Compromised keys, not broken code, now drive the majority of crypto theft, and North Korea is cashing the checks.

Eight months into the year, and the crypto industry has already replayed the same failure mode enough times to fill a textbook. The attack surface has not changed. Protocols keep trusting a small number of keys, signers, and verification nodes, and attackers keep finding that it is cheaper to compromise one person than to break one smart contract.

The numbers are stark. CertiK’s Hack3d H1 2026 report and Forbes both put total crypto hack losses at $1.3 billion through the first half of the year. TRM Labs arrived at a similar figure, noting that losses were trending just below the $1 billion mark for DeFi alone. The rekt.news leaderboard, which tracks individual exploits above $3 million, lists more than 30 incidents from 2026 so far, with the top two alone accounting for $575 million.

What separates 2026 from prior years is not the dollar amount. It is the attack taxonomy. The year’s biggest thefts did not exploit reentrancy bugs, flash loan loops, or oracle manipulation. They exploited people. Social engineering, session hijacking, validator key theft, and governance capture now drive the majority of losses by dollar value. The code passed every audit. The humans around it did not.

Two hacks, one playbook, $575 million gone

The year’s defining moment happened in an 18-day window between April 1 and April 18.

On April 1, attackers drained Drift Protocol of $285 million in 128 seconds. Drift was Solana’s largest perpetuals exchange. The exploit did not touch a single line of smart contract logic. The attackers had spent months posing as a quantitative trading firm, attending conferences, meeting Drift contributors in person across multiple countries, and building the kind of trust that this industry runs on.

By the time they struck, they had obtained pre-signed authority from Drift’s Security Council using a durable nonce, a legitimate Solana feature. They whitelisted a worthless token called CVT, deposited 500 million of it as collateral against a fake oracle they had controlled for three weeks, and withdrew $285 million in USDC, SOL, and ETH.

Neodyme’s 2024 audit had flagged the exact mechanism. The report noted that admin instructions like InitializeSpotMarket accepted an oracle account with zero validation. It was rated informational, reasoning that only the admin could call it. Two years later, the admin key was in the wrong hands, and the informational finding became a nine-figure exit.

Seventeen days later, on April 18, KelpDAO lost $290 million through its LayerZero bridge. The method was entirely different. No conference circuit, no fake trading desk. Someone social-engineered a LayerZero Labs developer on March 6, lifted their session keys, and used that access to poison the RPC infrastructure feeding LayerZero’s verifier network. External nodes were DDoS-ed into silence. The remaining compromised nodes signed off on a forged cross-chain message, and the bridge minted 116,500 unbacked rsETH.

The stolen rsETH went straight into Aave as collateral, borrowed real WETH against itself, and moved out before the emergency multisig had assembled enough signatures to pause. Aave’s total value locked dropped $6.28 billion in 48 hours. Nine protocols froze markets. Arbitrum’s Security Council used emergency powers to seize 30,766 ETH from the attacker’s wallet on-chain, a move that split opinion almost as much as the exploit itself.

Both hacks passed their audits. Both teams had followed standard security practices. Both lost everything to a single compromised key.

The Lazarus assembly line

Investigators linked both Drift and KelpDAO to TraderTraitor, a subgroup of North Korea’s Lazarus Group. Mandiant, CrowdStrike, Elliptic, and LayerZero jointly confirmed the KelpDAO attribution. Elliptic tied Drift to the same unit with medium-high confidence.

This is not new. Lazarus was behind the $1.5 billion Bybit hack in February 2025, identified by on-chain investigator ZachXBT within hours. Before that, the same group hit Radiant Capital, the Ronin Bridge, WazirX, and Harmony’s Horizon Bridge across 2022 through 2024. The U.S. Treasury, FBI, and CISA have all published joint advisories naming the group and its tactics.

What changed in 2026 is the sophistication of the social engineering layer. The Drift attackers built relationships over months. The KelpDAO attackers targeted a specific developer’s session credentials. In both cases, the initial breach happened through trust, not technology. The technical exploitation only began after the human layer was already compromised.

CertiK’s Ronghui Gu put it plainly in an interview with Forbes: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.” That quote now reads more like a warning label than an observation.

Bybit has since sued North Korea, its intelligence agency, and the Lazarus Group in U.S. federal court, trying to recover assets from the $1.5 billion hack. The legal theory is novel, but it underscores how few options victims have when the attacker is a sovereign state.

The math is uncomfortable. Drift ($285 million) plus KelpDAO ($290 million) equals $575 million from a single threat actor in 18 days. Against a total 2026 loss figure of $1.3 billion, Lazarus accounts for at least 44% of all stolen funds. If you include the Bybit hack from late February 2025, the group’s rolling 18-month tally exceeds $2 billion.

Bridges keep breaking the same way

Bridges are crypto’s soft underbelly. They have been since the Ronin Bridge hack in 2022 ($624 million), the Wormhole hack ($326 million), and the Nomad hack ($190 million). Four years later, the pattern has not changed.

In 2026, bridge exploits include KelpDAO ($290 million, single-verifier compromise), AFX Trade ($24.15 million, five compromised validator signatures on an Arbitrum USDC bridge), and VerusCoin ($19.14 million across two separate exploits of the same Ethereum bridge in May and July). The Cosmos EVM underflow bug hit three chains in quick succession: MANTRA ($3.6 million), TAC ($7.5 million), and KiiChain ($9.7 million), all through the same cross-shard receipt replay vulnerability.

The common thread is verification. Bridges must confirm that a message or transaction on one chain is valid before executing it on another. That confirmation almost always relies on a small set of signers, validators, or oracle nodes. Compromise enough of them, and the bridge does exactly what it was designed to do: release funds on the destination chain against what it believes is a legitimate request from the source chain.

AFX Trade is a case study in how thin the margins are. On July 22, five compromised validator signatures cleared the two-thirds quorum on its Arbitrum bridge, draining $24.15 million in USDC. The attacker moved the funds to Ethereum, swapped for 12,467.5 ETH, and consolidated into a single wallet. All of this happened 49 days after AFX had proudly promoted a security audit from Zellic. That audit documented zero test coverage and left acknowledgments unfixed. The dispute window on the bridge was 200 seconds. It disputed nothing.

The VerusCoin Bridge was hit twice: $11.6 million in May, then $7.54 million in July. Same bridge, different gap in the same broken trust boundary. The second time, there was no statement, no bounty offer, no communication at all.

The fix is known but rarely applied. Multi-verifier configurations, where a bridge requires confirmation from multiple independent verification networks before releasing funds, would have stopped both the KelpDAO and AFX Trade exploits. LayerZero publicly blamed KelpDAO for running a single-verifier setup. KelpDAO fired back with Dune data showing 47% of all LayerZero OApp contracts, more than 1,200 of them, use the exact same configuration. Over two and a half years and eight documented integration conversations, KelpDAO says LayerZero reviewed its setup each time and raised no objections.

This is the real scandal. The fix exists. The infrastructure supports it. Almost nobody uses it.

Audits are checking the wrong surface

Rekt.news published an editorial in July 2026 titled “Wrong Attack Surface” that crystallized what the year’s exploits had been screaming: the biggest losses all passed their audits because auditors were checking the code, and the code was fine.

CredShields put it directly in their Drift post-mortem: the attack surface has moved “up the stack to governance, to signers, and to the people building the protocols themselves.”

Traditional smart contract audits review Solidity or Rust for reentrancy, overflow, and access control bugs. They do not review operational security practices, key management procedures, social engineering resilience, or the off-chain infrastructure that feeds data to on-chain contracts. The KelpDAO exploit happened in LayerZero’s RPC infrastructure, which sat outside every audit scope. The Drift exploit happened through social engineering that compromised an admin key, which no code audit is designed to catch.

The Coldcard exploit is the most extreme example. On July 30, 2026, attackers began draining Bitcoin wallets secured by Coldcard hardware devices. A firmware bug had swapped the hardware random number generator for a predictable software fallback, shrinking the entropy of wallet seeds to a brute-forceable range. No phishing, no malware, no stolen device. Attackers ran the math on their own machines, derived candidate addresses, matched them against the public blockchain, and extracted the private keys for free.

Galaxy Research traced the initial wave to 1,082.65 BTC stolen from 1,196 addresses in 41 minutes. By August 7, the high-confidence tally had grown to 1,596 BTC from roughly 7,300 addresses, with candidate-inclusive estimates pushing past 2,055 BTC, or roughly $130 million. More than 25 separate attack patterns were identified. At least 15 independent attackers exploited the same flaw.

Coinkite, the maker of Coldcard, issued a preliminary advisory the same day and CEO NVK posted a public apology. But a firmware update could not fix wallets whose seeds had already been generated with the broken entropy. Those seeds needed to be replaced entirely.

The Coldcard incident is not a DeFi hack in the traditional sense. It is something worse: proof that the compromised key problem runs deeper than protocol governance. Even users who did everything the self-custody playbook recommends, hardware wallet, offline signing, no third-party custody, lost funds because the key generation itself was flawed.

What actually fixes this

The boring answer is the correct one. The 2026 exploit pattern has three failure points, and each has a known mitigation that most protocols have not adopted.

Key management: Multi-party computation (MPC) wallets and hardware security modules (HSMs) with threshold signing eliminate the single-key risk that enabled the Drift hack. Timelock delays on admin actions, combined with on-chain monitoring that alerts when privileged transactions are queued, give security teams a window to respond. Drift’s 128-second drain worked because there was no delay between key compromise and fund extraction.

Bridge verification: Multi-verifier configurations, where two or more independent verification networks must agree before a bridge releases funds, are the direct answer to the KelpDAO single-verifier failure. LayerZero supports this natively. The fact that 47% of its applications still run single-verifier setups is a configuration problem, not a technology problem.

Operational security: No code audit can protect against social engineering. Protocols handling nine-figure TVL need dedicated operational security programs: hardware-enforced authentication for all privileged access, mandatory multi-signature requirements that cannot be bypassed by a single signer, and security training that treats social engineering as a primary threat vector.

The Cosmos EVM underflow bug offers a different lesson. Cosmos Labs had known about the bug since April 2026 but misjudged its severity. When it was finally exploited across MANTRA, TAC, and KiiChain in August, all three chains halted too late. The funds had already bridged out. Responsible disclosure only works if the recipients treat the disclosure with urgency.

Term Labs’ governance attack ($8.5 million, August 2026) points to another gap. Near-zero voter participation let one wallet seize control of the protocol’s vaults for minimal cost, bypassing the governance delay entirely. When nobody votes, governance is just another attack surface. Quorum requirements, vote-locking periods, and guardian mechanisms that can veto suspicious proposals during a review window are standard tools that Term Labs had not implemented.

What to watch

The second half of 2026 will determine whether the industry treats these failures as lessons or as tolerable costs of doing business. Five indicators will tell the story:

Multi-verifier adoption rate on LayerZero: If the percentage of single-verifier OApps drops meaningfully from 47% by year-end, the KelpDAO lesson landed. If it holds steady, expect a repeat.

Timelock adoption on admin keys: Watch for protocols above $100 million TVL implementing mandatory delays on privileged transactions. Drift’s 128-second drain should make this non-negotiable.

Lazarus Group attribution in new exploits: The U.S. Treasury, Chainalysis, and TRM Labs all track Lazarus activity. Any new attribution to TraderTraitor signals that the group’s social engineering pipeline remains operational.

Cosmos EVM patch adoption across IBC chains: The underflow bug hit three chains. Dozens more run the same codebase. The speed of patching across the Cosmos ecosystem will show whether cross-chain coordination has improved.

Insurance protocol payouts and capacity: On-chain insurance providers like Nexus Mutual and Sherlock absorbed significant claims in H1 2026. If underwriting capacity shrinks or premiums spike, it signals that the market is pricing in continued attacks at current levels.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions. Information is accurate as of Sept. 4, 2026.

AMC Entertainment CEO Adam Aron has raised fresh concerns about Robinhood’s “tokenized stock” products, arguing that the offerings have no affiliation with AMC and that the company will ask its outside securities counsel to investigate the matter. In an X post on Friday, Aron called Robinhood’s tokenized AMC exposure “outrageous,” adding that Robinhood stock tokens are not registered under U.S. securities laws.

Aron also suggested the products may be restricted from being offered to U.S. investors and face additional limitations in other jurisdictions, including Canada, Switzerland, and the UK. The remarks add to an escalating pattern of scrutiny around tokenized stocks—blockchain-based instruments intended to track the value of traditional listed shares.

Key takeaways

• Adam Aron says Robinhood has “no affiliation” with AMC for its tokenized stock offering and is seeking a review by outside securities counsel.
• Aron characterizes Robinhood tokenized stock products as “outrageous” and says they are not registered under U.S. securities laws.
• The criticism also points to potential cross-border offering restrictions, naming Canada, Switzerland, and the UK.
• The dispute arrives amid broader industry tension over tokenized stock campaigns that have faced cancellations, including in connection with tokenized IPO access.
• Robinhood’s tokenized stock program has evolved from earlier tokenized debt structures to an Ethereum-layer 2 ecosystem centered on Robinhood Chain.

Aron questions Robinhood’s tokenized AMC exposure

Aron’s comments were direct: he told X users that Robinhood has no affiliation with AMC regarding the company’s tokenized stock offerings designed to provide economic exposure to AMC shares. He further stated that Robinhood will request an investigation from outside securities counsel.

While Aron’s post does not spell out specific legal or operational details beyond affiliation and registration concerns, it frames the issue as one of investor-facing legitimacy—both in terms of corporate relationship and compliance with U.S. securities regulations. He also noted that the offerings “may not be offered to US investors” and are subject to restrictions in multiple other countries.

Robinhood co-founder and CEO Vlad Tenev responded publicly on X by asking Aron to share his exact concerns regarding the tokenized offering. According to the reporting, Robinhood did not issue a separate public statement.

What “tokenized stocks” are—and why regulators and issuers are watching

Tokenized stock products are designed to deliver economic exposure to traditional equities using blockchain-based representations. In the case of Robinhood’s ecosystem, the company’s earlier “stock tokens” were launched as tokenized debt securities issued by Jersey-based Robinhood Assets and structured as ERC-20 tokens.

Aron’s criticism reflects a broader debate that has emerged across the tokenized asset market: who bears responsibility for compliance, and what level of legitimacy and disclosure is required when tokenized instruments are tied to the performance of well-known public companies. When issuers or executives claim a lack of affiliation, it can also raise questions about branding, marketing, and investor expectations—especially for retail audiences.

For investors, the key issue is practical: if a tokenized product is not clearly registered—or if jurisdictions treat it differently—then availability, settlement, and redemption pathways may not match what users assume from the “stock-like” wrapper.

Broader backlash linked to tokenized IPO campaigns

Aron’s comments arrive after another high-profile controversy involving tokenized stock offerings tied to IPO access. Earlier this year, major crypto exchanges reportedly canceled tokenized SpaceX IPO allocation campaigns and, in some cases, pointed to execution or delivery limitations tied to underlying asset transfer.

According to earlier reporting cited in the article, platforms including Bybit, Binance, Bitget Wallet, and MEXC canceled tokenized SpaceX IPO campaigns after SpaceX began trading on the Nasdaq. Several platforms attributed their decision to an inability to deliver the underlying assets associated with xStocks, which is described in the article as Kraken-owned.

That episode underscores a recurring vulnerability in tokenized equity narratives: even if tokenization is technically feasible, the compliance and mechanics of delivering the referenced securities—especially on time and in the correct jurisdiction—can determine whether such products remain viable. AMC’s situation may be distinct from IPO access arrangements, but it highlights the same underlying tension between “token-as-stock” marketing and real-world legal and settlement constraints.

Robinhood’s tokenization roadmap: from early tokens to Robinhood Chain

The article notes that Robinhood’s first generation of stock tokens launched in July 2026 as tokenized debt securities issued by Jersey-based Robinhood Assets, using ERC-20 tokens to represent economic exposure to underlying assets such as U.S. stocks and exchange-traded funds.

It also describes Robinhood’s subsequent push into infrastructure that can host tokenized assets. In February, Robinhood launched a public testnet for Robinhood Chain, an Ethereum layer-2 network built using Arbitrum technology. Later, in October 2025, Robinhood shared plans to tokenize nearly 500 U.S. stocks and ETFs on Arbitrum.

In July 2026, the article further points to coverage that Bernstein analysts raised their price target on Robinhood Markets, predicting that tokenized equities and prediction markets would drive growth in the next phase rather than traditional crypto trading.

Taken together, the roadmap illustrates why this dispute matters beyond AMC specifically. If tokenized assets are meant to become a durable product category for retail users, then questions about issuer affiliation, regulatory registration status, and jurisdictional availability can directly affect adoption, partner relationships, and—potentially—compliance strategy across the broader tokenization stack.

What to watch next

Aron says Robinhood will involve outside securities counsel, but the immediate uncertainty for market participants is what the investigation will conclude and whether Robinhood responds with clarifications about the legal basis for its tokenized stock products. Readers should also watch for how other issuers, regulators, and intermediaries react as tokenized equity offerings move from pilot phases toward wider deployment.

The Office of the Comptroller of the Currency granted OpenReserve preliminary conditional approval on Sept. 2 to organize a full-service insured national bank in Salt Lake City, Utah.

The approval does not allow OpenReserve Bank to begin banking operations. The company must satisfy the OCC’s capital, governance, security and compliance requirements before receiving final authorization.

OpenReserve plans a full-service national bank

OpenReserve applied for a national bank charter on April 13. Unlike limited-purpose national trust banks, its proposed institution would accept insured deposits and offer conventional lending alongside digital asset services.

The bank plans deposit products, commercial and retail lending, treasury management, payments and foreign correspondent banking. Its deposit products could include tokenized capabilities, according to the OCC’s eight-page decision.

OpenReserve also intends to provide digital asset custody through a subsidiary. Customers could use digital assets, including stablecoins, for cross-border remittances and other permitted payment activities.

The bank could receive transaction fees in cryptocurrency. It would generally need to convert those assets into fiat within one business day unless retaining them serves another permitted purpose, such as paying anticipated blockchain gas fees.

“OpenReserve Bank is our contribution to that tradition: durable financial infrastructure, built in the United States,” CEO Dee Choubey said.

The proposed services remain subject to final approval, product design, customer eligibility and operational readiness.

OCC requires $210 million before opening

The OCC requires OpenReserve to raise at least $210 million in initial paid-in capital after organizational and preopening expenses. The bank must maintain a tier-one leverage ratio of no less than 12% during its first three years.

OpenReserve must raise the capital within 12 months of conditional approval. It must begin banking operations within 18 months or the approval will expire, except in circumstances the OCC considers beyond the organizers’ control.

The company must apply for Federal Reserve Bank stock and obtain deposit insurance from the Federal Deposit Insurance Corporation. The charter application was submitted as a joint national bank and federal deposit insurance filing.

OpenReserve must notify the OCC at least 60 days before its proposed opening date. The regulator will then conduct a preopening examination covering operational readiness, governance, compliance and technology.

Stablecoin subsidiary requires a separate filing

OpenReserve plans to establish a wholly owned subsidiary for issuing, holding, converting and processing U.S. dollar-backed stablecoins. However, the OCC said an application for that subsidiary has not been filed.

Any stablecoin activities must comply with the GENIUS Act and its implementing regulations. The OCC retains sole discretion to determine whether OpenReserve’s structure and activities meet those requirements.

The bank must also give the regulator at least 60 days’ notice before materially changing its business plan. It cannot proceed with such a change until the OCC issues a written determination of no objection.

OpenReserve has described its planned onchain ledger and stablecoin infrastructure as supporting continuous settlement. These are intended capabilities, not services currently available to customers.

Security and compliance reviews come before launch

OpenReserve must establish programs covering the Bank Secrecy Act, sanctions compliance, credit risk and information security. It must also appoint an independent auditor and prepare financial statements under generally accepted accounting principles.

An independent reviewer must test the bank’s electronic platform, including protections against unauthorized access, malicious software and denial-of-service attacks. The OCC must also approve the final technology architecture and related risk-management plan.

OpenReserve announced seed backing from Andreessen Horowitz, Jump Capital, Coinbase Ventures, Wintermute Ventures and several other investors. It did not disclose the amount raised or confirm how much would count toward the $210 million requirement.

The decision arrives as more digital asset companies seek federal supervision. Crypto.news previously reported that the OCC listed 13 pending digital asset applications in August as Comptroller Jonathan Gould encouraged permissible crypto businesses to pursue national charters.

Most recent applicants have pursued limited-purpose trust charters. OpenReserve’s planned insured deposits and lending distinguish it from firms such as Crypto.com, whose proposed trust bank would focus on custody and settlement without accepting deposits or issuing traditional loans.

The OCC can modify, suspend or withdraw OpenReserve’s approval before opening. Final authorization depends on the company completing every preopening condition within the regulator’s deadlines.

The odds of a rate hike in September have fallen to 38% on Polymarket after Federal Reserve Governor Christopher Waller stated that his decision will depend on the upcoming August consumer price index (CPI) report.

Bitcoin (BTC) registered a sharp increase following Waller’s comments and reclaimed $80,000. The flagship cryptocurrency is up over 4%, trading around $81,271.

September Interest Rate Hike Odds Fall To 38%

Waller stated that cooler August inflation data could convince him to support holding interest rates steady at the upcoming Federal Reserve meeting. The Federal Reserve governor said inflation levels were moving toward the 2% goal, and employment was near its maximum sustainable level. However, Waller gave the CPI report more weight, stating that he does not expect the employment report figures to differ much from recent labor data.

Instead, he gave more weight to the August inflation report in deciding whether he will support keeping interest rates steady or increasing them from their present range.

“If there is continued progress toward our 2 percent goal, then I am willing to support holding the policy rate at its current level.”

Waller added he would consider supporting a hike if inflation numbers crept higher, adding that the Fed’s current policy stance gave the Fed some wiggle room as it only slightly restricted demand.

“If there is evidence that progress toward 2 percent inflation reversed in August, a small adjustment in our stance would help ensure that it resumes.”

Waller stated that explaining how the data could affect his decision allows investors, companies, and households to prepare for different policy outcomes. He supported the Fed’s decision to leave interest rates unchanged at the July policy meeting, explaining that the economy remained robust and showed early signs of disinflation.

Key Data Releases

The United States Bureau of Labor Statistics will release the August Producer Price Index (PPI) on September 10, and the Consumer Price Index on September 11, less than a week before the Fed’s decision on interest rates. The timing of the release gives policymakers a very small window to assess whether numbers continued easing in August.

The Personal Consumption Expenditures (PCE) index, the Federal Reserve’s preferred inflation gauge, rose 3.7% compared to the previous year and remains above the 2% target. The US-Iran conflict has added further uncertainty about upcoming data.

Federal Reserve Chair Kevin Warsh stated following the Jackson Hole meeting that inflation remained above the central bank’s target. CME FedWatch put the odds of a rate hike before Waller’s comments at 66%, after which the odds were revised to 50%.

Fed Officials Open To Rate Hike

However, Waller’s colleagues remain open to a September hike. Federal Reserve Governor Stephen Barr said in a September 1 speech that inflation had been higher than acceptable levels for over five years. Price growth fell from over 7% in 2022 to just over 2% in 2024, but stalled in 2025 as tariffs, the geopolitical situation in the Middle East, and AI spending pressured the economy.

According to Barr, Fed officials would act decisively and raise interest rates if they felt inflation remained high.

Federal Reserve officials were deeply divided over interest rates at the July FOMC meeting, with Beth Hammack, Neel Kashkari, and Lorie Logan favoring a 25-basis-point increase. Energy remains an area of concern for officials, with Brent crude climbing above $90 after renewed hostilities around the Strait of Hormuz, reigniting supply chain concerns. A jump in crude prices could have a domino effect on transport, production, and consumer costs.

Lower Odds Boost Bitcoin, Crypto

Odds of a rate hike rose to nearly 50% on Polymarket earlier in the week before falling to 38% following Waller’s comments. Meanwhile, expectations of no rate cuts following the upcoming meeting rose to 63%.

However, traders on Polymarket believe there will be at least one rate hike in 2026, with a separate contract putting that probability at 64%. Crypto investors will be watching any developments related to the decision on interest rates, which can affect demand through various avenues such as regulated investment products, Treasury yields, and the dollar.

Higher yields reduce demand for volatile assets like Bitcoin and increase it for interest-bearing money-market instruments and government debt.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Kalshi expanded its cryptocurrency derivatives lineup on Sept. 4 by launching perpetual contracts linked to BNB, Cardano, Worldcoin, Aave and Venice Token for eligible U.S. traders.

The contracts are margined and settled in U.S. dollars. They allow traders to take long or short positions without a fixed expiration date. Maximum leverage differs by asset, with approximately 4.5 times available for BNB and 1.9 times for Venice Token, according to the platform’s product information.

The additions bring Kalshi’s lineup to Bitcoin and 17 altcoin perpetual contracts. Existing markets include Ether, XRP, Solana, Hyperliquid and Zcash.

Kalshi crypto perpetuals expand to five more assets

The five additions cover several areas of the crypto market. BNB is the native asset of BNB Chain, while ADA supports the Cardano network. AAVE is the governance token of the Aave lending protocol.

Worldcoin’s WLD and Venice Token’s VVV provide exposure to projects connected with artificial intelligence. However, the availability of a perpetual contract does not establish the value, security or regulatory classification of its underlying token.

Kalshi’s contracts provide price exposure without requiring traders to hold the underlying assets. Gains and losses instead depend on changes in each reference price and the trader’s chosen position.

Leverage can magnify returns, but it also increases liquidation risk. A relatively small adverse price movement may eliminate a leveraged position’s margin. Perpetual contracts can also carry recurring funding or adjustment costs intended to keep their prices close to spot markets.

CFTC filing does not remove the legal dispute

Kalshi operates as a CFTC-regulated designated contract market. The new products appeared after the platform submitted contract materials through the regulator’s public filing system.

However, describing every filing as a separate CFTC “approval” may overstate the regulator’s role. Registered exchanges can introduce some products through applicable certification or review procedures. A filing’s presence in the CFTC database does not always mean the full commission held an affirmative vote on that individual contract.

The legal treatment of crypto perpetuals also remains contested. CME Group sued the CFTC after the regulator authorized Kalshi’s Bitcoin perpetual contract and issued related regulatory relief for Coinbase.

CME argues that perpetual products should be treated as swaps rather than conventional futures. That classification would subject them to a different regulatory structure. For background, crypto.news previously examined the legal dispute over how perpetual contracts should be classified.

CFTC asks court to dismiss CME challenge

The CFTC moved to dismiss CME’s lawsuit on Sept. 2, arguing that CME lacks standing because it can offer comparable products through its own registered exchange.

“This lawsuit is much ado about nothing,” the regulator’s lawyers said in the court filing. That statement represents the CFTC’s legal position, not a court finding.

The agency argued that CME had not demonstrated a concrete financial injury caused by Kalshi’s contracts. CME maintains that the regulator’s approach bypassed requirements established for swaps. As crypto.news reported in related coverage of the dismissal motion, the court has not ruled on either the standing question or the products’ classification.

Kalshi previously introduced Bitcoin perpetuals after receiving CFTC authorization in May. It subsequently added contracts tied to XRP, Zcash, Dogecoin, Shiba Inu and other assets. Its earlier expansion into XRP perpetual futures also brought cash-settled, non-expiring exposure to U.S. users.

What happens next for Kalshi and CME

Kalshi can continue offering the newly listed contracts while meeting applicable CFTC rules and its exchange obligations. Traders will need to monitor leverage, margin requirements, reference prices and any contract-specific costs.

Further additions are possible. Filings involving other assets, including XLM, DOT and HBAR, were reportedly awaiting completion, but their launch dates were not confirmed at publication.

The more consequential event will be the federal court’s response to the CFTC dismissal motion. The agency requested oral argument, although no hearing date had appeared on the public docket when the motion was reported.

A dismissal would end CME’s current challenge without necessarily resolving every legal question surrounding perpetual futures. If the case proceeds, the court could examine whether the CFTC properly treated Kalshi’s products as futures rather than swaps.

Pineapple Financial says it has migrated more than $1 billion of residential mortgage records onto Injective, marking a significant step in its plan to move a large portion of its funded loan portfolio onchain.

Injective announced Friday that Pineapple expects to eventually migrate over 29,000 funded mortgages worth more than $10 billion to the network. The approach is designed to keep each mortgage tied to its underlying loan file through an onchain record, rather than repackaging loans into a new mortgage security.

Key takeaways

• Pineapple Financial reports moving more than $1 billion in mortgage records onto Injective as part of an onchain migration of its existing portfolio.
• Injective says Pineapple plans to bring over 29,000 funded mortgages worth more than $10 billion onto the network.
• Each mortgage is represented by an onchain record with more than 500 data points to support verification, audit trails, and risk analysis.
• Token Terminal data indicates the PAPL0 asset market cap is about $1.1 billion, reflecting mortgage-record tokens rather than direct ownership of the underlying loans.

How Pineapple is tokenizing mortgages on Injective

Injective’s update frames the migration as a way to digitize and operationalize mortgage data on a layer-1 network built for financial applications. According to the company, Pineapple’s onchain records are linked to the underlying loan file, aiming to avoid creating a wholly new mortgage instrument in the process.

Each mortgage record includes more than 500 data points. Injective characterizes the dataset as intended for verification and audit workflows, as well as risk analysis that depends on having granular, loan-level information available in a consistent format.

Pineapple’s own dashboard, referenced by Injective, shows the initiative has expanded since it began in December 2025. The migration now includes 2,079 mortgage records, up from 1,259 at the time the effort launched.

What PAPL0 represents and why the structure matters

Token Terminal tracks PAPL0 as an asset associated with the mortgage records on Injective. The data cited in the announcement places PAPL0’s asset market cap at about $1.1 billion, up 48.2% over the past nine months, according to Token Terminal figures.

Crucially, Token Terminal’s project framing (as described in the original material) indicates that the tokens are meant to represent mortgage records, not ownership of the underlying loans themselves. That distinction is important for investors and counterparties trying to understand what is actually being transferred or referenced when token balances change—particularly in real-world asset (RWA) systems where legal ownership, servicing rights, and data integrity may not always map neatly onto token mechanics.

For market participants evaluating RWAs, this record-based model may also influence how due diligence is performed. Instead of relying on tokens as a proxy for the full legal construct of a mortgage, the onchain record is positioned as a structured data layer—potentially improving traceability and audit readiness.

Pineapple’s broader Injective ties and onchain treasury

The mortgage-record migration is part of a wider relationship between Pineapple and Injective. The material also points to a separate digital asset treasury connected to Injective’s native token, INJ, with Pineapple described as having a $100 million Injective treasury.

As part of that setup, Pineapple stakes INJ from the treasury. Kraken is named as a primary validator for the holdings, tying the arrangement to established institutional infrastructure for validating network activity.

Real estate tokenization continues, but remains small

The move sits within a broader push to bring real estate and other traditionally illiquid assets onto blockchains. Tokenization is often marketed as a way to divide interests, improve transferability, and broaden access—but the pace of adoption still varies widely by asset type and jurisdiction.

Earlier this year, several major finance players were highlighted in connection with tokenized real estate fund structures. In June, Apex Group joined other firms—including Goldman Sachs, Archax, and LRC Group—in a tokenized real estate fund effort where fund shares are issued as digital tokens through Goldman Sachs’ Digital Asset Platform. In that structure, blockchain-based ownership is used for the fund shares themselves, rather than simply recording property-related information onchain.

Dubai has also expanded its tokenized real estate initiatives. The reporting referenced that in February, the Dubai Land Department launched a second phase of a pilot after roughly $5 million in property had been tokenized, with transactions recorded on the XRP Ledger.

Still, despite recurring announcements, tokenized real estate appears to be only a small slice of the overall RWA ecosystem. The figures cited in the source state that the sector has about $226.5 million in distributed value, up 11.7% over the past 30 days. This is contrasted with approximately $38.8 billion across tokenized RWAs tracked by RWA.xyz.

What to watch next

With Pineapple increasing the number of onchain mortgage records and Injective targeting a scale-up to more than 29,000 mortgages worth over $10 billion, the key question for the next phase is how this record-based model performs in practice—especially around verification workflows, auditing, and how market participants interpret the relationship between tokenized records and the legal rights attached to the underlying loans.

Banco do Brasil has invested in a $5 million digitally native structured note issued by Citi on Euroclear’s blockchain-based infrastructure, completing what the lender described as the first transaction of its kind involving a Latin American institution.

Banco do Brasil said its proprietary treasury participated as an investor in the Digitally Native Structured Note issued by Citigroup Global Markets Funding Luxembourg SCA on Euroclear’s Digital Financial Market Infrastructure, or D-FMI, platform.

Citi Issuer Services, operating through Citibank N.A.’s London branch, served as the issuance and payment agent for the note.

The transaction gives Banco do Brasil direct exposure to a security issued and managed through blockchain infrastructure, part of a series of institutional experiments seeking to bring conventional financial instruments onto distributed ledgers.

Banco do Brasil enters digital note market through Citi deal

Banco do Brasil described the transaction as its first investment in digital notes and part of its work to assess new financial infrastructure built around distributed ledger technology.

Unlike a conventional note, which can depend on several systems and sequential processing steps, the digital instrument is issued, registered and managed through blockchain-based infrastructure.

Banco do Brasil said the structure can reduce operational steps while giving participants greater visibility over transaction records and supporting settlement, reconciliation and asset management within a more integrated system.

The bank participated through its proprietary treasury, placing it directly on the investor side of the issuance rather than acting only as a financial intermediary.

Its involvement comes as banks, payment companies and market infrastructure providers continue testing how blockchain can work alongside existing institutional systems.

Crypto.news previously reported that payments company Bottomline had connected its banking network with Chainlink infrastructure, giving more than 600 banks a route to blockchain-based settlement while retaining existing ISO 20022 messaging.

Bottomline processes more than $16 trillion in payments each year, and the integration was designed to connect conventional payment instructions with public and private blockchain networks.

Banco do Brasil’s transaction uses a different structure, with blockchain infrastructure supporting the issuance and management of an investment instrument rather than payment messaging.

Francisco Lassalvia, vice president of Wholesale Banking at Banco do Brasil, said the lender views financial market digitization as a long-term structural development.

“We believe that the digitalization of financial markets represents a long-term structural trend,” Lassalvia said.

He said transactions of this type can help establish standards, governance systems and infrastructure capable of supporting a new generation of digital assets.

According to Lassalvia, such systems could increase market efficiency while allowing financial institutions to pursue innovation with security and operational resilience.

Citi issues $5 million note through Euroclear D-FMI

Citi issued the structured note through Citigroup Global Markets Funding Luxembourg SCA, while Euroclear supplied the digital infrastructure used to create and manage the instrument.

Euroclear operates securities settlement and post-trade infrastructure for financial institutions across global markets. Its D-FMI platform extends that role to digitally native financial instruments built using distributed ledger technology.

The security was created in digital form on the blockchain-based platform from issuance, distinguishing it from structures where a conventional asset is created first and later represented through a token.

Banco do Brasil said native digitization can reduce the number of operational steps involved in handling an asset while improving transaction traceability.

Similar experiments have expanded across conventional finance as financial institutions test blockchain infrastructure for securities, funds, payments and collateral.

Circle, for instance, is preparing to launch an institutional blockchain whose founding validators include BlackRock, DTCC, Visa, Mastercard, Standard Chartered and Intercontinental Exchange. The network is expected to support tokenized financial assets, with DTCC planning to tokenize DTC-custodied assets on the chain beginning in 2027.

BlackRock is expected to deploy its tokenized BUIDL fund on the same network, allowing institutional participants to subscribe, redeem and use fund assets within an onchain environment.

The Banco do Brasil investment remains focused on a structured note rather than a fund or payment instrument, but it uses a similar underlying approach of placing parts of conventional financial-market activity on distributed ledger infrastructure.

Roksolana Dushynska, Global Markets Issuance Equity Structuring Manager at Citi, said the transaction formed part of the bank’s work in digital capital markets.

“The most recent issuance of our Native Digital Structured Note reinforces the role Citi is playing in accelerating the growth of digital capital markets,” Dushynska said.

She said distributed ledger technology was being used in capital markets to improve efficiency, transparency and accessibility for investors.

Citi intends to continue developing models using the technology as financial institutions examine new ways to issue, trade and manage assets, she added.

Digital notes can reduce conventional processing steps

Traditional securities infrastructure can involve separate systems and intermediaries handling issuance, registration, reconciliation, settlement and recordkeeping.

Information may need to pass between several platforms as a transaction moves through its lifecycle.

Under the model used for Banco do Brasil’s investment, the note is managed through blockchain infrastructure intended to provide participants with a common digital record.

Banco do Brasil said the setup has the potential to make settlement, reconciliation and asset management processes faster and more efficient while increasing transparency and traceability.

The distinction between digitally native securities and other blockchain-based financial products has become increasingly relevant as companies adopt different forms of tokenization.

Some tokenized products merely track the economic value of an underlying asset without giving investors ownership rights. Robinhood’s stock tokens, for example, provide economic exposure to equities without making token holders shareholders of the companies whose stocks they track.

Other models use blockchain as part of the actual securities issuance or registration process.

Banco do Brasil’s investment falls into the latter category because the structured note was issued natively through Euroclear’s digital market infrastructure.

Financial firms are testing similar models for trading. Uniswap founder Hayden Adams recently discussed how tokenized securities could trade directly against one another in blockchain-based liquidity pools rather than requiring every transaction to settle against dollars.

Ten tokenized stock pools against SPY had generated $33 million in trading volume from more than 11,000 traders when the proposal was discussed, showing another method through which blockchain infrastructure is being tested around conventional financial assets.

Banco do Brasil tests blockchain infrastructure for institutional products

For Banco do Brasil, the $5 million investment forms part of its assessment of technology that could support institutional products and financial-market infrastructure.

The lender said it is evaluating new infrastructure models that could contribute to modernization of the financial system and support products and services for institutional investors.

Its participation places a major Latin American bank directly inside a digitally native securities transaction conducted through established international financial institutions.

The structure retained several roles familiar to conventional capital markets. Citi remained responsible for issuing the note through its Luxembourg entity, its London branch handled issuance and payment agency functions, Euroclear provided the D-FMI platform and Banco do Brasil participated as the investor.

Banco do Brasil said financial institutions, regulators and investors worldwide have been paying increased attention to digital platforms capable of issuing and settling financial instruments.

Native digitization can reduce operational steps and provide a traceable transaction history while creating infrastructure that can support new models for trading, settlement and asset management, according to the bank.

The transaction took place on the 19th, with Banco do Brasil investing through its proprietary treasury and Citi and Euroclear handling the issuance and infrastructure functions for the $5 million digitally native structured note.

Canary Capital said its proposed Canary Staked TRX ETF is “coming soon,” pointing investors toward an amended registration statement filed with the U.S. Securities and Exchange Commission on Aug. 19.

The asset manager has not announced a trading date. Its latest filing remains a preliminary prospectus and states that securities cannot be sold until the registration statement becomes effective. No SEC effectiveness notice appeared in the fund’s public filing history as of Sept. 4.

The product would trade under the ticker TRXS. It would give investors exposure to TRX through ordinary brokerage accounts while also participating in the Tron network’s staking process.

Canary Staked TRX ETF would combine price and staking exposure

The fund’s primary objective is to track the price of TRX held by the trust, minus operating expenses and other liabilities. Its secondary objective is to earn additional TRX by staking tokens through the network’s proof-of-stake process.

Canary expects to allocate substantially all the trust’s TRX to staking. The prospectus says staking fees would not exceed 20% of generated rewards. Under the current structure, the trust would retain the remaining 80%.

The staking fees would be shared among the staking provider, Canary and the custodian. Rewards received by the fund would be included in its daily net asset value calculations.

This structure separates the proposal from crypto funds that only hold their underlying tokens. As crypto.news previously reported, competing BNB ETF filings excluded staking at launch, while Canary retained staking as a core part of its TRX proposal.

TRXS filing names its exchange, fee and custodians

TRXS is expected to list on Cboe under the prospectus, subject to the necessary regulatory and operational conditions. The fund would issue and redeem baskets containing 10,000 shares. Transactions could use either cash or TRX, depending on the circumstances described in the filing.

The Aug. 19 amendment set the annual sponsor fee at 1.10% of the trust’s TRX holdings. The fee would accrue daily and could be paid monthly in TRX or cash. Canary may waive part of the fee, but the prospectus says it has no obligation to do so.

BitGo Bank & Trust would hold the fund’s TRX. U.S. Bank would serve as cash custodian, while U.S. Bancorp Fund Services would provide administrative, accounting and transfer-agent services.

The filing also says CoinDesk Indices would provide the CoinDesk Tron Benchmark Rate used to calculate the fund’s net asset value. Investors could still buy or sell shares at a premium or discount to the reported value of the underlying TRX.

SEC filing is not approval or a launch confirmation

Canary originally submitted the fund’s Form S-1 in April 2025. Subsequent amendments added the TRXS ticker, Cboe listing plan, service providers, staking terms and final fee details.

However, an S-1 amendment does not mean the SEC has endorsed the investment. The prospectus explicitly says neither the SEC nor any state securities regulator has approved or disapproved the securities or judged the prospectus accurate.

Canary’s “coming soon” announcement therefore reflects the sponsor’s launch expectations. The company has not provided a firm date or confirmed that every remaining regulatory condition has been completed.

The filing also warns that the fund would not be registered under the Investment Company Act of 1940. Investors would consequently lack some protections available through registered investment companies.

TRX price shows limited reaction to the announcement

TRX traded near $0.328 on Sept. 4, approximately 0.6% higher during the session. Its intraday range was roughly $0.326 to $0.332.

The modest movement did not establish a direct connection between the ETF announcement and TRX’s price. Broader cryptocurrency conditions and network activity can also influence the token.

TRON’s expanding stablecoin business provides relevant context for the product. As crypto.news reported, TRON processed $2.1 trillion in quarterly USDT transfers during the second quarter of 2026. USDT supply on the network reached $87.9 billion at quarter-end.

What happens next for the TRX ETF

The clearest remaining milestone is an SEC notice declaring the registration statement effective. Canary may also file another amendment containing final launch information or updated commercial terms.

A final prospectus would normally confirm the trading date and any remaining operational details. Until those steps occur, TRXS should be described as a proposed or pre-launch product rather than an operating ETF.

As expectations regarding Federal Reserve policy for September shift, the digital asset market is once again in the spotlight.

On Sep. 3, Federal Reserve Governor Christopher Waller stated that if upcoming inflation data continues to show a cooling trend, he would favor maintaining current interest rates at the September meeting; however, he did not rule out further monetary policy tightening should inflation re-accelerate.

This statement alleviated some market concerns regarding immediate further rate hikes. Following the news, global stock markets strengthened, U.S. Treasury yields retreated, and market risk appetite improved. For the digital asset market—where shifts in interest rate expectations often influence capital flows and investor sentiment—attention has turned back to stablecoins and the digital financial infrastructure supporting them.

Unlike BTC, ETH, or XRP, USDC is a stablecoin pegged to the value of the U.S. dollar; its market focus lies not in dramatic price appreciation, but in the continued expansion of payments, trading, settlement, and institutional applications for digital assets.

Recent developments have also emerged within the USDC ecosystem. Circle launched “Circle Arc,” a blockchain centered on USDC that targets institutional payments, settlement, and compliant digital financial applications. The participation of institutions such as BlackRock, DTCC, and Visa in the validator ecosystem further underscores institutional interest in stablecoin infrastructure.

Meanwhile, investors are reconsidering a key question: amidst the volatility of the digital asset market, can long-term USDC holders generate additional returns through digital asset services beyond simply using the coin for trading and asset allocation?

Against this backdrop, an increasing number of USDC holders are shifting their investment strategies toward the EX DeFi cloud mining platform, seeking a more stable path for asset growth.

How will Federal Reserve policy changes affect USDC?

Federal Reserve monetary policy has long been a critical factor influencing global financial markets.

Currently, the Fed must still strike a balance between controlling inflation and sustaining economic growth. Waller’s latest remarks indicate that if future data confirms inflation is cooling, he would support holding rates steady; however, should August inflation data show a significant rebound, he might support a rate hike.

Consequently, investors are now paying closer attention to upcoming inflation and employment data. 

For USDC, changes in policy interest rates do not translate directly into the sharp price surges or drops seen with volatile assets like BTC or ETH. Instead, USDC’s strengths lie in its peg to the US dollar and its expanding utility in payments, trading, and digital asset settlement.

As the regulatory landscape for stablecoins matures and institutional participation in the digital asset market grows, USDC is evolving from a mere medium of exchange into a component of digital payment and financial infrastructure.

Why is EX DeFi attracting attention from USDC users?

For those seeking to generate extra income, traditional digital asset investments come with significant price volatility, while self-managed mining entails costs related to hardware, electricity, and maintenance.

EX DeFi combines a cloud mining model with AI-driven computing power management, offering users a way to participate without the need to purchase or maintain mining rigs themselves.

Key features of EX DeFi

Beginner-friendly:

Even users with no prior experience can get started easily; they can explore platform services immediately after registration and receive $17 in trial funds.

No hardware purchase required:

Users do not need to buy, deploy, or maintain specialized mining hardware, as they can participate in mining services via the cloud.

Security and compliance:

The platform adheres to international security standards—including McAfee®, Cloudflare®, and 2FA verification—and utilizes cold wallet isolation to enhance fund security.

Affiliate rewards program:

Users can earn up to 5% in affiliate rewards by referring friends, creating a source of long-term income.

Support for multiple digital assets:

The platform supports USDC as well as various mainstream digital assets, including XRP, BTC, ETH, USDT, BNB, DOGE, LTC, and SOL.

Green energy commitment:

EX DeFi’s infrastructure runs on 100% green energy and continues to expand its use of clean energy. It leads the digital asset industry toward low-carbon, eco-friendly development, contributing to global sustainability while generating value for users.

About EX DeFi

Founded in 2021 and headquartered in the UK, EX DeFi currently provides high-performance, cost-effective cloud mining solutions to over 2 million users across more than 180 countries and regions worldwide. 

Guided by the development philosophy of being “green, intelligent, open, and sustainable,” EX DeFi leverages innovative cloud mining technology and decentralized finance (DeFi) infrastructure to foster an efficient, low-carbon digital ecosystem, thereby creating long-term value for global users.

Get started with the EX DeFi platform in three simple steps:

Step 1: Register an account

Visit the official EX DeFi platform and create a free account using your email address. Receive $17 in trial funds upon registration.

Step 2: Select a contract

Choose a cloud mining contract that suits your budget and desired duration, then start automated mining with a single click.

Step 3: Start participating

Once the mining contract is activated, the system automatically allocates computing power to the mining pool and settles earnings within 24 hours. You can choose to withdraw your generated earnings or reinvest them for future opportunities.

Popular mining plans:

Investment: $100 | Duration: 2 days | Daily return: $4 | Total profit: $100 + $8

Investment: $500 | Duration: 6 days | Daily return: $6.5 | Total profit: $500 + $39

Investment: $1,000 | Duration: 10 days | Daily return: $13.5 | Total profit: $1,000 + $135

Investment: $5,000 | Duration: 20 days | Daily return: $73.5 | Total profit: $5,000 + $1,470

Investment: $10,000 | Duration: 30 days | Daily return: $161 | Total profit: $10,000 + $4,830

Visit the EX DeFi platform to view details on more investment contracts.

Conclusion

Recent statements from the Federal Reserve indicate that future policy direction will remain heavily dependent on inflation and employment data. If inflation continues to cool, market concerns regarding further monetary policy tightening may subside, thereby improving overall sentiment toward risk assets. 

Meanwhile, USDC is establishing itself as a key piece of in/frastructure in the digital asset market, driven by its stable US dollar peg and its expanding use in payments, settlement, and institutional applications. For users looking to explore yield-generating opportunities in digital assets, EX DeFi Cloud Mining offers an alternative way to earn passive income.

For more details, please visit the official website: https://exdefi.com/

Contact email: [email protected]