Phemex CEO Federico Variola says AI has been a ‘net negative’ for crypto, despite the crypto exchange announcing an AI-focused transformation earlier this year. 

Speaking on Cointelegraph’s Chain Reaction, Variola said AI has diverted capital away from the industry, while empowering attackers and driving up cybersecurity costs for smaller teams — pressures that risk pushing crypto toward greater centralization. 

“It’s difficult to be bullish about AI in crypto,” he said. “Liquidity have been significantly diverted to to that industry on one side. On the other hand, AI has empowered a lot of bad actors that have been exploiting protocols.”

“It’s difficult to envision a world in which AI is going to favor crypto specifically as an industry, since a lot of the fixes that we see actually encourage more centralization rather than less centralization.”

Variola’s assessment offers a skeptical view of AI’s impact on crypto. It also comes after his crypto exchange announced an AI transformation in February, when he outlined plans to embed the technology across product development and internal operations, though his latest views focused on the broader crypto industry. 

AI raises stakes for crypto security

Variola’s take also comes as AI has been linked to recent crypto exploits. 

In July, attackers drained roughly $116 million in Bitcoin from more than 5,200 addresses affected by a Coldcard hardware wallet flaw that is widely believed to have been discovered through the malicious use of AI. 

Coinkite CEO Rodolfo Novak warned developers at the time that the “sober reality” is that AI-assisted code review can now uncover bugs that outpace the industry’s most seasoned experts. 

“AI has empowered a lot of bad actors that have been exploiting protocols, whether with social engineering or… finding vulnerabilities,” said Variola, adding that small teams working on protocols will no longer operate without a massive cybersecurity budget. 

He also warned that the AI threats could make self-custody and decentralized finance less appealing. 

“As AI becomes more pervasive, and whether it is your devices being hacked or social engineering, or all these kinds of strategies that are empowering threat actors, that makes DeFi a lot less appealing for a retail user because you have to worry about so many things that you didn’t have as much before.”

On the other hand, security experts have also highlighted AI’s defensive potential. CertiK senior blockchain investigator Natalie Newson told Cointelegraph in April that “AI can also be one of the biggest defenses,” even as she warned that the technology was making attacks more sophisticated.

Despite his assessment of AI’s overall impact, Variola said he sees practical benefits with AI agents, specifically to help investors build a portfolio or help them make better trading decisions. However, Variola said he did not expect AI agents to fully replace human trading decisions. 

“At the end of the day, still it will be up to the user to make the final decision. So I don’t think that agents will ever replace that action of taking the trade.” 

Magazine: Why are AI’s biggest companies suddenly asking to slow down?

An attempted extraction of roughly $7.7 million worth of rsETH from an Ethereum Safe was disrupted after an MEV bot intercepted the transfer. Blockchain security firm Blockaid says the incident began with a malicious custom module attached to the victim wallet, which redirected liquidity into a setup designed to unwrap into rsETH.

According to Blockaid, about $7.73 million in rsETH had been compromised when it reported the attack. However, a separate automated actor captured the tokens first, and the receiving address was then placed under a short 24-hour pause by the rsETH protocol’s operator, Kelp.

Key takeaways

• Blockaid attributes the initial loss to a custom module connected to an Ethereum Safe wallet that was used to route tokens into a malicious Uniswap v4 hooked pool.
• An MEV bot (“Yoink”) front-ran the exploiter and obtained the rsETH before the attacker could control the funds.
• Kelp responded with a 24-hour pause at the receiving address level, while stating rsETH remains fully backed and its core contracts were not impacted.
• Minting, withdrawals, and integrations reportedly continued normally during the investigation.

How the Safe-to-rsETH extraction attempt worked

In its report, Blockaid described an exploitation path that leveraged Ethereum Safe’s module system. The attacker used a public “keeper multicall” to invoke a custom Uniswap v4 liquidity module associated with the victim Safe, steering funds into an attacker-created liquidity environment.

That attacker-controlled pool was configured so that aEthrsETH could be unwrapped into rsETH, effectively converting the routed position into the token the attacker intended to extract. Blockaid identified the affected wallet as a Safe belonging to an unidentified user, and said rsETH losses were on the order of $7.73 million at the time of its initial update.

Blockaid’s post also links the broader incident to a specific on-chain transaction on Etherscan, where the follow-on movement of assets showed how the attempted outflow unfolded.

The MEV bot that changed the outcome

Rather than letting the original exploiter take custody of the rsETH, an MEV bot known as Yoink stepped in first. As described in Blockaid’s account, Yoink monitors blockchain transactions for profitable opportunities, and in this case front-ran the step needed to capture control of the tokens.

Blockaid pointed to Etherscan transaction data showing Yoink transferring approximately 18.93 ETH—roughly $46,000 at the time of the observed conversion—to an address labeled as a “block builder” within the same transaction. While the figures relate to the bot’s subsequent transfer rather than the initial rsETH amount, they illustrate that the MEV opportunity was executed quickly after the exploit transaction entered the mempool.

In practical terms, MEV front-running did not “prevent” the exploit attempt from being constructed; it instead redirected the settlement outcome by capturing the assets before the attacker could complete its intended withdrawal path.

Kelp’s response: a targeted pause, not a protocol shutdown

After the MEV bot intercepted the tokens, Kelp—described as the protocol behind rsETH—placed the address that received the funds under a 24-hour pause. The move was aimed at temporarily preventing transfers from that destination while security experts investigated.

Kelp said the measure was a precaution at the wallet/address level and emphasized that the protocol’s own contracts were not the affected component. In a statement posted on X, Kelp characterized the pause as “a precautionary, wallet-level measure only,” adding that rsETH “remains fully backed.”

Importantly for holders, Kelp also indicated operational continuity: minting, withdrawals, and integrations were continuing normally as the investigation proceeded. The protocol’s messaging suggests that any risk exposure was contained to the exploited Safe/module pathway rather than a systemic contract vulnerability.

What remains uncertain—and what investors should watch

Based on Blockaid’s description and Kelp’s response, the incident centers on an attacker leveraging a custom module connected to a specific Safe, while Kelp asserts its core contracts were not compromised. Even with that reassurance, the episode underscores how Safe module permissions can be a critical control surface: if a malicious module is enabled or if the wallet is tricked into executing a malicious multicall, assets can be routed into nonstandard flows.

With Kelp’s 24-hour pause window now the immediate timeline focal point, the next questions are whether the paused address can be safely recovered, whether further addresses or transactions are linked to the same exploit chain, and whether similar module-based patterns emerge elsewhere. Readers tracking rsETH should also watch for updates from Kelp and security researchers on post-incident analysis and any guidance aimed at Safe/module operators.

Ripple has signed a new sports partnership with Louisville Athletics, placing the XRP logo across Louisville Basketball. The agreement begins with the 2026-27 season and covers both the men’s and women’s programs. XRP branding now sits alongside one of college basketball’s most recognized names.

XRP Logo Takes Center Court

The XRP logo will appear on Denny Crum Court during every Louisville home game. Meanwhile, the Coach Denny Crum logo will remain inside the three-point arc. As a result, the new XRP branding will coexist with a decades-old campus tradition.

Beyond the court, XRP signage will appear on courtside boards during television broadcasts. Additionally, XRP branding will extend to promotions inside the KFC Yum! Center. Consequently, fans attending games will see XRP messaging throughout the arena and not only on the floor.

Louisville will also promote the XRP partnership through its digital and social media channels. Furthermore, radio broadcasts for both basketball teams will carry coverage tied to the deal. Therefore, XRP’s visibility will extend well past game day and into everyday fan engagement.

Partnership Adds Finance And Education Component

Ripple will fund financial and technology education programs for Louisville student-athletes. These programs will also reach the wider campus community beyond athletics. Ultimately, the sessions aim to explain traditional finance alongside digital assets such as XRP.

Louisville’s athletic director said the university sought brands that respect its basketball tradition and history. He added that the arrangement honors Coach Crum’s legacy while embracing new opportunities for growth. Meanwhile, a Learfield sports properties executive called Louisville a strong national platform for brand partners.

That executive further noted that the collaboration expands XRP’s presence within college athletics broadly. This marks one of the more prominent XRP placements inside a major conference program. Consequently, the agreement signals growing interest from crypto brands in collegiate sports marketing.

Context Behind The Ripple And XRP Push

The Louisville deal arrives as Ripple pursues wider brand recognition beyond crypto trading platforms alone. Recently, Goldman Sachs became a major holder of Ripple-linked exchange-traded funds. This shift points to rising institutional interest surrounding XRP and its broader ecosystem.

College sports sponsorships have increasingly drawn interest from financial and technology brands in recent seasons. Ripple’s move into Louisville basketball follows that pattern and adds a new sector to campus marketing. As athletic programs seek fresh revenue streams, XRP-linked partnerships may become more common nationwide.

US lawmakers failed to advance the proposed CLARITY Act in the Senate on Tuesday, delivering a near-term setback for the crypto industry’s push for a clear federal regulatory framework for digital assets.

The Senate voted 49–50 on a motion to invoke cloture—falling short of the 60 votes needed to proceed to the next stage—after Democrats raised concerns tied to US President Donald Trump’s reported crypto investments, according to Cointelegraph’s coverage. Industry representatives described the outcome as disappointing, but argued that regulators’ rulemaking may still be able to narrow the uncertainty.

Key takeaways

• The Senate’s 49–50 cloture vote means the CLARITY Act did not move forward, leaving firms without a new statutory baseline.
• Executives pointed to potential regulatory action by the SEC and CFTC as the most immediate path to practical clarity.
• Legal experts warned that relying on agency guidance and discretionary enforcement could keep compliance burdens high and delay planning cycles.
• There may be another attempt to restart the bill’s momentum after Senator Thom Tillis moved to reconsider the failed cloture vote.
• Market odds for the bill being signed in 2026 reportedly slipped to 5% on Tuesday, reflecting renewed uncertainty.

CLARITY Act stalls after Senate falls one vote short

Tuesday’s vote underscores how difficult it has been for the CLARITY Act to break through procedural hurdles. The motion to invoke cloture—used to limit debate and move legislation forward—came up short, with the Senate unable to reach the 60-vote threshold required to advance the measure.

While the vote did not eliminate the possibility of future progress, it reinforced the gap between crypto’s regulatory needs and the current US framework, which often leaves firms navigating a patchwork of securities, commodities, and state-level money-transmission rules.

According to the article, industry leaders said they were disappointed but not convinced the US is standing still. They argued that agency rulemaking could partially substitute for a stalled legislative effort, at least in the near term.

SEC and CFTC rulemaking seen as the next best route

Ripple CEO Brad Garlinghouse said on X that the lack of legislative momentum would still be met with regulatory work. He pointed to the SEC—under Chair Paul Atkins—and the CFTC—under Chair Rostin Behnam? (Note: the original article cites a CFTC chair “Selig”) as the bodies that could issue rules to “fill the legislative gap,” adding that the industry would remain engaged in the process.

At the Solana Policy Institute Summit on Monday, Atkins committed to producing clearer crypto rules with or without additional legislation, according to the same reporting. The message was that regulators may attempt to reduce ambiguity even as Congress remains gridlocked.

But multiple executives and legal officers cautioned that this approach may only postpone a harder problem. NEAR’s chief legal officer Abhishek Vaidyanathan argued that rejecting the bill leaves companies “completely dependent on agency guidance and ongoing administrative discretion.” In practical terms, he said firms preparing longer-term budgets could still be forced back into case-by-case judgments, repeatedly performing legal work while counterparties treat regulatory uncertainty as an ongoing pricing factor.

Bitget Wallet COO Alvin Kan similarly told Cointelegraph that the bill’s failure continues to cloud how securities, commodities, and money-transmission rules apply across different crypto products.

Why the difference between law and agency guidance matters

The industry’s concern is less about whether regulators will act, and more about predictability. A statute like the CLARITY Act can provide clearer boundaries in one place, while agency decisions can vary based on interpretation, enforcement posture, and the pace of rulemaking.

That distinction became the center of the criticism after Tuesday’s vote. Vaidyanathan highlighted how firms planning for future years—he referenced 2027 budgets—could remain exposed to prolonged uncertainty. If compliance requirements continue to depend on discretion rather than a stable statutory framework, businesses may face higher legal costs, slower product rollouts, and more conservative risk management.

For traders and market participants, ambiguity can also influence market structure: if different entities interpret the same product differently, liquidity and custody arrangements may be shaped by legal risk as much as by economics. Executives’ comments reflect the belief that rulemaking may mitigate uncertainty, but may not fully replace the certainty that comes from comprehensive legislation.

Senator Tillis moves to reconsider; timeline risks remain

Even with Tuesday’s setback, momentum is not entirely gone. The article notes that Senator Thom Tillis moved to reconsider the failed attempt, which could open the door to another cloture vote.

1inch chief legal officer Orest Gavryliak, speaking to Cointelegraph, said the result is a “delay, not a verdict,” arguing that legislation of the CLARITY Act’s scale rarely moves in a straight line and that cloture can be brought again.

However, Vaidyanathan took a more cautious view of immediate prospects, suggesting that the next Congress is more likely to tackle market structure issues. He also pointed to the US legislative calendar: the House had canceled weeks scheduled for September 21 and 28, and the Senate’s state work period begins October 5 ahead of the November 3 election, as cited in the original report. That timing matters because it compresses the available window for lawmakers to act before the election cycle complicates legislative priorities.

In parallel, Polymarket’s odds of the CLARITY Act being signed into law in 2026 reportedly fell to 5% on Tuesday, the lowest probability since the market opened in January, according to the article. While prediction markets are not official indicators, the sharp move suggests that participants see limited near-term legislative momentum.

With the Senate vote failing to reach cloture and executives warning that agency-based solutions may only partially stabilize planning, the key question for readers is how quickly the SEC and CFTC translate Atkins’ commitments into concrete, product-specific rulemaking—and whether the CLARITY Act can regain traction before legislative focus shifts after the election.

U.S. prosecutors have charged two former Robinhood engineers with fraud allegations tied to cryptocurrency token listings, accusing them of using confidential internal information to profit from perpetual futures trades on Hyperliquid.

According to the U.S. Department of Justice (DOJ), Hefu Chai and Huaisong “Jerry” Xiang bought perpetual contracts connected to tokens shortly before those assets debuted on Robinhood Crypto. The DOJ alleges each defendant earned more than $50,000 from the trades between 2025 and 2026.

Key takeaways

• The DOJ alleges Robinhood engineers accessed nonpublic listing plans via a private Slack channel and traded perpetual futures on Hyperliquid ahead of announcements.
• Prosecutors say the alleged strategy relied on opening long positions before tokens listed and closing after their value rose following debut.
• The charges extend insider-trading-style conduct into decentralized derivatives markets, rather than spot token purchases alone.
• Prosecutors argue that company “insider” restrictions do not prevent liability if misappropriated information is used to trade derivatives.
• Both defendants are presumed innocent, and the charges remain allegations.

DOJ alleges inside information drove pre-listing perpetual trades

In a press release describing the case, the DOJ said Chai and Xiang traded based on upcoming listing information they allegedly obtained through Robinhood’s internal systems. Prosecutors allege that each used the information to buy perpetual contracts linked to specific tokens before those tokens were announced as listings on Robinhood Crypto.

After the tokens’ debut, the DOJ claims the defendants closed their positions at higher prices. The agency’s filings state that the alleged profits for each defendant exceeded $50,000.

The alleged mechanism matters for market structure: perpetual futures allow traders to take leveraged exposure without necessarily buying the underlying asset directly. The DOJ’s theory therefore targets a broader category of “derivatives” behavior than cases limited to spot markets.

Robinhood roles, access controls, and alleged policy breaches

The DOJ complaints say Chai worked at Robinhood from around 2021 until May 2026 and served as a technical lead tied to new digital-asset listings. Xiang, prosecutors allege, worked at Robinhood from around 2024 until September 2026 and was a software engineer involved in crypto listings.

According to the DOJ, Robinhood designated both men as “Coin Aware Individuals,” granting them access to a private Slack channel that contained planned listing dates. The DOJ also alleges the engineers traded in a way that violated a company policy restricting members of that group from trading on Robinhood—or any other platform—within 24 hours before or after a listing or delisting announcement.

Prosecutors further allege Chai traded perpetuals ahead of at least 10 listing announcements involving tokens including Cat in a dogs world (MEW), Moo Deng (MOODENG), Aster (ASTER), Plasma (XPL), Hyperliquid (HYPE), Ethena (ENA), and Aerodrome Finance (AERO). For Xiang, the DOJ says the first alleged pre-listing trade involved Popcat (POPCAT) perpetuals in March 2025, followed by trades ahead of at least 10 other listing announcements.

Why prosecutors frame it as law-breaking—then link it to past insider cases

The DOJ’s allegations echo the logic behind earlier U.S. insider-trading prosecutions involving crypto listings. Earlier coverage by Cointelegraph highlighted the 2023 Coinbase insider-trading case, in which a former employee used confidential information to profit from new token listings. That matter involved direct purchases of the underlying asset rather than futures exposure.

In this Robinhood case, the DOJ’s theory extends the alleged misconduct into perpetual derivatives markets. Prosecutors appear to be drawing attention to the fact that insider-style profits can be pursued through leveraged instruments, not only spot buys, and that the legal risk persists even when the trading venue differs from where the listing decision is made.

U.S. Attorney Jamie McDonald said corporate insiders cannot avoid securities and commodities laws by trading misappropriated information through perpetual futures, tokenized securities, or similar instruments.

Charges, potential penalties, and what remains unresolved

Each defendant faces one count of violating the Commodity Exchange Act and one count of wire fraud. The DOJ stated that the Commodity Exchange Act count carries a maximum prison sentence of 10 years, while the wire fraud count carries a maximum of 20 years.

As with all criminal cases, the charges are allegations. Chai and Xiang are presumed innocent unless convicted.

Robinhood did not immediately respond to Cointelegraph’s request for comment by the time of publication.

For traders and builders, the main thing to watch next is how courts treat the DOJ’s attempt to connect insider information to profits generated specifically through perpetual futures on platforms outside the company that made the listing decision. The outcome could influence how aggressively prosecutors pursue “listing-related” conduct across both centralized listings and decentralized derivative trading venues.

An attacker attempted to drain approximately $7.7 million worth of rsETH from an Ethereum Safe wallet by abusing a custom module tied to the wallet. Instead of successfully exiting with the funds, the operation was interrupted when an MEV bot captured the tokens first, according to blockchain security firm Blockaid.

Blockaid said the exploit used a public “keeper” multicall to route a custom Uniswap v4 liquidity module into an attacker-controlled hooked pool. In that setup, aEthrsETH was unwrapped into rsETH—allowing the attacker to try to take custody of the extracted tokens.

Key takeaways

• Blockaid traced the incident to a custom Uniswap v4 liquidity module connected to a Safe wallet.
• The attacker reportedly targeted rsETH holdings worth about $7.73 million, but an MEV bot intercepted the funds.
• On-chain activity indicates the MEV bot transferred rsETH out before the original exploiter could act.
• Kelp, the rsETH protocol, placed a 24-hour pause on the recipient address as a precaution while stating rsETH remains fully backed.
• Minting, withdrawals, and integrations were reported as continuing normally during the investigation.

From Safe module to attacker-controlled liquidity pool

In its report, Blockaid described a two-stage strategy. First, the attacker leveraged a Safe-related “keeper multicall” as a public execution path. Then, through that multicall, the attacker directed a custom Uniswap v4 liquidity module into a hooked pool created by the attacker.

The key mechanics, per Blockaid, were centered on converting aEthrsETH into rsETH inside the attacker’s pool. This effectively created a route for extracting rsETH from the victim wallet using functionality already wired into the Safe.

Blockaid identified the impacted wallet as belonging to an unidentified Safe user and estimated that roughly $7.73 million in rsETH was taken at the time of its initial reporting.

MEV bot “Yoink” front-runs the exploiter

Rather than letting the exploiter obtain control of the extracted rsETH, the transaction appears to have been front-run by an MEV bot named “Yoink.” MEV bots monitor mempool and transaction patterns to capture opportunities when transactions can be reordered for profit or advantage.

Blockaid said Yoink took the rsETH before the original attacker could secure the funds. Etherscan transaction data linked in Blockaid’s update indicates that Yoink transferred about 18.93 ETH—valued at roughly $46,000 at the time—during the same transaction to an address labeled as a “block builder.”

While this does not by itself clarify the bot’s full profit model, the pattern is consistent with MEV-style routing: the bot captures value in the reordered execution and settles or forwards funds through builder-related infrastructure.

Kelp pauses a receiving address; contracts reportedly safe

After the extraction and interception, the rsETH protocol behind Kelp moved to reduce the risk of further token movement from the implicated destination.

Kelp placed the address that received the funds under a 24-hour pause, temporarily preventing the tokens from being transferred. In an update posted on X, Kelp described the step as a precautionary, wallet-level measure only, adding that its own contracts are safe and that rsETH remains fully backed.

Kelp also said minting, withdrawals, and integrations were continuing normally while it worked with security experts to investigate what happened. In its explanation of the likely attack path, Kelp pointed to the custom module attached to the victim’s Safe as the apparent vector, while stating that Kelp’s core contract layer was unaffected.

What this incident signals for Safe and DeFi modularity

This case underscores how “legitimate” DeFi components can become high-risk when they are wired into wallet automation or custom modules. The exploit did not rely on a claimed vulnerability in Kelp’s contracts; instead, it leveraged a custom Uniswap v4 module and the Safe’s ability to execute preconfigured calls via a public multicall mechanism.

For users and teams operating smart-contract wallets, the lesson is less about any single protocol’s implementation and more about how modules are designed, approved, and monitored. When Safe wallets are configured to route assets through complex strategies—especially ones involving liquidity hooks and public execution helpers—attackers may not need to break contract code. They may only need to steer existing pathways into attacker-controlled counterparty logic.

At the same time, the fact that an MEV bot intercepted the extracted rsETH illustrates another dynamic: even when exploitation succeeds in pulling funds into a usable form, automated market mechanisms can reorder outcomes and reduce the attacker’s ability to complete settlement.

For readers tracking recovery and downstream impacts, the most important immediate variable will be the duration and scope of Kelp’s pause and whether the protocol can identify the remaining movement rights or any other affected addresses. Beyond that, attention will likely shift to what developers and auditors recommend for safely handling custom modules, keeper multicalls, and Uniswap v4 hook integrations in production wallet setups.