The U.S. Department of the Treasury has launched a formal rulemaking process for the payment-stablecoin framework established by the GENIUS Act, opening the proposal to public comment as regulators move toward a planned start date in January 2027.

In a notice released on Monday, Treasury said it is seeking input from market participants and other stakeholders ahead of the GENIUS Act’s implementation. Under the law’s timeline, stablecoin rules were set to take effect 120 days after agencies finalize the regulations, or 18 months after the bill was signed in July 2025—placing the effective date at Jan. 18, 2027, absent changes to the scheduling.

Key takeaways

• Treasury is proposing GENIUS-related rules and will accept public comments for 60 days after the notice appears in the Federal Register.
• GENIUS would generally require entities to have a federal or state license before issuing a “payment stablecoin” in the U.S.
• The law’s implementation is still expected for Jan. 18, 2027, but multiple agencies have reportedly missed earlier internal timing targets.
• Treasury’s proposed process is part of a broader 2026 rulemaking effort involving agencies such as the OCC, the FDIC, and the Federal Reserve.

Treasury opens GENIUS rulemaking to public comment

According to the Treasury Department, the notice of proposed rulemaking is intended to help establish regulatory certainty for businesses that want to build payment stablecoin products in the United States. Treasury Secretary Scott Bessent said the department welcomes feedback from stakeholders as it works to “provide the regulatory certainty businesses need to innovate and grow in America.”

The proposal matters because GENIUS is designed to move stablecoin oversight from a patchwork of approaches toward a clearer legal structure. Once the law takes effect, Treasury said, an entity generally would not be able to “issue a payment stablecoin” in the U.S. without a related federal or state license.

Public input is a key part of the process. Treasury stated that comments will be open for 60 days following publication in the Federal Register, giving industry participants, financial institutions, and other interested parties a defined window to weigh in on how the framework should operate in practice.

Inter-agency rulemaking is underway, but deadlines slipped

Treasury’s proposal follows similar steps by other U.S. agencies. In 2026, multiple regulators—including the Office of the Comptroller of the Currency (OCC), the Federal Deposit Insurance Corporation (FDIC), and the Federal Reserve Board—have reportedly issued their own notices of proposed rules related to implementing GENIUS.

However, the timing has become a focal point for observers. The report accompanying the Treasury notice says agencies missed a 120-day deadline in July to finalize regulations before January, raising the possibility that GENIUS could become effective without fully settled guidance.

This creates a practical problem for businesses trying to plan for compliance and product launches: even if the statute is scheduled to take effect in January 2027, companies may still be operating amid transitional uncertainty about the exact requirements they will need to meet.

For readers looking for additional background on the broader stablecoin rulemaking environment, earlier coverage noted how the OCC has advanced proposals aimed at resolving parts of the long-running debate over stablecoin yield and related practices. That context is reflected in the agency-by-agency approach to GENIUS implementation.

What GENIUS changes for payment stablecoin issuers

At the core of the framework is a licensing requirement that is meant to formalize who can issue payment stablecoins and under what authorization. Treasury’s notice indicates that once GENIUS is active, entities generally need a federal or state license before they can issue a “payment stablecoin” in the United States.

For investors and traders, this type of licensing can influence expectations around which stablecoins are likely to gain institutional support. For builders, it can affect how they structure reserves, partner with regulated institutions, and design compliance operations—especially if the market previously relied on regulatory uncertainty rather than clear authorization pathways.

It also raises an operational question that market participants will be watching: how quickly regulators will translate the proposed framework into final, implementable rules. Treasury’s comment period is designed to narrow that uncertainty, but the overall effectiveness timeline leaves limited margin for delays.

Cross-Atlantic coordination and competitive pressure

The U.S. rulemaking effort also intersects with international developments. In July, the UK-US Financial Regulatory Working Group met in London to discuss cooperation between U.S. and UK financial regulators, including implementation steps for GENIUS.

While the UK has taken steps to address stablecoin regulation, the pending rollout of GENIUS is leading some within the crypto industry to argue that the UK could be at risk of falling behind the U.S. in establishing a comprehensive, operational framework.

That perceived asymmetry matters because it can affect where stablecoin-related partnerships and compliance strategies form first. If the U.S. moves more decisively toward a standardized licensing approach, businesses may prioritize compliance-ready pathways there—at least until the UK’s own framework becomes equally concrete.

As Treasury’s proposed rules move through the comment period and toward finalization, the most important thing to watch will be whether agencies can converge on final requirements in time to reduce transitional risk before Jan. 18, 2027. If the broader suite of GENIUS regulations remains incomplete, market participants will likely press regulators for clarity on licensing timelines, compliance expectations, and how existing operations should adapt.

Crypto exchange Binance reportedly handed Russian authorities the transaction details of one of its customers despite fully withdrawing its operations from Russia in 2023. 

According to Reuters, the crypto exchange gave up the transfer history of Yuri Belenkiy, an IT specialist who holds a Bulgarian residency permit and Russian passport. 

Belenkiy was accused of terrorist financing by Russia’s Investigative Committee after he allegedly sent over $700 worth of funds to Ukraine’s military and another military group via Binance. 

Russia asked Binance to reveal further donations

Russia’s Investigative Committee claimed he made the payments after witnessing an online appeal from Arkady Babchenko, a Ukraine-supporting advocate exiled from Russia.

Crypto payments were allegedly sent between January 2023 and March 2024. The committee also pushed Binance to reveal who else had sent funds to the advocate, but it’s unclear whether Binance complied. 

“We have collected full evidence of the content on X, all of which is fabricated rumors,” Lee said. “During daytime US time, we will file a police report and send a lawyer’s letter to X, demanding technical and data forensics.”

Regarding unpaid staff, the founder of the Cayman Islands-based crypto exchange said, employee assets “are not prioritized over client assets, everyone is a client, and there are no privileges.”

An X user known as BeardStaff said their assets had been inaccessible since the July 26 announcement, and that a dedicated VIP manager removed them from Telegram the day withdrawals stalled. “Where is my $10 million?” they posted.

Another user cut straight to Lee’s hacked account claim.

“No one asked you if the account was hacked or not,” wrote @chicha_liam. “Answer what people have been asking you since July 26. When will users be able to withdraw their funds?”

Onchain investigator ZachXBT also pushed back. “If you actually have the liquidity, then simply return the funds to everyone instead of posting vague statements.”

Roshan Dharia, CEO of distressed investment firm Echo Base, told CoinDesk via Telegram that his firm has offered BitMart a funded restructuring package including debtor-in-possession financing and equity at emergence, underwritten by Echo Base as a claimholder. He said BitMart has not responded.

The SEC is developing an innovation exemption for platforms seeking to offer tokenized securities. The framework could let firms trade digital versions of U.S. stocks under federal requirements. Meanwhile, SEC Chair Paul Atkins supports efforts to move financial markets onto blockchain networks.

The proposed structure could allow continuous trading and faster blockchain settlement for eligible securities. It could also connect digital share records with established market systems and securities rules. However, the SEC still must address custody, surveillance, clearing, settlement, and investor protection.

The agency recently canceled a meeting that could have covered parts of its crypto regulatory agenda. Officials cited a scheduling issue, and the cancellation did not change requirements. Therefore, platforms seeking tokenized stock markets must continue operating within current regulations.

24/7 Trading Could Reshape Equity Markets

Tokenized stocks could extend trading beyond the fixed hours used by traditional U.S. exchanges. Blockchain networks can process transactions continuously, supporting trading at night, on weekends, and on holidays. Consequently, eligible markets could operate on schedules that differ from conventional venues.

The technology could shorten settlement times by recording ownership changes directly on blockchain networks. Yet tokenization does not remove market duties, because securities still require safeguards and clear ownership rights. Moreover, firms must determine how digital shares connect with brokers, custodians, clearing systems, and infrastructure.

The SEC has supported experiments involving blockchain-based securities infrastructure. Its no-action relief for a DTCC pilot covers selected equities, ETFs, and Treasury securities. Nasdaq has also developed infrastructure for trading and settlement of tokenized securities.

Wall Street Builds Tokenization Infrastructure

Financial firms and crypto companies are building systems that could support blockchain-based securities markets. These efforts focus on trading, custody, settlement, and links between digital networks and financial infrastructure. As a result, tokenization is moving beyond experiments and into market structure discussions.

The SEC is also considering changes that could affect trading models and competition. An August 11 submission from Ondo Finance backed proposed Regulation NMS changes affecting alternative market structures. Those changes could create more room for trading models outside traditional order books.

Tokenized shares would remain securities when blockchain networks record their ownership. SEC materials have distinguished between issuer-backed tokens and third-party models, which can affect shareholder rights. Therefore, the exemption could shape how firms issue, trade, custody, and settle U.S. equities.

On Saturday afternoon, Mark Cuban posted another crypto prediction, “Chips as an asset class will be the new crypto.” Within a day, the controversial, 10-word thesis became a trending topic and racked up over 1.2 million views.

The replies doubled as a highlight reel of Cuban’s dismal record with prior crypto predictions.

Cuban has been incorrectly predicting crypto prices for more than seven years, including a banana-based valuation framework and numerous deleted posts that are doubly embarrassing after Cuban both failed to predict crypto prices and then tried to erase the evidence.

Cuban also promoted an Iron Finance yield farm mere days before it imploded and went to $0, plus a “risk free” lender that went bankrupt.

He has also experienced a six-figure phishing loss of digital assets due to poor security and self-owned by selling out of his bitcoin (BTC) position.

Before anyone weighs in on Cuban’s belief that computer chips will outperform crypto, below is a review of his expired predictions.

‘I’d rather have bananas’

In a 2019 Wired interview, Cuban said BTC had even less intrinsic value than baseball cards, comic books, or artwork.

Confidently, he delivered a line that still haunts him, “I’d rather have bananas, I can eat bananas. Crypto, not so much.”

Weeks later, he doubled down, telling Forbes’ audience that BTC had “no chance” of becoming a reliable currency.

Since Cuban’s September 27, 2019 bearish opinion, the price of BTC has rallied 670%. BTC was trading near $8,200 at the time of Cuban’s “no chance” call.

Deleting his comparison of crypto to dot-com

By January 2021, Cuban was comparing crypto trading to the dot-com stock trading bubble of the late 1990s.

That post has since vanished from his account. 

A few months after he deleted that post, in an October 2021 social audio space on Twitter, Cuban called BTC “the best store of value” and said he actually owned it.

Fake downloads of The Odyssey have begun spreading Lumma Stealer malware through files disguised as high-quality movie releases, putting crypto wallets, passwords, and browser sessions at risk.

Bitdefender reported on Aug. 6 that its researchers had found malicious Windows executables using filenames designed to resemble pirated copies of The Odyssey, only days after the film’s release.

The Odyssey downloads conceal Windows executables

Disguised as video files, the downloads use familiar torrent labels such as 1080p, WEBRip, Blu-ray, and H264 to make the listings appear authentic. Bitdefender identified filenames including “the odyssey 2160phd (2026) engsubs eztv.exe,” “the odyssey 2026 1080p h264-djt.exe,” and “the odyssey 2026 1080p webrip-lama.exe.”

Rather than opening a movie, each .exe file launches software built to infect a Windows computer. Bitdefender said its security products prevented users from downloading or running the detected files, although the researchers warned that other filenames may also be circulating.

Attackers can make the disguise harder to spot by changing the executable’s icon to resemble VLC Media Player or an ordinary video file. Windows installations hide known file extensions by default, according to Bitdefender, which means a user may see a movie-style name and VLC icon without noticing the .exe ending.

People searching torrent sites may also expect unusual filenames, compressed folders, or a bundled video player, giving the malicious file another layer of cover. Bitdefender said the lure does not require a complex trick because the victim has already decided to download an unofficial copy from an unverified source.

Lumma Stealer can capture wallets and browser sessions

Once executed, Lumma Stealer searches the infected computer for browser passwords, saved payment information, autofill records, remote desktop credentials, and cryptocurrency wallet data, according to the security firm.

The malware also collects browser authentication cookies. Bitdefender warned that stolen cookies can let an attacker take over an active account session even when the victim has enabled multi-factor authentication, since the criminal may reuse a session that has already passed the login check.

Known as LummaC2, the malware is an information stealer developed in Russia and sold to other criminals as a service, according to Bitdefender and U.S. authorities. Its availability through underground markets allows buyers to run data-theft campaigns without building their own malware.

During its examination of the Odyssey files, Bitdefender observed attempts to contact command-and-control infrastructure associated with Lumma Stealer. Researchers identified the domains auditva[.]cyou, myroayy[.]cyou and logmabx[.]click, which the company said it had blocked for its customers.

Unlike some earlier versions, the samples found in the latest movie campaign did not use separate droppers or persistence tools, Bitdefender said. The operators instead appeared satisfied with collecting and sending available information during the initial execution.

Previous movie-based Lumma attacks used extra methods to avoid detection. Bitdefender found delayed execution when security software was present, encrypted payload delivery through AutoIt scripts, and other checks in a 2025 campaign built around fake copies of Mission: Impossible – The Final Reckoning.

U.S. agencies previously disrupted LummaC2 infrastructure

For U.S. crypto holders, LummaC2 has already drawn action from federal law enforcement. In May 2025, the Justice Department obtained warrants to seize five internet domains used by the malware’s administrators, while Microsoft filed a separate civil case covering about 2,300 other domains tied to the operation.

Court documents cited by the department said the FBI had identified at least 1.7 million cases in which LummaC2 was used to steal information. Listed targets included browser records, email and bank login details, autofill data, and crypto seed phrases that could provide access to virtual asset wallets.

“Malware like LummaC2 is deployed to steal sensitive information such as user login credentials from millions of victims in order to facilitate a host of crimes, including fraudulent bank transfers and cryptocurrency theft,” Matthew Galeotti, then-head of the Justice Department’s Criminal Division, said in the announcement.

The federal operation seized two domains on May 19, 2025. After LummaC2 administrators told customers about three replacement domains the next day, U.S. authorities seized the new addresses as well, according to the department.

Alongside the seizures, the Cybersecurity and Infrastructure Security Agency and the FBI issued a technical advisory describing how LummaC2 enters computers and removes sensitive information. The Justice Department directed people who believe a device has been compromised to contact the FBI’s Internet Crime Complaint Center or a local field office.

The appearance of new Lumma-linked domains in Bitdefender’s 2026 findings indicates that malware campaigns using the family continued after the 2025 enforcement operation. Bitdefender did not provide a victim count, estimated crypto loss, or geographic breakdown for the Odyssey campaign.

Crypto malware is using familiar content as bait

Movie torrents are one part of a series of malware campaigns that package harmful code inside content, applications, or tools that users actively seek.

Earlier in August, crypto.news reported that Microsoft had found a fake CAPTCHA campaign using BNB Chain smart contracts to retrieve attack instructions. Microsoft said the operation targeted thousands of consumer and business devices each day and delivered several malware families, including Lumma Stealer.

Instead of downloading a movie, people caught in that campaign were instructed to open Windows Run, Terminal, or PowerShell and paste a command supplied by the attacker. Microsoft warned that successful infections could expose credentials, install remote-access tools, and create an entry point for ransomware.

Mobile users have faced a different form of wallet theft. In July, reports renewed attention around SparkKitty mobile malware, which Kaspersky had previously found inside iOS, Android, and third-party applications. The spyware collected images from phone galleries, where some users had stored screenshots of wallet recovery phrases, passwords, and QR codes.

Developer tools have also become a delivery route. Socket disclosed in May that the TrapDoor malware campaign involved at least 34 harmful packages and 384 connected versions across npm, PyPI, and Rust repositories. According to the security company, the packages targeted crypto and artificial intelligence developers while seeking wallet data, GitHub tokens, cloud credentials, and SSH keys.

For the latest movie campaign, Bitdefender advised users to watch films through legitimate streaming services, avoid executables advertised as videos, and keep Windows and security software updated. The company also recommended enabling file extensions in Windows Explorer so an .exe file cannot appear to be an ordinary movie.