Strategy disclosed on July 30 that its Bitcoin sales during 2026 totaled about $218.4 million and helped fund preferred-stock dividends. The sales put a dent in a strategy built on the premise that Strategy would never sell.

The disclosure came alongside an $8.22 billion second-quarter net loss. Most of the loss was an unrealized markdown from a lower quarter-end Bitcoin price. It did not involve cash outflows or equivalent BTC sales.

Strategy is now using Bitcoin from its reserve to support a growing financing structure. The company still holds more than 843,000 BTC, but accumulation is no longer the only permitted use of its holdings.

The $8.22 billion loss was mostly unrealized

Strategy recorded an $8.32 billion unrealized loss on its Bitcoin during the quarter. Under fair-value accounting, the company updates the balance-sheet value of its holdings as Bitcoin’s market price changes. Gains or losses flow into reported earnings even when Strategy does not sell the coins.

Strategy earned $10.02 billion in the second quarter of 2025, when rising Bitcoin prices generated a large unrealized gain.

Strategy held approximately 843,775 BTC as of July 26. The company reported an original acquisition cost of $63.69 billion and a market value of $54.77 billion, using a July 27 price of $64,915.

Its average purchase price was about $75,476 per Bitcoin. The gap between cost and market value can change and does not represent a realized loss on the full reserve.

Bitcoin can now fund several obligations

Strategy’s board-authorized BTC Monetization Program allows the company to sell Bitcoin for several purposes. These include building its dollar reserve, paying preferred dividends and interest, and funding securities repurchases.

Strategy’s shift toward selling Bitcoin began earlier than the July 30 disclosure. The $218.4 million figure covers the year through July 26, not just the second quarter. On June 1, 2026, the company disclosed in an SEC filing that it had sold 32 BTC between May 26 and May 31 for about $2.5 million, its first Bitcoin sale since December 2022. The move drew renewed public scrutiny of Michael Saylor’s long-standing “never sell” position, including past remarks that holders should part with a kidney before their Bitcoin. Saylor addressed the criticism at the BTC Prague conference on June 11, 2026, describing the sale as routine treasury management tied to a defined financial obligation, not a reversal of Strategy’s Bitcoin thesis.

Preferred-stock dividends had a growing effect on the quarter’s results. Strategy reported $400.7 million of preferred dividends, up from $49.1 million one year earlier. Those payments increased the loss attributable to common shareholders above the company’s overall net loss.

Strategy has not abandoned its Bitcoin treasury: holdings grew 25% during 2026 through July 26. Selling Bitcoin gives the company another source of cash when dividends and interest come due.

>>> Read more: Strategy Signals Possible Bitcoin Sales After Q1 Loss

A dollar reserve provides a cash buffer

Strategy said its dollar reserve had reached $3.75 billion by the results announcement. Management estimated that the reserve could cover more than 2.1 years of its existing preferred dividends and interest obligations.

That figure is larger than the company’s June 30 cash position of $1.71 billion in cash and cash equivalents plus $736.1 million in short-term investments, reflecting subsequent financing activity.

Strategy raised $17.06 billion through at-the-market securities offerings during 2026 through July 26. It also reduced its convertible debt from $8.21 billion to $6.71 billion by repurchasing notes at a discount.

Separately, the company authorized a $1 billion repurchase program for MSTR common shares. However, no common-stock repurchases had occurred by July 26. Strategy did spend about $25 million repurchasing STRC preferred shares below their stated value.

Future Bitcoin sales remain uncertain

Strategy has not provided a schedule or target for further Bitcoin sales. Bitcoin prices, financing conditions, and the size of future preferred-stock obligations will likely shape how much it sells and when.

Those obligations are growing. Further preferred-stock issuance would add to the recurring cost already driving the dividend increase. Raising capital through common shares avoids that cost but dilutes existing shareholders, so each financing option carries a different tradeoff for the company and for investors.

The dollar reserve is the clearest gauge of how much pressure that creates. Whether its current coverage window holds, shrinks, or grows in future disclosures will show how tightly Bitcoin sales stay tied to the cost of servicing Strategy’s preferred securities.

The post Strategy Turns to Bitcoin Sales to Support Preferred Dividends appeared first on CrispyBull.

The IRS Criminal Investigation division warned on July 30 that fraudsters are mailing official-looking letters to cryptocurrency holders. The notices use a QR code to direct recipients to a fake “Digital Asset Compliance Portal.”

The fake IRS crypto letters mirror common phishing campaigns but use physical mail to add credibility. A convincing envelope and tax-notice format can make the request feel more legitimate than an unexpected email. The IRS says it is not an official portal and taxpayers do not need to register wallets or exchanges through it.

Coinbase Security and threat-intelligence firm DarkTower traced the mechanics of the campaign which gathers information that may support later social engineering attempts, like basic account details and phone numbers. The number of letters sent, and whether there are confirmed victims or losses, remains unknown.

The letter sends recipients to a look-alike site

The mailed notice copies elements of genuine government correspondence. These include Treasury and IRS references, a notice number and an urgent deadline. Its QR code points away from IRS.gov to a domain that resembles an official compliance service.

After a recipient scans the code, the site asks which exchange or wallet holds the person’s cryptocurrency. It lists both hardware wallets and major trading platforms. Next, it asks for an estimated account value which allows the operator to identify higher-value targets.

The site then signals a “platform approval” hand-off before requesting a phone number under a verification step. According to Coinbase and DarkTower, this prepares a possible follow-up call. The caller may pretend to represent the IRS, an exchange or a compliance service.

>>> Read more: Ledger and Trezor Seed Phrase Mail Scam

The potential phone call is where theft could occur

According to Coinbase and DarkTower, the phone-based step remains unconfirmed, as testing the flow caused the site to go dark after entering a number, leaving open whether a call follows or the number is stored for later use. If a call does occur, it would likely mirror common social engineering patterns. During such contact, a fraudster may seek an account password or a two-factor authentication code, or request a wallet recovery phrase, each of which can provide a route to an exchange account or self-custodied funds.

A caller may also instruct the recipient to transfer cryptocurrency to a “safe” wallet, which would send assets to an address controlled by the scammer. Even if the timing and trigger of any call remain unclear, these requests are key warning signs. A legitimate agency or exchange will not ask for credentials, recovery phrases, or transfers during an unsolicited call.

Coinbase said DarkTower traced the campaign domain to a Hong Kong registrar. Someone registered it shortly before the letters went out. The site used Romanian hosting infrastructure associated with other phishing pages. However, those technical locations do not establish the operators’ identities or nationality.

A paper notice can be real, but this portal is not

The IRS does send legitimate notices by mail, so a paper envelope alone is not proof of fraud.

Crypto tax reporting and disclosure requirements have expanded in recent years, making IRS correspondence about digital assets more common for many holders. This means that a convincing notice may appear routine at first glance and recipients may be less likely to scrutinize a letter from the IRS, which can increase the effectiveness of a well-crafted fake.

The decisive warning signs are the invented portal and the wallet-registration request. Before scanning any code or visiting the printed site or calling any number on the notice, recipients should check their official IRS online account or use contact details obtained directly from IRS.gov.

At this time, public sources have not explained how the senders obtained names and home addresses associated with crypto ownership. Neither Coinbase nor any other exchange or the IRS itself reported on a related database breach. 

>>> Read more: IRS Cryptocurrency Tax Reporting 2025: What You Need to Know

Exposed information requires quick account checks

Anyone who entered information into the unverified compliance portal should treat it as compromised. Coinbase recommends changing the affected exchange password and checking the two-factor authentication method. Users should also contact the provider through its official app or website.

Never share a wallet recovery phrase with a caller or enter it into a tax-compliance site. If someone disclosed a phrase, the owner may need to move any remaining assets. They should use independently verified wallet guidance and act before a scammer can.

The IRS accepts reports about suspicious tax-related letters, websites and calls. In addition, victims can report fraud to the Federal Trade Commission. Exchange-specific incidents should go through the provider’s official support channel.

The post Scam Uses Fake IRS Letters and QR Codes to Target Crypto Wallets appeared first on CrispyBull.

Zcash activated its Ironwood network upgrade on July 28, closing the older Orchard shielded pool, a part of the network that stores private transactions, to new funds. The network simultaneously opened a separately tracked private pool for future shielded transactions.

Orchard contained a critical flaw that could have allowed someone to create counterfeit ZEC without leaving an obvious public record. Developers fixed the immediate vulnerability in early June. However, that repair could not prove whether anyone had exploited the flaw during the previous four years.

Ironwood creates a clean starting point for shielded funds. Orchard users can still withdraw or migrate their ZEC, but the transfer will happen gradually through compatible wallets.

The vulnerability behind the upgrade

Zcash uses shielded pools to keep transaction details private while still checking that transactions follow network rules. The Orchard flaw affected the circuit responsible for that control process.

Researcher Taylor Hornby discovered the vulnerability on May 29 using Anthropic’s Claude Opus 4.8 as part of an AI-assisted security audit commissioned by Shielded Labs, shortly after the model’s public release. According to a Shielded Labs disclosure, developers deployed an emergency fix within days of the disclosure. Public analysis has not established that anyone created counterfeit ZEC.

A public checkpoint protects the migration

Still, Zcash’s private design means the blockchain cannot provide a complete historical answer. Therefore, the migration uses an accounting boundary described as a turnstile.

The network publicly recorded how much legitimate value entered Orchard. Its rules now prevent more value from leaving than that recorded amount. Any counterfeit ZEC that might exist beyond the verified balance could not cross the boundary.

This supply check is the main security purpose behind Zcash’s upgrade to Ironwood. It does not expose individual transactions or remove the privacy features of the new pool.

Orchard can release funds but cannot receive more

Zcash activated Ironwood at mainnet block 3,428,143. From that block onward, network rules prevent new value from entering Orchard. They also stop ordinary transfers between users from remaining inside the older pool.

Value already held in Orchard is fully available to owners. They can move it into Ironwood or withdraw it to another supported Zcash address. The new pool started with a separate transaction history and a zero balance.

CoinDesk reported that Orchard held about 3.66 million ZEC when Ironwood activated. That amount was worth roughly $1.7 billion at the reported market price. Around 1,500 ZEC had already moved into Ironwood by the publication cutoff. That leaves the bulk of Orchard’s 3.66 million ZEC still waiting to migrate.

Wallet support will shape the migration

Moving Orchard funds is voluntary and user-driven. In fact, not every ZEC holder needs to act immediately, since a lot of coins sit outside Orchard entirely.

However, Orchard users need wallet software that supports Ironwood and handles the migration safely. Wallet readiness matters because a poorly designed transfer can reveal more transaction information than the user intended.

The Zcash community has published several dashboards tracking how much value crosses into Ironwood. These tools can measure total movement between pools without identifying the people involved.

The final migration timeline remains unknown. Some funds may stay in Orchard for an extended period because their owners are inactive, waiting for wallet updates or choosing not to move.

>>> Read more: Zcash Developer Exit Over Governance Dispute

Ironwood adds a future recovery feature

Ironwood also changes how the network records shielded notes. The new format is designed to support recovery if future quantum computers break the cryptography that protects today’s private balances.

This feature does not quantum-proof Zcash now, but it preserves information that could support a later recovery process after the network adopts new cryptography.

The new pool also has its own balance records, note tree and list of previously spent notes. So nodes can track Ironwood independently from Orchard while maintaining private transaction details.

Formal verification of the new circuit is still in progress, and wallet and exchange support will differ by provider. Migration speed now depends less on Zcash’s code than on how quickly individual wallets adopt it.

The post Zcash restricts old pool after flaw raised hidden supply risk appeared first on CrispyBull.

Decentralized exchange Dango stopped perpetuals trading on July 29 at 12:00 UTC, completing the first major step in its planned two-stage shutdown. The platform said it would close remaining positions at oracle prices under its shutdown plan, while deposits in its liquidity vault would unlock for withdrawal.

Users now have about two weeks before the project plans to switch off its Layer 1 blockchain. Dango says it will return balances in USDC. Assets still on the network after August 13 are expected to return to their original Ethereum deposit addresses.

The trading cutoff triggered automatic settlement

Dango announced the closure on July 24 after concluding that it had no viable path to lasting commercial success. It gave traders five days to close positions and withdraw funds before trading ended.

The team warned that liquidity could become thin during that period. With fewer orders available to absorb trades, execution prices can worsen, especially for larger positions. As a result, Dango encouraged users to act before the cutoff instead of relying on the final settlement.

When trading halted on July 29, Dango said it would settle remaining positions using oracle prices, external price data an exchange relies on when its own order book cannot supply a fair reference. The company has not published those prices, so the settlement has not been independently verified.

Dango also said deposits in its DLP liquidity vault, a pooled system used to support trading activity, would unlock. It planned to move those funds and other balances into users’ spot accounts as USDC, a dollar-linked stablecoin.

The blockchain remains scheduled to close August 13

While trading has ended, Dango’s Layer 1 blockchain will remain available until August 13 at 12:00 UTC. Users can still withdraw during this final period, and deposits remaining at the chain cutoff are expected to return automatically to the Ethereum addresses from which they originally arrived.

That approach may reduce the risk of funds becoming permanently stranded. However, the announcement does not explain how the project will handle unusual deposit routes or unsupported assets, and it does not disclose current withdrawal times or the total value still awaiting removal.

Until Dango discloses how it will handle those edge cases, users with anything other than a standard deposit have no confirmed path to recovering their funds.

Dango is closing only months after launch

Dango was built as a decentralized venue for perpetual futures, which allow traders to speculate on asset prices without a fixed expiry date. It operated its own blockchain and promoted features such as unified margin, which lets traders use a single balance across positions, and an onchain order book.

The exchange launched its perpetuals product in April 2026. Before the shutdown announcement, independent reporting placed its total value locked near $1.6 million. The project had raised $3.6 million in a 2024 seed round led by Hack VC and Lemniscap.

Founder Larry Engineer attributed the closure to several pressures. He cited a shrinking financial runway, legal and compliance delays, lost momentum, staff departures, and difficult market conditions. Dango has not announced a bankruptcy filing or said that it cannot meet customer obligations.

The platform also suffered a security incident days after its April launch, when an exploit briefly drained funds from its insurance fund. The attacker returned the money in full for a bug bounty, and no users were affected. Dango did not cite the episode among its reasons for shutting down.

>>> Read more: Triple-A Hot Wallet Drain Hits $11.8M, Details Unclear

Users still need proof that settlement finished

While Dango’s plan described an orderly wind-down after trading ended, the shutdown process remains incomplete and operational results unconfirmed. The project has not published the oracle prices used for each forced closure or provided a reconciliation showing that all vault deposits reached spot accounts. It has also not disclosed how many customers still hold balances on the network. Nor has it said when, or if, those records will be released.

The post Dango Ends Trading as August 13 Shutdown Deadline Approaches appeared first on CrispyBull.

Crypto payments company Triple-A lost an estimated $11.8 million from its hot wallets in an incident first flagged by blockchain investigator Specter on July 24. Deposits kept arriving at the affected wallets and being swept for at least 31 hours after the first unauthorized transfers. Triple-A has since said the loss hit company treasury assets, not client funds. However, the access method and a final confirmed loss figure remain undisclosed.

What investigators tracked, July 24–26

Specter first reported the activity at 5:18 p.m. ET on July 24, saying more than $9.3 million had been taken, converted and bridged to Ethereum. PeckShield followed roughly four and a half hours later, raising the estimate above $9.7 million. It identified activity across Ethereum, TRON, Polygon, Arbitrum, Solana and The Open Network. PeckShield’s alert included a snapshot of eight transfers reaching a single Ethereum address between 20:35 UTC on July 24 and 03:03 UTC on July 25. It held 5,226.67 ETH, then valued at about $9.73 million.

By July 26, Specter had added Bitcoin to the list of affected networks, attributing another $1.8 million in losses to Bitcoin and TRON. That brought the estimated total to approximately $11.8 million. The investigator also reported that new deposits were still reaching the affected wallets and being swept 31 hours after the first large outflows appeared.

Triple-A’s only public comment during this window came on July 25, when the company told reporters it was actively investigating the wallet incident. At the time it assured that the attack had not affected customer funds. It did not elaborate on what the wallets held, how access had occurred, or whether the activity had stopped. The loss figures are based on on-chain tracking and not a confirmed company accounting. Triple-A has not confirmed the loss estimate or published a list of affected addresses.

Triple-A’s account, July 27

Roughly 35 hours after Specter’s initial alert, Triple-A published a newsroom statement addressing the wallet incident directly. The company said the affected wallets held its own treasury assets and no client funds. Client funds, it said, are held separately in trust accounts that were not exposed, consistent with Singapore’s rules requiring licensed digital payment token providers to safeguard customer assets apart from company holdings. Triple A Technologies Pte. Ltd., the company’s Singapore entity, holds a major payment institution licence from the Monetary Authority of Singapore.

The statement also said the company detected unauthorized access on July 25. Subsequently, it placed some services into maintenance mode for about three hours while securing the affected infrastructure. Once it completed additional security checks, normal processing resumed. Triple-A said it is working with cybersecurity firms and the Singapore Police Force, and that it remains well-capitalized and able to meet its liabilities. The financial impact would be absorbed through treasury reserves.

The statement did not disclose a specific loss figure, wallet addresses, or how the unauthorized access occurred.

Where the two accounts do not line up

Triple-A’s description of a three-hour maintenance window on July 25 sits awkwardly next to Specter’s report of deposits still being swept 31 hours later, into July 26. Businesses often continue sending funds to previously issued deposit addresses until those addresses are replaced. If a compromised address remains active, additional deposits can keep reaching an attacker well after the initial breach has been identified and contained elsewhere.

Pausing certain services is not the same as disabling on-chain deposit addresses. Also, Triple-A has not specified which systems underwent the maintenance period or whether it rotated any deposit addresses. The two timelines are not necessarily contradictory, since a brief pause to secure core infrastructure would not automatically stop funds from landing on addresses still in circulation. But nothing in Triple-A’s statement accounts for the extended sweep Specter described, and the company has not addressed the gap directly.

Still open

Several questions remain unanswered. Triple-A has not disclosed whether stolen credentials, compromised private keys or another failure allowed the transfers, nor has it published a final loss figure or the specific wallet addresses involved. It has also not said whether any exchanges or stablecoin issuers froze funds linked to the incident, or whether it recovered any assets.

As of publication, two days after Triple-A’s July 27 statement, no further update has confirmed whether the sweeping of new deposits described by Specter has stopped.

The post Triple-A Reports Treasury Loss as Investigators Track Extended Sweep appeared first on CrispyBull.

A dispute over BIP-110, a proposed temporary change to Bitcoin’s transaction rules, is moving toward a scheduled enforcement test in August. The debate now includes prominent developers, infrastructure operators, security specialists and corporate Bitcoin advocates on both sides.

Michael Saylor and Adam Back first publicly opposed the proposal on July 11. Saylor later expanded his position in a July 18 essay titled “110 Reasons BIP-110 Is a Bad Idea,” but his intervention was part of an already active technical and governance dispute. It wasn’t its starting point.

The Bitcoin BIP-110 proposal would restrict several methods of placing large amounts of non-payment data inside transactions. Supporters argue that the limits would protect node operators and preserve block space for monetary activity. Opponents say the rules could break legitimate transaction structures and establish a precedent for judging transactions according to their purpose.

BIP-110 has not received network-wide acceptance or taken effect. Its “Complete” status means its technical specification has been finalized, not that the Bitcoin network has approved the change.

BIP-110 would impose seven temporary restrictions

Formally titled the Reduced Data Temporary Soft fork, BIP-110 would add rules that make some previously valid transactions or blocks invalid for nodes enforcing the proposal.

The proposal contains seven restrictions. They include an 83-byte limit for OP_RETURN outputs, one of several transaction fields used to attach data, as well as 256-byte caps on other data fields and tighter rules for certain Taproot scripts. Taproot is part of Bitcoin’s system for supporting more advanced transaction and contract structures.

The proposal itself acknowledges that its Taproot limits could complicate projects such as BitVM, which aims to support more complex applications using Bitcoin. Its authors also identify unusual Taproot and pre-signed transaction structures that could encounter spending problems, although they describe those cases as unlikely.

Supporters describe the targeted activity as arbitrary data storage that imposes costs on full-node operators. Every full node must download and process the blockchain. Node operators bear the verification cost, while miners receive the transaction fees.

The restrictions would apply for about one year. They would cover only UTXOs created after the activation height. A UTXO is an individual piece of bitcoin that has not yet been spent. Those confirmed before activation would remain exempt.

Dashjr and Ocean argue the restrictions are necessary

Luke Dashjr is one of the proposal’s most prominent public supporters. The Bitcoin Core developer, Ocean mining pool co-founder and technical director is credited with advising on BIP-110’s original draft.

Dashjr has presented the proposal as a defensive measure against transaction activity that he believes threatens Bitcoin’s long-term function. He has stated: “If BIP110 fails, Bitcoin fails with it.”

Ocean was the first mining pool to signal support and remains nearly the only pool doing so. Miner signalling means miners indicate support through the blocks they produce. Ocean’s position gives the proposal a named institutional advocate, although current signalling remains far below the threshold required for early lock-in.

Supporters argue that transaction fees alone do not account for every cost imposed on the network. Their case is that consensus restrictions may be justified when certain transaction structures create persistent storage and processing burdens for thousands of independent nodes.

Back and Saylor challenge purpose-based restrictions

Adam Back and Michael Saylor have emerged as the two most prominent public critics.

Back is Blockstream’s co-founder and chief executive and the inventor of Hashcash, the proof-of-work system cited directly in the Bitcoin whitepaper. He has described BIP-110 as a “literal downgrade,” arguing that it could break existing Miniscript and UTXO edge cases while creating a precedent for filtering transactions based on their perceived purpose. In practical terms, his concern is that the proposal could disrupt some advanced transaction structures that are valid under Bitcoin’s current rules.

Saylor’s July 18 essay develops a similar governance argument. He maintains that Bitcoin cannot reliably determine whether transaction data represents an image, contract, proof or future financial application. In his view, fee-paying transactions should compete for block space without consensus rules deciding whether their purpose is acceptable.

Node operators and miners can already choose which transactions they relay or include. Critics argue that converting those individual policy choices into network-wide consensus rules is a materially different step.

This is the central divide surrounding the Bitcoin BIP-110 proposal. Supporters see a temporary response to unwanted data storage. Opponents see a shift from verifying transaction validity toward regulating transaction intent.

Lopp, Todd and other critics raise broader concerns

Jameson Lopp, Casa’s chief security officer, has framed Bitcoin’s value as a “dependable anchor.” He warns that purpose-based restrictions could create a “slippery slope to centralization and control.”

Developer Peter Todd has offered a practical demonstration of another criticism: bypassability. Todd embedded the full BIP-110 text inside a transaction that complied with BIP-110’s own restrictions, illustrating that determined users may still store substantial data by restructuring how it is encoded.

Gregory Maxwell, a former Bitcoin Core developer and Blockstream co-founder, has raised technical criticisms of the proposal and has also alleged that Ocean Mining authored BIP-110. Its pseudonymous author, Dathon Ohm, denies that claim.

The August process could separate enforcing nodes

Miners began signalling support in December 2025. BIP-110 uses a 55% early lock-in threshold across a 2,016-block difficulty period. A difficulty period is a standard Bitcoin cycle covering 2,016 blocks, while early lock-in means the proposal has gained enough miner support to advance before the mandatory stage.

Signalling remained below 1% as of the weekend of July 18–19, leaving support far short of early lock-in. Miner signalling is a live figure that updates frequently and may have changed by publication.

The more contentious stage is expected around August 7, near block 961,632. Nodes running BIP-110 rules would then reject blocks that do not signal support. For that software, the specification forces lock-in by block 963,648. Activation follows near block 965,664, expected around September 1.

Those rules apply only to participating software. Nodes that do not enforce BIP-110 would continue accepting otherwise valid Bitcoin blocks. If enforcing nodes reject most blocks followed by the wider network, they could separate onto a smaller chain.

A lasting split is not certain. The outcome depends on miners, node operators, exchanges, custodians and other economically important participants. Miner signalling does not capture every form of network support.

>>> Read more: Noah Doe Bitcoin Wallet Lawsuit Faces New Legal Challenges

Complete status does not represent approval

BIP editor Mark “Murch” Erhardt, who assigned BIP-110 its number, has called it “a misguided and unusually careless soft fork proposal.” He published it because it met the repository’s process criteria. But documenting a proposal and endorsing it aren’t the same thing.

BIP-110-compatible software is already available through Bitcoin Knots and several node platforms. Publishing a specification or releasing software does not equal consensus across Bitcoin.

The next meaningful evidence will come from miner signalling and adoption among exchanges, custodians and node operators. Until then, the Bitcoin BIP-110 proposal remains just that: a proposal, not an accepted upgrade for the entire network, even as its technical specification is complete and its enforcement schedule approaches.

The post Why Bitcoin Developers Are Divided Over BIP-110’s New Restrictions appeared first on CrispyBull.

Federal agents have arrested a Florida man accused of helping distribute malware through playable games linked to Steam, a popular PC game distribution platform. The alleged operation infected about 8,000 devices, accessed around 80 crypto wallets and stole at least $220,000, according to a federal complaint.

The filing states the malicious games gave the malware access to passwords, account data and crypto wallets on infected devices. Steam itself didn’t suffer any breach. 

Playable games allegedly concealed the malware

Agents arrested 21-year-old Zyaire Dontaevious Zamarion Wilkins, of North Lauderdale, Florida, on July 14. Prosecutors filed the criminal complaint in Washington state the following day. They accused Wilkins of conspiracy to obtain computer information for private financial gain.

The complaint does not name Steam directly, but refers to a popular digital distribution software company. Steam has been identified through contextual details, including the games named in the filing and the location of the case in the Western District of Washington, near Valve’s headquarters in Bellevue.

The filing says Wilkins worked with unnamed co-conspirators between approximately May 2024 and February 2026. They allegedly launched and marketed eight games containing malicious software.

>>> Read more: Microsoft Warns of Crypto Clipper Malware Spreading via USB

How the games gained trust

The FBI’s victim-information page identifies BlockBlasters, Chemia, Dashverse/DashFPS, Lampy, Lunara, PirateFi and Tokenova. Investigators say the group promoted the games through Discord, Telegram, X and LinkedIn. 

The distribution strategy helped the malware blend in. The attackers used Steam’s reputation as a familiar place to download games, then promoted the titles on established social and messaging platforms. The installed software looked and behaved like normal games, which gave users little reason to suspect it also contained malware. 

BlockBlasters had already drawn public scrutiny before Wilkins was charged. In September 2025, independent researchers ZachXBT and vx-underground publicly linked that game to malware when a Twitch streamer raising money for cancer treatment lost roughly $32,000 during a livestream. Researchers tied that episode to more than $150,000 in estimated losses from BlockBlasters at the time.

Valve had already removed several of the flagged titles after they were identified post-launch. PirateFi was taken down in February 2025, followed by a malicious demo for Sniper: Phantom’s Resolution in March 2025, and later by Chemia and BlockBlasters in 2025. Valve has not responded to media requests for comment on that pattern, including on the Wilkins case specifically.

That exposure appears to have overlapped with the FBI Seattle field office’s public investigation into malware on Steam, announced in March 2026. This investigation also named BlockBlasters among the games under review. The July complaint appears to be the first arrest to emerge from that investigation.

The complaint alleges at least $220,000 in losses across the broader case. However, the document does not establish whether the losses reported in September 2025 are included or separate from that total.

Investigators followed the crypto spending trail

Authorities estimate that the malware reached about 8,000 devices. From those, an estimated 80 users suffered losses from their crypto wallets. Hence, not every infection led to cryptocurrency losses. 

This investigation into the malware circulating on Steam also shows how blockchain activity can connect other online activities directly to an individual. For example, agents obtained a wallet address from messages involving an alleged co-conspirator. They then traced spending from that address to Bitrefill, a service that sells gift cards for cryptocurrency.

The associated account had purchased more than 150 gift cards, including Uber Eats vouchers. Investigators then obtained account information from Uber and used it to identify a phone number and delivery address connected to Wilkins, according to the complaint.

>>> Read more: Crypto Investor Loses $6.9M in Douyin Cold Wallet Scam

The charges leave major questions open

The identities of the alleged co-conspirators remain undisclosed. Authorities also have not announced any recovery of the stolen cryptocurrency. The final loss could well exceed $220,000 if more victims come forward.

The FBI is now seeking information from people who downloaded the listed titles between May 2024 and January 2026. Its form asks about account compromises, missing funds, wallet addresses and transaction records. Consequently, reporting those details could help investigators identify additional victims and trace further transfers.

The post Hidden Malware in Steam-Linked Games Led to a Federal Arrest appeared first on CrispyBull.

Visa has opened a new platform for selected financial institutions and fintech companies to test stablecoin operations. The service sits inside Visa’s payment infrastructure. Clients can use one environment to create wallets and manage the minting, transfer and redemption of Open USD.

The Visa Stablecoin Platform brings several previously separate technical functions together. However, it remains a limited beta, and Visa has not made the service broadly available to banks, consumers or the merchants connected to its network.

Visa packages stablecoin operations in one system

The platform, known as VSP, serves banks, fintech companies, payment providers and crypto businesses. According to Visa’s July 16 announcement, approved clients can manage stablecoins through a Visa-controlled environment. Their available functions include minting, holding, transferring and redeeming tokens.

Minting creates new stablecoin units when the required money enters the system. Burning removes units when a holder redeems them. Visa is packaging those processes with bank-account connections, wallet infrastructure and controls over who can authorize transactions.

Meanwhile, institutions can use Visa’s new Wallet-as-a-Service offering or connect wallets they already operate. The system includes audit logs, transfer allow lists and dual approvals. Under that last control, one person starts a sensitive transaction and another authorized user must approve it.

Together, these features address a practical obstacle for financial companies. A business may want to use stablecoins without building every technical and internal control itself.

>>> Read more: Visa Launches USDC Settlement for U.S. Banks

Open USD is the first supported stablecoin

The Visa Stablecoin Platform begins with Open USD, or OUSD. Open Standard recently introduced the dollar-linked token with support from a group of financial, technology and crypto companies.

Visa does not issue OUSD. But, VSP connects participating institutions to the Open Standard system so they can mint, burn, manage and transfer the stablecoin.

VSP launches with support for Open USD alongside Visa’s existing support for Circle’s USDC and Paxos’ USDG through its earlier stablecoin services. Still, the company has not named which blockchain or blockchains VSP itself is using for the current tests, even though Visa’s broader stablecoin settlement infrastructure already runs on disclosed networks.

The choice also adds another competitor to the market led by Tether’s USDT and Circle’s USDC. Reportedly, Circle shares fell around 5% on July 16 as investors assessed the new competitive pressure. Only time will show whether the sentiment proves right and OUSD gains significant adoption.

The platform connects with Visa’s existing services

Visa already supports stablecoin settlement for selected partners and works with stablecoin-linked cards and blockchain-based money movement. VSP links those capabilities with the treasury and settlement systems that institutions use today.

For example, a client could link a bank account and set internal policies for stablecoin movements. It could then manage wallets and approvals through the platform. At the same time, the client could connect that activity to existing Visa services.

This approach gives institutions another way to handle money behind payment, settlement or treasury products, next to Visa’s card network. Consumers may not see the stablecoin layer at all if a bank or fintech builds it into an existing service.

>>> Read more: Visa Taps BVNK to Pilot Stablecoin Payouts via Visa Direct

Broad availability still depends on the beta

Visa’s network reaches about 15,000 financial institutions and more than 200 million merchants, according to Fortune. Should Visa decide to expand beyond the current beta, this base would be large enough that even modest adoption within VSP could translate into meaningful volume.

The company has not disclosed the names of participating institutions, transaction volumes, pricing, or a timetable for broader access. It has said, however, that beta results will determine how and where it expands the platform.

The post Visa Opens Stablecoin Platform to Selected Beta Clients appeared first on CrispyBull.

Tether has frozen $131 million in USDT held across four wallets linked to the Central Bank of Iran. The restrictions followed a July 14 update to the US Treasury’s sanctions list. OFAC added the wallet addresses to the bank’s existing entry.

This freeze linked to Iran shows how much control an issuer retains over tokens like USDT moving on a public blockchain. Though the tokens remain visible in the wallets and US authorities did not seize them, their holders can no longer transfer or redeem the affected USDT.

OFAC added four wallets to an existing designation

The Treasury’s Office of Foreign Assets Control, or OFAC, has sanctioned the Central Bank of Iran since 2019. Its July 14 update added four more cryptocurrency addresses as identifiers connected to the bank. It’s not a new designation.

All four addresses operate on TRON, a blockchain widely used for moving USDT. Publishing them allows exchanges, custodians and compliance services to screen transactions involving the wallets.

Independent on-chain analyst Specter also traced the four wallets to both the Central Bank of Iran and activity linked to the Islamic Revolutionary Guard Corps (IRGC) before Treasury’s public confirmation. This attribution comes from Specter’s own blockchain analysis. OFAC’s official designation cites only the Central Bank of Iran.

Chainalysis reported on July 15 that the addresses had received more than $165 million in stablecoins. According to its onchain analysis, Tether froze the $131 million that remained accessible when the restrictions took effect. Some funds had already moved elsewhere.

Chainalysis also traced earlier funding to an institutional liquidity provider and an Asia-based payment processor. It did not publicly identify either business, leaving an important part of the transaction route unresolved.

>>> Read more: Tether freezes $225 mln USDT linked to crypto crimes

How Tether can make USDT unusable

USDT transactions appear on public blockchains, but Tether issues and administers the token. Its smart contracts include controls that can prevent designated addresses from sending or redeeming their balances.

That mechanism does not erase transactions or remove a balance from a wallet, so it remains visible onchain. But it locks the balance. The holder can no longer use the USDT for transactions. Freezing USDT linked to Iran doesn’t mean that Tether or any other authority took control or ownership of the balances. Asset seizures would require a separate legal process.

>>> Read more: UK Crypto Exchanges Under Scrutiny Over Iran Links

Almost $475 million has now been blocked

The latest $131 million is not the first freeze involving addresses attributed to Iran’s central bank. The action brings the total Tether has blocked to almost $475 million across wallets identified by OFAC as belonging to the institution. That total includes roughly $344 million frozen previously in April, which was tied to the same underlying OFAC blockade against the Central Bank of Iran. Last month OFAC also sanctioned major Iranian crypto exchanges, which the Central Bank had reportedly used to move funds in and out of stablecoins, which indicates a broader enforcement pattern beyond wallet freezes.

OFAC has cautioned that the wallet identifiers it publishes may not represent all addresses linked to a designated entity. In this case, the four TRON wallets disclosed in the July update may not capture the full set of addresses tied to Iran’s central bank, leaving open the possibility of additional, undisclosed wallets. Separate blockchain analysis points to a larger overall footprint: Elliptic estimates that Iran’s central bank has accumulated at least $507 million in USDT in total, used to support the rial. The gap between Elliptic’s estimate and the $475 million frozen so far reinforces OFAC’s own caveat that unidentified wallets may still be out there.

The next question is whether US authorities pursue seizure or forfeiture proceedings against the frozen balances. Investigators have not disclosed how much money moved before the restrictions. They may also identify additional wallets linked to the central bank. It has not transferred those funds to the US government, and it does not cover every crypto wallet associated with Iran or its central bank.

Where issuer control meets crypto’s original premise

Iran has faced restrictions on access to the global banking system for years, and stablecoins have offered a workaround. Dollar-linked value and international liquidity without a traditional correspondent bank. This action shows the limits of that workaround.

Crypto’s founding pitch was self-custody: control your own keys, and no bank, government, or company can touch your money. “Not your keys, not your coins” became the shorthand. The risk was always framed as someone else holding your wallet.

>>> Read more: Tether TRON Financial Crime Unit Freezes $300 M in Illicit Crypto

Now we see a version of the risk nobody built that phrase for. Nobody took the keys. Nobody seized the wallets. The Central Bank of Iran still controls those four addresses, and the tokens are still sitting there, visible on TRON, exactly where they were. Tether didn’t need the keys at all. It froze the token at the contract level, the same mechanism it has always held over USDT.

It’s less a break-in than a wall built at the exit. The wallet still opens. The tokens still exist. They just can’t go anywhere.

That distinction is what draws the comparison to central bank digital currencies, where a central authority holds that same freezing power over its own currency by design. No, this was not a purely internal decision on Tether’s part. The freeze followed a public OFAC designation, an external and published trigger. But for someone holding a centrally issued stablecoin, the practical experience, funds visible, funds unusable, looks a lot like what critics warn a CBDC could do.

The post Tether Freezes $131M in USDT Linked to Iran’s Central Bank appeared first on CrispyBull.

Following the announcement of the first award recipients earlier this year, CrispyBull is now recognizing three organizations that have made a measurable impact within their respective regions and categories.

The latest winners are:

• Best Crypto Exchange LATAM 2026 — Bitso
• Best Customer Service North America 2026 — Coinbase
• Innovation in Digital Finance North America 2026 — Circle

Each award recipient was evaluated based on product quality, customer experience, market reputation, regulatory standing, innovation and long-term contribution to the digital asset industry.

As with every category, these awards focus on consistent performance over time, not just short-term success.

Best Crypto Exchange LATAM 2026 — Bitso

Latin America has become one of the world’s fastest-growing cryptocurrency markets. Economic uncertainty, inflation and increasing demand for efficient cross-border payments have accelerated crypto adoption across the region.

Within that landscape, Bitso has established itself as one of the most influential exchanges serving Latin American users.

Founded in Mexico, the company has expanded across multiple markets while building a reputation for reliability, regulatory engagement and products tailored to local financial needs.

Instead of copying the playbook of global exchanges, Bitso has concentrated on addressing the specific financial challenges faced across the region. Its platform supports local currencies across several countries and offers accessible on-ramps and off-ramps. It has already become an important infrastructure provider for cross-border payments throughout Latin America.

The company has also invested heavily in compliance and operational resilience while expanding services retail customers and institutional clients alike.

The CrispyBull editorial team believes Bitso represents the strongest combination of regional expertise, customer trust and practical utility in the Latin American market today.

Best Customer Service North America 2026 — Coinbase

Excellent customer support has become one of the defining characteristics of successful digital asset platforms.

As cryptocurrency adoption expands beyond early adopters, users increasingly expect the same level of service they receive from established financial institutions.

Coinbase has invested significantly in improving that experience.

While no large exchange is immune from support challenges during periods of rapid growth, Coinbase has spent recent years strengthening customer assistance through expanded support channels, enhanced account recovery processes, clearer educational resources and improved security tools.

The company has also continued to introduce features to help customers better protect their accounts, manage transactions and resolve issues more efficiently.

Customer service extends beyond responding to support tickets. It includes product design, transparency, security communication and the overall experience users encounter throughout their relationship with a platform. Across these areas, Coinbase has demonstrated consistent progress while serving one of the largest customer bases in North America.

The CrispyBull Awards recognize organizations that continue improving. Coinbase’s hits that mark with its ongoing investment in customer experience.

Innovation in Digital Finance North America 2026 — Circle

Innovation in financial technology is not always defined by launching the most visible consumer product. Sometimes it comes from building the infrastructure that enables the broader digital economy.

Circle has become one of the most influential companies operating in that space. The company has played a central role in advancing regulated stablecoin infrastructure through USDC while developing payment, settlement and financial services that connect traditional finance with blockchain technology.

As governments, banks and financial institutions continue exploring tokenized money and digital payments, Circle has positioned itself as one of the companies helping shape that transition.

Its work extends beyond issuing a stablecoin. Circle has consistently focused on compliance, transparency and institutional-grade infrastructure while expanding services that support businesses, developers and financial institutions.

During the past year, the company has continued strengthening its role within regulated digital finance, reinforcing its position as an important bridge between traditional financial systems and blockchain-based payments.

The CrispyBull editorial team believes Circle’s long-term contribution to regulated digital finance and payment infrastructure distinguishes it from its peers.

Recognizing excellence across global markets

One of the goals of the CrispyBull Awards is to acknowledge that excellence often looks different across regions.

Markets mature at different speeds. They operate under different regulatory environments and serve users with different financial needs. Regional awards allow companies to be evaluated within the context of the markets they serve instead of a one-size-fits-all global comparison.

This year’s regional winners illustrate that diversity.

Bitso has become an essential part of Latin America’s crypto ecosystem by addressing practical financial challenges unique to the region.

Coinbase continues raising expectations for customer experience within one of the world’s largest digital asset markets.

Circle is helping define the infrastructure that could support the next generation of digital finance.

Although they operate in different segments of the industry, each company has demonstrated a sustained commitment to improving how individuals and businesses interact with digital assets.

More CrispyBull Awards winners will follow

The CrispyBull Awards 2026 will continue throughout the year as additional regional and global winners are announced across multiple categories.

Nominations for the 2026 awards will remain open until July 31, 2026, after which the editorial team will finalize evaluations for the remaining categories.

The awards aim to recognize organizations that have delivered meaningful value to users while contributing to the continued development of the cryptocurrency and digital finance industries. Further winners will be revealed as the evaluation process progresses.

The post CrispyBull Awards 2026 Recognize Bitso, Coinbase and Circle with Regional Honors appeared first on CrispyBull.