, is designed to let another account cover transaction fees or reserve requirements while the user keeps control of the account and keys. The feature could let applications onboard users without requiring them to acquire XRP solely to meet network costs. The XLS-68 proposal explicitly supports fee and reserve sponsorship while preserving user key control.

DynamicMPT targets token issuers. The XLS-94 proposal lets issuers designate selected MPT properties as mutable when creating a token, then update those permitted fields later. The standard is intended to accommodate changing business or compliance requirements without making every token property freely editable.

Together, these features fit XRPL’s growing focus on tokenized finance. In related tokenization coverage, crypto.news reported that JPMorgan, Mastercard, Ondo Finance and Ripple tested a tokenized Treasury redemption using XRPL.

Not every cited upgrade belongs to version 3.3.0

One correction is necessary around the widely circulated “six upgrades” framing. fixCleanup3_2_0 belongs to the earlier xrpld 3.2.0 cycle, not the newly released 3.3.0 feature package. The 3.3.0 GitHub changelog instead shows work around LendingProtocolV1_1 and a separate fixCleanup3_3_0 track alongside the headline features.

The release therefore should not be read as six finished capabilities becoming available simultaneously. It is a server-software milestone that gives validators and operators code needed for amendment decisions. Individual amendments can have different voting timelines and may fail to activate if support falls below the required threshold.

This governance process has mattered before. The original Batch and Permission Delegation amendments were stopped after bugs were identified before mainnet activation, showing that inclusion in software or validator voting is not the same as production deployment.

What happens next for XRPL validators

Node operators now need to assess version 3.3.0 and decide whether to upgrade and support individual amendments. Exact activation dates depend on validator voting, rather than the Aug. 6 software release. XRPL’s amendment rules require the supermajority to persist continuously for two weeks.

For XRP holders, the immediate change is technical rather than monetary. Version 3.3.0 expands the network’s potential toolkit for privacy, multi-step settlement, delegated authority, sponsored onboarding and configurable token issuance, but none guarantees higher XRP demand or price appreciation.

The next verifiable milestones will be validator adoption of 3.3.0, amendment support levels and scheduled activation dates. Until those thresholds are met, the new capabilities should be described as released in node software and moving through governance, not as fully active XRP Ledger mainnet features.

Validator decisions, rather than release marketing, will determine when each feature becomes usable on mainnet.

The Senate will not vote on crypto market structure before August 7. Prediction markets price passage at 16 percent. The math for September is worse than it looks.

The most bipartisan digital asset bill ever to clear a chamber of Congress is now four days from a procedural death that prediction markets already priced in weeks ago. On August 6, 2026, Senate Majority Leader John Thune told reporters the chamber will not hold a floor vote on the Digital Asset Market CLARITY Act before lawmakers leave Washington for the August recess. The Senate holds its last scheduled votes on Friday morning, August 7. It does not return until September 14.

The announcement converted what lobbyists had called a “tight but possible” window into a confirmed miss. On Polymarket, the contract asking whether H.R. 3633 will be signed into law before 2027 trades at 16 cents on the dollar, down from 82 cents in February. The collapse is not a prediction of permanent failure. It is a repricing of the calendar, and the calendar is brutal.

What the CLARITY Act actually does

The Digital Asset Market CLARITY Act is a 309 page bill that divides oversight of digital assets between two federal regulators. Tokens whose value derives primarily from an open, decentralized network would fall under the Commodity Futures Trading Commission. Tokens still tied to the commercial efforts of a founding team or company would be classified as securities under the Securities and Exchange Commission.

The classification matters because it determines which rulebook applies. A digital commodity under CFTC oversight would face disclosure and market integrity requirements modeled on existing futures regulation. A digital asset security under the SEC would face the full weight of securities law, including registration, reporting, and the antifraud provisions that have driven most of the agency’s crypto enforcement actions since 2023. The bill creates a process for tokens to transition from security to commodity status as their networks decentralize, a mechanism the industry has wanted since the SEC first applied the Howey test to token sales.

Beyond classification, the bill sets rules for exchanges, stablecoin yield, DeFi protocols, developer protections, and customer property treatment in bankruptcy. It also grants the CFTC new statutory authority over spot digital commodity markets, a power the agency currently lacks and has requested repeatedly since 2022.

The House passed it on July 17, 2025 with a vote of 294 to 134. More than 70 Democrats crossed the aisle, making it the most bipartisan crypto vote in congressional history. The Senate Banking Committee advanced it on May 14, 2026 by a vote of 15 to 9, with two Democrats joining the Republican majority. At that point, the industry expected a floor vote by the July 4 recess. That deadline came and went.

The stablecoin yield compromise nobody noticed

Buried in the bill’s 309 pages is a provision that could reshape the competitive landscape between banks and crypto firms. The Senate Banking Committee version prohibits interest or yield on idle stablecoin balances, protecting the bank deposit franchise from a product that could siphon savings accounts. But it permits activity based rewards, meaning stablecoin issuers can compensate users for lending, staking, or other on chain actions that generate real economic return.

The distinction is narrow but consequential. A stablecoin that pays 4 percent for sitting in a wallet would compete directly with savings accounts and money market funds. A stablecoin that pays 4 percent for providing liquidity to a DeFi protocol occupies a different regulatory category. The first looks like a deposit. The second looks like a return on productive capital.

Banking industry lobbyists fought for this distinction throughout the markup process. Crypto firms initially opposed it, arguing that any yield restriction would handicap stablecoin adoption. The compromise language reflects months of negotiation between the American Bankers Association and the Blockchain Association, brokered in part by the White House. Both sides have publicly accepted the current text, making stablecoin yield one of the few resolved issues in the bill.

The resolution matters for passage because it removed the banking industry as an active opponent. Banks will not lobby against a bill that protects their deposit base. That leaves the ethics provision as the primary obstacle, which is a political problem rather than an industry one.

The ethics provision that broke the timeline

The single largest obstacle to passage is a proposed ethics provision governing government officials with crypto holdings. Under the current bipartisan draft, federal officials, including the president, would need to divest any crypto holdings worth more than one million dollars that also represent at least 10 percent of a company’s value. Officials with smaller stakes above 15,000 dollars would be required to place holdings in a blind trust or divest outright.

The provision exists because of one person. President Trump disclosed more than one billion dollars in crypto earnings, and Democrats argued that signing a bill governing the industry he profits from requires unprecedented restrictions. The White House initially accepted a version of the ethics language, and Polymarket odds jumped 11 points to 43 percent on July 21 when reports surfaced that Trump had agreed to the deal. But Democrats countered that the restrictions did not go far enough.

Senators Thom Tillis and Ruben Gallego drafted alternative ethics language and sent it to the White House for review. The proposal would also give state attorneys general the power to sue the Justice Department over lax enforcement or to sue exchanges listing assets that violate the ethics rules. Republicans resisted that provision over fears of partisan misuse. A July 22 revision made the ethics rule temporary, with an expiration tied to the end of the current presidential term, but that concession did not satisfy the Democratic caucus either.

The negotiations are ongoing, but as of August 6, no agreement exists. The ethics provision did not appear in the House version of the bill, which means any Senate text on the subject will need to survive conference committee as well. That creates a second layer of political risk. Even if Democrats accept a version of the ethics language strong enough to secure their floor votes, House Republicans who passed a clean bill without ethics provisions may resist adding them in conference. The provision that was designed to unlock Senate votes could become the provision that kills the bill in reconciliation.

Advertisement

How prediction markets became the bill’s unofficial whip count

Polymarket did not wait for Thune’s confirmation. The contract asking whether the CLARITY Act will become law in 2026 began its descent in mid July, falling from 43 percent after the ethics deal reports to 24 percent by late July, then to 14 percent when Thune floated a last minute vote that never materialized. The current price of 16 cents reflects a modest bounce after Thune promised September priority, but the market is telling a clear story: bettors do not believe the calendar supports passage this year.

Nearly five million dollars in total volume has traded on the main contract. A secondary Polymarket market asking whether the Senate would vote before the August recess resolved to “No” with overwhelming liquidity on that side. The accuracy of prediction markets on congressional timing has improved markedly since 2024, when Polymarket correctly called several procedural outcomes on the GENIUS Act weeks before traditional political analysts.

The 82 to 16 percent decline is the steepest odds collapse for any major crypto regulatory contract on Polymarket. It exceeds the drop in GENIUS Act passage odds during the 2025 stablecoin negotiations and approaches the speed of the 2024 Bitcoin ETF approval contract’s final week repricing, though in the opposite direction.

Advertisement

What makes this market particularly informative is who trades it. Polymarket’s regulatory contracts attract a mix of crypto industry insiders, political consultants, and Hill staffers who cannot legally trade traditional political prediction markets but face no such restriction on crypto native platforms. The information density of the order book arguably exceeds that of any single news source, because traders with private knowledge have financial incentives to act on it immediately. When the price moved from 43 to 24 percent in the last week of July, the market was pricing in what CoinDesk reported three days later: that Senate leadership had effectively abandoned the August timeline.

The September math

Thune told reporters the bill will be “queued up first thing” when the Senate returns on September 14. The procedural path requires filing for cloture, waiting two days under Senate rules, and then holding a 60 vote procedural vote before debate can even begin. If Thune files cloture before the recess, the first vote could occur as early as Tuesday, September 15. If he waits until September 14 to file, the first vote would fall on Wednesday, September 16 at the earliest.

From September 14 through the pre election recess in mid October, the Senate has roughly 14 working days. In that window, it must also address government funding legislation, potential continuing resolutions, and any executive nominations the White House pushes. Crypto market structure will compete for floor time with every other priority that a chamber facing midterm elections needs to clear.

A legislative staffer told CoinDesk that the bill “would easily have a chance at passage in September” if the outstanding issues are resolved. That conditional is doing all the work. The outstanding issues are the ethics provision, illicit finance safeguards, Agriculture Committee provisions on commodity oversight, and stablecoin yield treatment. None of these are new objections. They have been under negotiation since May. The recess does not resolve them. It suspends them. Staff level negotiations can continue during August, but no senator is going to make a public concession on ethics language while campaigning in their home state. The political dynamics of the recess favor inertia, not resolution.

Advertisement

The September window also coincides with the fiscal year deadline on September 30. If Congress faces a government shutdown fight, the CLARITY Act will be the first item pushed off the calendar. Crypto market structure is important to the industry but it is not must pass legislation, and leadership will always prioritize keeping the government open over advancing any single policy bill.

The 60 vote problem

The CLARITY Act needs 60 votes to clear cloture. Republicans hold 53 seats. That means at least seven Democrats must cross the aisle, and that count assumes every Republican votes yes. Multiple Republican senators have publicly announced opposition or expressed concerns about stablecoin yield language and the ethics provision’s scope.

The seven Democratic crossovers are not hypothetical. Specific senators have tied their votes to specific conditions. Consumer protection language must be strengthened. Illicit finance provisions must be tightened. The ethics provision must restrict presidential crypto involvement more aggressively than the current draft. Each of these demands requires text changes that could lose Republican votes on the other side.

The bill passed the Senate Banking Committee 15 to 9, not 15 to 0. Even in committee, the margin reflected the partisan difficulty of the exercise. On the floor, with midterm campaign pressures and a president whose personal wealth is intertwined with the bill’s subject matter, the vote counting becomes significantly harder. Every amendment that wins a Democratic vote risks losing a Republican one, and the margin for error is zero. The vote counting exercise is further complicated by the midterm calendar. Senators in competitive races have little incentive to take a difficult vote on crypto regulation months before an election. A vote for the bill invites attack ads about enabling presidential self dealing. A vote against it invites attack ads about blocking innovation. The safest move for a vulnerable senator is to not vote at all, which is precisely what the recess delay accomplishes.

Advertisement

What happens if September fails

If the CLARITY Act does not pass the Senate before the mid October recess, it enters a lame duck session compressed by midterm elections, repeating a pattern that has stalled crypto legislation before. The composition of the next Congress depends on November results, and any significant change in chamber control would reset the legislative process entirely.

The bill would not die in a formal sense. It could carry over to a lame duck session after November. But lame duck crypto legislation has never passed, and the political incentive to vote on a complex regulatory framework after elections, when members are either leaving or repositioning, is close to zero. The GENIUS Act stablecoin bill faced a similar dynamic in late 2025 and was ultimately folded into the CLARITY Act rather than passed independently.

Industry lobbyists have begun contingency planning for 2027. A senior policy advisor at the Blockchain Association told reporters that the organization is “preparing for both timelines” but acknowledged that starting over in a new Congress would delay comprehensive market structure regulation by at least 18 months. The SEC would continue operating under its current enforcement first approach, and the CFTC would lack the statutory authority the bill would grant it over spot digital commodity markets.

The gap between votes and law

Even if the Senate passes the CLARITY Act in September, the bill must go to conference committee to reconcile differences with the House version. The House passed its version in July 2025. The Senate version, after committee markup and potential floor amendments, will differ in several material ways, particularly on ethics provisions that did not exist in the House text.

Advertisement

Conference committees on financial regulation historically take weeks to months. The Dodd Frank Act’s conference process took three weeks, and that was considered fast. The CLARITY Act’s conference would need to resolve ethics language, stablecoin yield treatment, CFTC funding mechanisms, and Agriculture Committee provisions that the House and Senate handle differently.

The path from a September Senate vote to a presidential signature before January 2027 requires the conference to finish before the lame duck session ends, both chambers to approve the conference report, and the president to sign a bill containing restrictions on his own financial activities. Polymarket’s 16 percent price reflects the compound probability of all these steps occurring in sequence. The market is not saying the CLARITY Act is dead. It is saying that the chain of events required for it to become law in 2026 is long enough that each link compounds the risk of failure.

What to watch

Cloture filing before August 7. If Thune files cloture on the CLARITY Act before the Senate leaves, it signals genuine intent to hold a procedural vote on September 15. If he does not, the earliest possible vote shifts to September 17 or later, consuming more of the limited floor time.

Ethics language from the White House. The Tillis and Gallego proposal is sitting with the White House for review. A formal response before or during recess would indicate whether the divestiture thresholds and state attorney general enforcement mechanism are acceptable. Silence through recess means September negotiations start from scratch.

Advertisement

Polymarket price above 25 cents. A sustained move above 25 percent on the main contract would indicate that new information, likely a bipartisan agreement on ethics, has shifted market consensus. The current 16 percent price already embeds a September vote attempt and assigns it low probability of success.

Democratic senator public statements during recess. The seven crossover votes needed are identifiable. If any of them publicly endorse the current ethics language or announce conditions that have been met, the vote count math changes. If they use recess town halls to criticize the bill, September passage becomes effectively impossible.

Government funding calendar conflicts. If a continuing resolution debate consumes the first week of the September session, the CLARITY Act loses floor time it cannot afford. Watch for appropriations committee scheduling in late August.

Advertisement

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. Cryptocurrency markets and regulatory outcomes are inherently uncertain. Prediction market prices reflect crowd sentiment, not guaranteed outcomes. Always conduct your own research before making financial decisions. Published August 6, 2026.

A five-year firmware error turned Coldcard into the largest known Bitcoin seed-theft, while AI-assisted analysis of the broader ecosystem is surfacing how systematically the industry has underestimated the same class of vulnerability.

On July 30, 2026, a coordinated sweep removed more than 1,082 Bitcoin from 1,196 hardware wallets in approximately 41 minutes. No device was stolen. No PIN was guessed. The Bitcoin protocol was untouched. The attackers worked from a laptop and an offline seed-reconstruction tool, because a firmware error introduced five years earlier had made the seeds of certain Coldcard models predictable enough to reconstruct without handling the hardware. By August 3, Galaxy Research had confirmed 1,596 BTC stolen from about 7,300 addresses, with a suspected fourth wave potentially pushing losses to approximately 2,055 BTC, close to $130 million. As investigators distributed flagged addresses to law enforcement and exchanges, a parallel wave of AI-powered security analysis swept other Bitcoin wallet codebases and surfaced entropy handling failures that conventional review had missed, suggesting Coldcard is the most visible instance of a far wider problem.

What went wrong inside the firmware

The vulnerability traces to a single macro-check error introduced during a March 2021 Coldcard firmware migration. Coinkite, the Canadian hardware wallet manufacturer, was integrating a new cryptographic library called libngu as part of a broader codebase update. During that integration, an incorrect conditional check caused wallet seed generation to bind to a software pseudo-random number generator called Yasmarang, built into the MicroPython embedded Python runtime, instead of the STM32 hardware true random number generator the device contains.

The production board configuration for every affected Coldcard model sets the macro MICROPY_HW_ENABLE_RNG to zero, because Coldcard provides its own separate hardware RNG wrapper. Libngu checks for this macro using a #ifndef conditional, which tests only whether the macro is defined in the build environment, not whether its value is nonzero. Because the macro was defined with a value of zero instead of absent entirely, libngu treated the hardware source as available and silently bound the seed-generation function to MicroPython’s deterministic Yasmarang generator. That generator produces output seeded from the microcontroller’s unique identifier and timer registers at boot, neither of which provides cryptographic randomness.

The hardware RNG continued running in other firmware functions throughout the entire affected period. Internal code reviews at Coinkite could confirm the generator was present, accessible, and called in the firmware without detecting that wallet seed creation had quietly redirected to the weaker source. Coinkite said in its technical postmortem that it had no knowledge the MicroPython fallback existed in that code path until the post-incident investigation, a detail that underscores how a single incorrect boolean check can survive years of review precisely because the intended component is visible and functional everywhere else.

Block’s Bitcoin engineering and security team independently identified the same error. The team traced the #ifndef macro check, confirmed the Yasmarang binding, and published a technical disclosure stating that the affected firmware called the deterministic fallback instead of the STM32 hardware source during seed creation. Block said it had not completed full empirical testing of exploitability but decided early disclosure was appropriate because active theft reports had already emerged.

The impact on entropy differed by device. Seeds generated on Mk2 and Mk3 devices running affected firmware versions from 4.0.0 through 4.1.9 contain roughly 40 bits of effective entropy, with no cryptographically generated input added to the random number generator output at all. Mk4, Mk5, and Q devices receive a small contribution from a secure element at boot, but libngu hashes and truncates that input to four bytes before using it to reseed only a single 32-bit word of the Yasmarang state. The result is approximately 72 bits of effective entropy rather than the intended 128, an exposure roughly 72 quadrillion times weaker than the intended design.

How attackers reconstructed wallets without physical access

A seed phrase is computationally infeasible to guess when it draws from 128 bits of uniform randomness. A seed drawing from 40 bits of entropy occupies roughly one trillion possible values. An attacker who can constrain the Yasmarang seed further, using publicly available information about the MCU unique identifier and typical boot timing for a given device model, reduces that space to something modern hardware can traverse.

Bitcoin addresses derived from any seed are publicly visible on the blockchain. An attacker who understands the Coldcard firmware flaw can enumerate the Yasmarang output sequences possible for a target device family, derive the Bitcoin addresses that each candidate seed would produce, and compare every derived address against the full public blockchain. Any match reveals a wallet whose private keys the attacker can recreate offline and use to authorize a transfer without touching the original hardware, knowing the device PIN, or interacting with the Bitcoin network in any way that would look unusual until the moment the transfer itself is broadcast.

The attack requires no cooperation from the victim, no network access to the victim’s device, and no vulnerability in the Bitcoin protocol. It is a consequence of the seed being drawn from a statistically small number of possible values instead of the 2^128 possibilities the device is designed to provide.

Block noted in its disclosure that practical exploitation cost depends on available MCU identifier information, boot timing, and prior RNG call history, and that no end-to-end brute-force benchmark has been published for any affected model.

JUST IN: Coldcard wallets affected by security issue with reported losses

Roughly 594 $BTC valued at $38 million has been stolen from certain dormant single sig wallets pic.twitter.com/f3fk7kYXzM

— crypto.news (@cryptodotnews) August 1, 2026

Four attack waves and a $130 million toll

Galaxy Research has tracked four suspected waves of theft activity since July 30, combining on-chain data, victim reports, and coordination with law enforcement, exchanges, and blockchain analytics companies.

The first wave struck July 30 and removed 1,082.65 BTC from 1,196 addresses over approximately 41 minutes. Two subsequent waves targeted additional wallets exhibiting the same address profile. Galaxy confirmed those three waves, along with 14 smaller linked incidents, as responsible for the theft of 1,596 BTC from about 7,300 addresses. Galaxy head of research Alex Thorn identified a suspected fourth wave on August 3 after observing transaction patterns matching the earlier attacks, with his running estimate settling at 448.7 BTC moved from 709 additional addresses. The sweep rate during the most active period reached 13.8 wallet drains per Bitcoin block, compared with a baseline of 0.3 per block during a pre-incident control window, a pace roughly 45 times above normal. Galaxy’s confirmed estimate and fourth-wave analysis placed possible total losses at approximately 2,055 BTC.

The firm has stressed that its figures come from on-chain analysis and verified victim reports, not Coinkite’s own device records, and that blockchain data alone cannot determine whether a single actor carried out every wave. The firm identified at least 15 distinct attackers across all observed waves.

The largest single theft involved 1,159 BTC removed across seven addresses in one coordinated sweep. As of August 5, all of those funds remained unmoved and had not entered mixers or cash-out services. A separate, smaller attacker had begun attempting to launder stolen funds, routing 64 BTC toward a mixer, with approximately 10 BTC mixed during the first pass and the remainder split into outputs of roughly 7 BTC each for further rounds.

Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses. Galaxy has distributed roughly 600 flagged attacker and victim addresses to U.S. federal law enforcement and exchanges to support monitoring. Around 90% of stolen Bitcoin has not moved, giving compliance teams time to flag destinations before funds reach cash-out services, though Galaxy has warned that new attackers may still be targeting unpatched wallets.

Why the flaw survived five years of review

The macro-check error remained undetected for more than five years because of how hardware wallet firmware is typically reviewed.

Standard security assessments verify that the correct entropy source is present in the codebase, accessible from the right modules, and referenced in the seed-generation logic. Auditors confirm presence at the source level without tracing every conditional compilation path to its binary outcome to verify which function the code actually calls at runtime. In the Coldcard case, the STM32 hardware RNG was present, accessible, and actively called in multiple other firmware functions. The only code path where it was silently replaced was wallet seed creation, and the replacement was invisible to source-level review because the incorrect #ifndef check behaved unexpectedly at compilation.

Kraken chief security officer Nick Percoco argued after the incident that this pattern exposes a structural gap in hardware wallet certification. Existing frameworks, including Common Criteria evaluations, CSPN reviews, and vendor-commissioned audits, check physical security, secure element integrity, protocol implementation, and cryptographic library correctness. None of those frameworks systematically verify that production firmware at the moment of wallet creation actually calls the approved source of entropy rather than a fallback.

“Production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used,” Percoco said.

He cited NIST SP 800-90B, the United States standard for true random number generator testing and validation, and Germany’s BSI AIS-31 as existing frameworks that model what end-to-end entropy verification looks like in other regulated domains. He compared the hardware wallet certification gap with PIN entry device standards, where independent laboratory testing is mandatory before products can ship, and with U.S. government cryptographic module approvals, where entropy source validation is part of the FIPS 140 process. No equivalent independent check currently covers hardware wallet seed generation.

AI-driven audits surface a wider pattern

The Coldcard disclosure prompted security researchers to apply automated analysis methods to Bitcoin wallet firmware, embedded cryptographic libraries, and shared software components used across multiple wallet implementations. The goal was to determine whether the same class of error, specifically entropy source misdirection that survives source-level review because it only manifests at compilation or runtime, existed elsewhere in the Bitcoin custody ecosystem.

AI-assisted static analysis addresses this problem differently from manual review. A model trained on cryptographic vulnerability patterns can simulate compilation conditionals, trace every call binding that reaches a seed-generation or key-derivation function, and flag any path where the intended entropy source is overridden, replaced, or weakened under a specific build configuration. A human reviewer reading source code sees an entropy source called; an automated tool traces what that call actually resolves to in the compiled binary under each possible macro or configuration state.

Applied systematically across Bitcoin wallet firmware and shared cryptographic libraries in the weeks following the Coldcard disclosure, this approach identified 85 critical-severity findings across multiple wallet implementations and supporting libraries. The issues include incorrect fallback bindings similar to the Coldcard macro-check error, insufficient reseed entropy that leaves a weak software generator state only partially overwritten by hardware input, and conditional compilation paths that produce substantially weaker randomness under specific device configurations while passing standard source-level code review.

Advertisement

Coordinated vendor disclosure processes are underway for affected implementations, and the full set of findings is being released on timelines aligned with remediation schedules. Not all 85 findings have been made public as of August 7, 2026. The scale and distribution of the findings extend the concern Percoco raised about Coldcard into a much broader context. If a single incorrect boolean check in one vendor’s library could redirect entropy without detection for five years, the AI audit is providing an early answer to how common that class of oversight may be across the broader ecosystem.

Coinkite’s response and what remains unresolved

Coinkite disclosed the vulnerability publicly after its internal investigation and after Block’s independent disclosure confirmed the findings. The company released corrected firmware for every affected model: version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for the Q model, and Edge versions 6.6.0X and 6.6.0QX for Mk4 and Q respectively on the Edge release track.

Coinkite halted all outbound shipments after confirming the vulnerability and said it destroyed every device containing affected firmware that remained in its facilities. The company advised affected users to retain their old hardware rather than discarding it, because original devices may become relevant if stolen funds are eventually recovered through legal proceedings. Coinkite’s legal team is coordinating with law enforcement agencies across multiple jurisdictions.

The most critical limitation of the firmware update is that it does not repair any seed generated under affected firmware. The vulnerability is in the seed-creation process, not in the device’s ongoing operation. A new seed generated on corrected firmware is safe. An old seed generated under affected firmware is permanently weakened regardless of what firmware version the device subsequently runs. Migrating to corrected firmware without also generating a new seed leaves the underlying wallet exposed to the same offline brute-force attack.

Advertisement

Coinkite’s advisory notes one exception: users who added at least 50 fair, independent, private dice rolls when originally generating their seed may have supplemented the weak firmware entropy enough that their specific seed is not at risk from this flaw. A strong, unique BIP-39 passphrase reduces immediate exposure but does not repair the underlying seed. Seeds exported from a Coldcard to any other wallet remain affected regardless of where they are stored.

The custody debate the hack reignited

The Coldcard incident has reopened a recurring argument about self-custody versus managed exchange storage. The 2022 FTX collapse moved a substantial share of Bitcoin from exchange accounts into hardware wallets, with self-custody positioned as the default defense against counterparty risk. The Coldcard flaw is now running the same flow in the opposite direction.

OKX chief compliance officer Jonathan Brockmeier said the exchange has seen record inflows since the Coldcard attacks began. He described the shift as “the flip side of FTX.” OKX reported preventing $26.3 million in scam-related losses in the first half of 2026 and protecting more than $1.1 billion in customer assets during the same period, citing AI-driven monitoring of blockchain activity and account behavior as core components of its security architecture.

K33 Research reported that nearly 890,000 BTC moved on-chain in the seven days following the initial attacks, the highest seven-day active supply figure recorded in 2026. Bitcoin’s 30-day high-to-low trading range during the same period was the narrowest since 2023, with realized volatility falling below that of the Nasdaq 100, meaning the Coldcard-driven spike in on-chain activity occurred against a backdrop of unusually calm price action. K33 head of research Vetle Lunde attributed the spike to Coldcard-related address migrations and noted that similar surges in on-chain activity have historically appeared near market turning points.

Advertisement

Ripple CTO Emeritus David Schwartz compared Coldcard losses with the 2011 MF Global collapse and pointed to a structural difference: regulated financial institutions offer insurance and bankruptcy recovery mechanisms, while Coldcard users whose Bitcoin was drained through reconstructed seeds have no comparable safety net. Recovery depends on whether law enforcement can trace and reclaim the Bitcoin through coordinated exchange and legal action.

What to watch

– New attack waves. Galaxy has warned that additional attackers may still target unpatched wallets. Sweep rates above 1.0 wallet drain per Bitcoin block should be treated as a signal of active exploitation.

– Mixing and laundering acceleration. A separate attacker had begun mixing 64 BTC as of August 5. Movement from the larger 1,159 BTC cluster toward mixers or cross-chain services will narrow the investigative window significantly.

– Fourth-wave confirmation. Galaxy has not yet confirmed 448.7 BTC in a suspected fourth wave. Victim reports validating those losses would push the confirmed total to approximately 2,055 BTC and expand regulatory coordination.

Advertisement

– Hardware wallet certification reform. Percoco’s call for mandatory independent entropy testing now has a documented failure to anchor it. Watch for proposals from NIST, BSI, or hardware wallet industry bodies to incorporate end-to-end RNG validation into certification.

– Coordinated AI audit disclosures. Vendors are remediating the 85 critical findings on rolling timelines. Each public disclosure will clarify which wallet implementations beyond Coldcard carry entropy handling weaknesses.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. All information is provided as general context and should not be relied upon as the basis for any investment or custody decision. Cryptocurrency assets carry significant risk, including total loss of principal. Readers should verify all information independently and consult qualified professional advisors before taking action based on the contents of this article. August 7, 2026.

Advertisement

Mastercard Crypto Credential does not move money; it vouches for the people moving it, and that distinction is now worth more than the rails beneath every stablecoin transaction.

At a glance, the Mastercard Crypto Credential announcement from August 5, 2026, reads like any other payments headline: a large incumbent partners with a fintech, a pilot begins, press releases follow. The language is careful, the commitments are limited, and the timeline is left open. Look past the surface, however, and something structural becomes visible. Mastercard is not trying to move stablecoins faster. It is trying to control who is allowed to move them at all.

That is not a payment product. It is a compliance passport.

The framing matters because the stablecoin market has spent years solving the wrong problem. Settlement infrastructure, liquidity sourcing, and wallet user experience have absorbed most of the capital and headlines. Meanwhile, the operational constraint that actually limits network growth, the compliance cost of adding a new counterparty to a cross-border flow, has gone largely unaddressed. Mastercard is betting that whoever solves that constraint first will own a more durable competitive position than whoever processes the most transactions.

What happened on August 5

Mastercard and Borderless.xyz announced a pilot program to test Mastercard Crypto Credential inside working cross-border stablecoin payment flows. Three payment operators joined as the initial participants: Infinia, Walapay, and Koywe. All three companies came into Mastercard’s orbit through its Start Path accelerator program.

Borderless.xyz is the network through which the pilot runs. The platform connects wallet infrastructure with more than 15 licensed stablecoin providers across more than 100 countries, covering 260 payment corridors across 59 currencies. Its Q2 2026 benchmark report showed stablecoin pricing had fallen below interbank foreign exchange rates in February 2026, a milestone indicating that on-chain cross-border payments are no longer only a theoretical alternative to legacy wire transfers.

Kevin Lehtiniitty, chief executive and co-founder of Borderless.xyz, named the core problem directly: “Every new provider means starting the verification process over.” That sentence captures the structural inefficiency the pilot is designed to address. The payments work. The compliance does not scale.

The pilot aims to show that a standardized assurance signal from Mastercard can travel across the Borderless.xyz network in place of repeated bilateral counterparty checks. Downstream providers accept the credential on the strength of the originating verification alone, compressing weeks of due diligence into a signal they integrate into existing approval workflows. The pilot changes no individual operator’s obligations, but reduces how much work each one must do to satisfy them.

What the credential actually is, and what it is not

Mastercard Crypto Credential does not route transactions. It does not custody assets. It does not settle transfers between wallets. The framework does exactly one thing: it attaches identity and eligibility information to the parties on either side of a stablecoin transfer, in the form of standardized assurance signals.

Those signals contain verification and governance metadata. Payment providers integrate the signals into their internal compliance and risk processes. When a counterparty presents a Crypto Credential signal, the receiving provider can treat the originating KYC and AML check as sufficient, rather than running its own independent review from scratch. The framework also replaces raw wallet addresses with human-readable aliases, which satisfies Travel Rule requirements by making identity information transmissible without exposing long hexadecimal addresses to every party in the chain.

This distinction from a payment product is important for two reasons. First, it means the credential does not compete with stablecoin issuers. Circle’s USDC, Paxos’s USDG, PayPal’s PYUSD, Fiserv’s FIUSD, and Ripple’s RLUSD all run on top of the credential framework, not beside it. Crypto Credential is not a stablecoin and does not aspire to be one. Second, it means the revenue model for Mastercard is not transaction volume. It is access to a trusted network. The card network charges for the right to present a recognized compliance signal, which is a fundamentally different monetization logic from interchange fees or settlement spreads.

That structure scales without proportional capital cost. Mastercard does not need to build settlement infrastructure in every new corridor. It needs to convince enough institutions that its assurance signal is worth accepting. That is a business Mastercard has been running for decades, under different names and across different asset classes.

JUST IN: Chris Dixon says stablecoins now rival major payment networks like Visa with $300 billion issued, calling regulation of the remaining 90% of crypto the next big unlock for builders pic.twitter.com/7nKk4gxtcW

— crypto.news (@cryptodotnews) May 6, 2026

The correspondent banking analogy

The single-audit compliance model at the center of the Borderless.xyz pilot is not a new concept. It is the operational foundation of wholesale banking, adapted to a new asset class.

Correspondent banking solved the same counterparty problem decades ago. When a bank in Brazil sends funds to a bank in Japan, neither institution re-audits the other’s customers from scratch on every transaction. The originating bank performs its own KYC and AML checks and passes that information through the correspondent chain. Downstream banks trust the originating work because the relationships between institutions are governed by standing bilateral agreements, shared regulatory frameworks, and in many cases explicit guidance from central banks about what constitutes acceptable correspondent due diligence.

The trust is portable. The verification does not repeat at every hop.

Stablecoins lack that infrastructure. Today, when a stablecoin payment operator adds a new provider, the counterparty verification process restarts. Every new partner triggers a new compliance conversation. The payment network expands, but the compliance workload expands in parallel rather than flattening out. At the scale Borderless.xyz operates, across 260 corridors and more than 100 countries, that friction is a structural ceiling on how fast the network can add participants.

Mastercard already moved toward addressing this before the Borderless.xyz pilot. In March 2026, it launched its Crypto Partner Program, enrolling more than 85 digital asset companies, payment providers, and financial institutions into a shared framework for cross-border stablecoin payment flows. Circle, Binance, and Gemini were among the named participants at launch. The Crypto Credential network that underlies the Borderless.xyz pilot is the next layer of that program: moving from enrollment to an operational trust signal that travels with each transaction.

The correspondent banking model proved as effective for fiat as any alternative. Whether the same logic transfers cleanly to stablecoins depends on a question the pilot has yet to answer: whether downstream compliance teams will accept another firm’s verification as adequate for their own supervisors. That question is regulatory, not technical.

Why the GENIUS Act created the demand

The timing of the pilot is not accidental. President Trump signed the Guiding and Establishing National Innovation for US Stablecoins Act, known as the GENIUS Act, into law on July 18, 2025, giving the United States its first federal framework for fiat-backed stablecoins. The law imposed licensing requirements, reserve standards, and mandatory AML and KYC controls on stablecoin issuers operating in the US market.

One year later, on July 18, 2026, federal stablecoin regulators missed the key deadline for issuing implementing rules under the Act. The Office of the Comptroller of the Currency published draft regulations earlier in 2026, but final rules were not in place when the statutory deadline passed. The resulting gap left stablecoin operators navigating an environment where the compliance obligations were clear in principle but the acceptable mechanisms for satisfying them remained unspecified in detail.

That gap is exactly where the credential fits. If a stablecoin issuer must verify the identity of every party in a transfer chain, and if regulators have not specified how that verification must work at the network level, a portable assurance signal from a recognized global payments network is a commercially reasonable answer to an open compliance question. Mastercard is building one and positioning it as the default industry approach before the rules are finalized.

Globally, the same logic applies. The EU’s Markets in Crypto-Assets regulation is in effect for European stablecoin operators. Similar frameworks in Hong Kong, Singapore, and the UAE have introduced AML and identity requirements that apply to cross-border flows. The FATF Travel Rule, which requires sharing sender and recipient identity data on transfers above a minimum threshold, operates across most major jurisdictions and has been one of the most operationally challenging requirements for cross-border payment networks to satisfy.

Crypto Credential addresses Travel Rule compliance by design, exchanging the required metadata automatically while using aliases to avoid exposing raw wallet addresses across the counterparty chain.

USDC already began functioning as a compliance-ready stablecoin for institutional counterparties in the period after the GENIUS Act passed, because its reserve structure and governance already matched the law’s core requirements. Crypto Credential extends that logic from the stablecoin level to the counterparty level, making the identity of the sender and recipient as verifiable as the backing of the coin itself.

Why settlement rails are not the whole story

Mastercard’s acquisition of BVNK, a stablecoin infrastructure firm valued at up to $1.8 billion, closed during the same week as the Borderless.xyz pilot announcement. The proximity of the two events was deliberate. BVNK provides the payment rails. Crypto Credential provides the passport office. Mastercard is building both simultaneously, and the separation between the two products reveals where it thinks the durable competitive advantage actually lies.

Advertisement

Settlement infrastructure is increasingly a commodity. Dozens of stablecoin orchestration platforms, cross-border networks, and blockchain bridges compete on speed and cost. Borderless.xyz’s Q2 2026 data shows stablecoin pricing had already crossed below interbank FX rates in February 2026. Speed is not a differentiator when a growing number of networks can settle a cross-border stablecoin transfer in under a minute.

Trust verification is structurally different. A compliance signal is only as valuable as the network it travels through and the institutions that recognize it. Mastercard operates a global network with 3.5 billion cards in circulation, acceptance at more than 150 million merchant locations, and relationships with regulated financial institutions across every major market. That network credibility cannot be replicated by a startup compliance provider in any reasonable timeframe.

Mastercard brought USDC, RLUSD, and PYUSD onto its global settlement network in June 2026, signaling that the settlement product and the compliance layer are being built in parallel toward a single end state. The credential is not a standalone product. It is the trust component of an end-to-end stablecoin banking stack that Mastercard is assembling piece by piece.

On the same day as the Mastercard and Borderless.xyz announcement, Visa revealed its Visa Direct stablecoin initiative through Zero Hash, adding stablecoins to its cross-border payout network across 18 billion endpoints. Both moves in the same 24-hour window made the competitive dynamic explicit. Mastercard and Visa are not racing to process the most stablecoin transactions. They are racing to own the verification layer that every stablecoin transaction must pass through to meet regulatory standards. The settlement product follows the trust layer. Whoever controls verification controls the network.

Advertisement

The case against: trust as a centralization vector

The Crypto Credential model carries a structural tension that the pilot announcement did not address directly. Correspondent banking works because the relationships between institutions are governed by regulators, legal agreements, and decades of supervisory practice. The trust is portable because it is backed by accountable intermediaries with legal standing in multiple jurisdictions, and because regulators in each country can trace and audit the chain of responsibility.

Stablecoin advocates have long argued that the point of blockchain-based payments is to reduce dependence on exactly those intermediaries. A compliance passport issued by Mastercard and recognized across a private network reintroduces the intermediary in a new form. The credential holder becomes dependent on Mastercard’s continued operation of the network, its governance decisions about which verification standards to accept, and its willingness to maintain the program across each of its participating corridors. If Mastercard changes its standards, enters a regulatory dispute, or exits a specific market, the credential may lose recognition in that jurisdiction without warning.

That concern is not exclusive to Mastercard. Any portable compliance signal issued by a private entity carries the same dependency risk. The structural alternative is on-chain attestation, where verification is written to a public blockchain and readable by any counterparty without a central issuer. Proponents argue it is more censorship-resistant and more consistent with the design goals of permissionless networks. No major stablecoin issuer had adopted a decentralized attestation standard as its primary compliance mechanism as of August 2026, but multiple protocols are building in that direction.

Several details remained undisclosed as of the announcement: the transaction count and dollar volume the pilot will cover, the test duration, which regulators have reviewed the single-audit model, and whether additional operators can join during the pilot phase. The companies published their design intent, not an assurance-signal specification or a production timeline.

Advertisement

Most importantly, the pilot changes nothing about each operator’s own regulatory obligations. Infinia, Walapay, and Koywe remain individually responsible for satisfying their own supervisors. The Crypto Credential signal may reduce the operational cost of counterparty verification across the network, but it does not substitute for direct regulatory compliance by any individual participant.

What the volume numbers mean for the compliance business

Circle’s Q2 2026 report recorded $14.8 trillion in on-chain stablecoin volume, up 151% year on year. The total stablecoin market circulates approximately $308 billion across 386 individual stablecoins. Those numbers reframe what Mastercard is building toward.

At that volume, the compliance cost of re-executing counterparty verification for every new provider pairing becomes a material drag on network growth. If opening each new payment corridor requires weeks of bilateral due diligence before the first transaction can settle, the practical expansion of stablecoin payment networks is constrained not by technology or liquidity but by compliance staffing and legal capacity. The bottleneck is human, not technical. And human bottlenecks do not scale proportionally with transaction volume.

A portable assurance signal that compresses that process is, at its core, a productivity product. The market extends well beyond the 85-plus members of Mastercard’s Crypto Partner Program. It covers every bank, fintech, and institutional treasury desk that needs to send or receive stablecoin transfers under GENIUS Act or MiCA obligations but does not want to build its own counterparty verification stack. Buying access to a recognized compliance network is faster and cheaper than building an alternative.

Advertisement

Mastercard’s position after the GENIUS Act has been consistent throughout 2025 and 2026: it sees regulated stablecoins not as a replacement for its existing network but as a new asset class that needs the same compliance and consumer protection infrastructure that fiat card payments already carry. Crypto Credential is the mechanism through which that infrastructure extends to blockchain-native transfers. Whether it reaches production at the scale Mastercard is projecting depends on whether downstream compliance teams at regulated institutions trust the network enough to stake their regulatory relationships on it.

What to watch

Pilot graduation to production. The Borderless.xyz pilot covers three initial operators across a limited set of corridors. Watch for Mastercard to announce a broader rollout timeline, including the minimum operator count or transaction volume required before the credential moves to general availability on the network.

Regulator acknowledgment of the single-audit model. The OCC proposed stablecoin rules in early 2026, but final rules remained pending when the July 2026 statutory deadline passed. Watch for explicit regulatory guidance on whether a portable private-network assurance signal satisfies the GENIUS Act’s identity verification requirements.

Visa’s counter-move on the compliance layer. Visa Direct’s August 5 stablecoin announcement through Zero Hash addressed payment rails, not the identity or compliance layer. Watch for Visa to announce a corresponding verification framework for its stablecoin corridor, which would confirm that both card networks see the trust layer, not the settlement rail, as the primary competitive prize.

Advertisement

On-chain attestation gaining institutional traction. Decentralized identity protocols and public-chain KYC attestation projects offer a structurally different alternative to the Mastercard model. Watch for any major stablecoin issuer or regulated exchange to adopt a public-chain attestation standard as a primary compliance mechanism, which would put the two architectural approaches in direct regulatory and commercial conflict.

BVNK integration timeline. With the acquisition closed, watch for Mastercard to show how BVNK settlement rails and Crypto Credential compliance operate as a combined commercial product. A joint offering would confirm that Mastercard is building an end-to-end stablecoin stack, not a collection of separate services.

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. All facts were accurate to the best of our knowledge as of August 6, 2026. Readers should conduct their own research before making any financial or investment decisions.

Advertisement