AGP Executive Report

Wallet Breach Watch: SafePal disclosed an authorization flaw that exposed order info for about 39,798 customers (names, addresses, purchase details), while seed phrases, private keys, passwords, and payment data stayed safe; SafePal says it patched the issue, removed 30+ phishing sites, and will retain data for just 90 days. AI Scam Surge (Australia): ASIC warns deepfake celebrity/politician scams are rising fast, with more than 19,000 removed in a year; scammers use fake “news” and social ads to push victims into crypto-linked investment sites. Stablecoin Transparency: Tether says KPMG completed a full audit of its 2025 financials with an unqualified opinion, including physical inspection of gold bars backing USDT. Regulation Crossroads (US): CLARITY Act odds are slipping as banks push back on stablecoin rewards, setting up a September fight over whether yields look too much like bank interest. Crypto Market Growth: Tokenized ETF market cap jumped 826% to about $611M in a year, led by Ethereum issuance. Crypto Politics: Trump-linked World Liberty Financial received conditional OCC approval for a bank charter tied to a USD1 stablecoin plan.

Trump-linked banking push: The OCC granted World Liberty Trust Co. conditional approval for a national trust bank charter, a first-of-its-kind move for a sitting president’s family, setting up a regulated USD1 stablecoin path—while Democrats warn about conflicts. Regulation roulette: Galaxy cut the odds of the CLARITY Act passing this year to 10% as Senate timing tightens and the SEC cancels a tokenized-securities meeting. Sanctions tightening: Bitget moved to restrict 16 sanctioned crypto platforms in phases (starting Aug. 7) while expanding US stock-token offerings; HTX disputes the impact. Security and scams: Microsoft is making passkeys the default in Entra ID and retiring SMS/voice MFA; WhatsApp is testing an on-device AI scam alert against voice-clone fraud. AI watermark backlash: Anthropic’s invisible watermarking for Claude is driving a surge in watermark-removal scams and misleading apps. Bitcoin scarcity debate: CZ says lost/stuck coins could make a full BTC out of reach for many millionaires. Crypto crime/legal: Bybit sued North Korea and Lazarus to freeze cashout routes after a $1.5B hack.

Regulation Watch: The SEC delayed its tokenized-securities “innovation exemption,” adding friction to the already-stalled CLARITY Act as Congress and regulators keep moving on separate tracks. Market Structure: A new dataset of 377 disclosed 1H 2026 funding rounds argues crypto’s “permissionless era” is effectively over, with money clustering in regulated areas like payments, stablecoins, exchanges, and prediction markets. Tokenized Equities: Bitget’s Reality Protocol rNVDA on Arbitrum One jumped to roughly a $18M–$20M market cap as NVIDIA-share backing and dividend payouts move on-chain. Security & Scams: DeFiLlama founder 0xngmi says a fake App Store DeFiLlama drained a wallet until Apple removed it after the team proved theft; separately, macOS Screen Sharing flaws are being actively exploited to install Monero miners—patch now. Policy & Compliance: ICE withdrew a sole-source $125M Thomson Reuters surveillance data plan and will compete it. Crypto Policy Meeting: The White House is set to host major crypto and prediction-market leaders Aug. 19 as CLARITY odds remain low. Payments Expansion: Coins.ph is integrating Bayad to add nearly 300 billers and speed up posting for everyday payments.

US Regulation Stalls: The SEC abruptly canceled its “Regulation Crypto” vote meeting, leaving token issuers waiting as the CLARITY Act heads toward September and Galaxy Research pegs passage odds at just 10%. White House Push: Trump will host major crypto and prediction-market CEOs (Coinbase, Ripple, Chainlink, Kalshi, a16z and more) to discuss regulation, while the CFTC moves ahead with its own AI/crypto advisory work. Banking for a Trump-linked Token: The OCC granted World Liberty Financial’s trust bank preliminary conditional approval to issue and manage USD1, boosting its stablecoin ambitions. Security & Scams: Mumbai EOW arrested four over an “Origin AI” alleged Rs 30-crore Ponzi/MLM; CyberWallet users face an Aug. 15 shutdown with “recovery” risk; and France’s DGFiP data breach reportedly exposed 678k taxpayers, raising new scam threats. Market/Exchange Watch: Bithumb posted a $15.7M Q2 net loss as revenue fell 36%. Tech Risk: GeoServer’s zero-day is already being probed, with no patch yet.

SEC/Token Rules: The SEC canceled its crypto fundraising meeting again, leaving token issuers with no clear next step as regulators shuffle authority between the SEC and CFTC. Banking/Stablecoins: The OCC conditionally approved a national trust charter for Trump-backed World Liberty Financial, paving the way for faster stablecoin-related settlement and asset services. Traditional Finance Meets Crypto: Israel’s Bank Leumi is partnering with Galaxy Digital to let retail customers trade BTC, ETH, and SOL in its Leumi Trade app starting in early 2027. Crypto Scams: Singapore warned of fake crypto job offers after $11.8M in losses, while Canada’s BBB says investment/crypto fraud is the riskiest scam category. Security/Exploits: Netherlands NCSC says a high-severity macOS flaw is under active exploitation, with attackers gaining root and installing Monero miners. DeFi Safety: 1inch joined SEAL’s Whitehat Safe Harbor to legally protect rapid intervention during active exploits. Market/Industry: Binance moved to restrict transactions with multiple platforms tied to compliance and sanctions. Regulation/AML: Ireland’s new AML strategy adds enhanced controls for transfers involving private crypto wallets, aligning with EU travel-rule expectations.

US Regulation Crossroads: The Senate punts the CLARITY Act to September, but the SEC is moving anyway—voting on a 400-page “Regulation Crypto” plan that creates new token offering pathways while leaving the SEC-vs-CFTC split unresolved. Prediction Markets Under Pressure: JPMorgan ended its Polymarket banking ties amid scrutiny, while the CFTC used emergency powers to keep Kalshi running after New York’s $36B lawsuit—another sign crypto-adjacent markets are getting squeezed by state-federal conflict. Crypto Crime Crackdown: Ukraine police shut down 94 fraudulent call centers, seizing computers, SIMs, and access to 12 crypto wallets tied to impersonation and remote takeover scams. Security Breach Watch: Trezor says a shipping-provider breach exposed about 13,700 hardware-wallet customers; Singapore also flagged a $11.8M scam using fake job offers and malware to steal crypto transfer access. XRP Signals + ETF Slump: Ripple moved $50.5M XRP to an unknown wallet, with 1M later routed to Binance, as US spot XRP ETF inflows fell 93% for the week. Local Policy + Capital Rules: Kenya’s new minimum-capital licensing is pushing startups to consider Mauritius or South Africa. Web3 Product Push: NOXCAT pitched “From Wallet to Consumer App” at Malaysia Blockchain Week, aiming to cut user complexity. UK Politics With Crypto Ties: Nigel Farage won the Clacton by-election, but the result was immediately overshadowed by disputes over a “credible threat” claim and ongoing scrutiny tied to a crypto billionaire donation.

Hardware Wallet Security: Trezor says its ShipMonk shipping partner breach exposed personal data for 13,689 customers (names, emails, phones, and shipping addresses for most), warning the wallets themselves and private keys weren’t compromised—so the danger is phishing and impersonation. Regulated Stablecoins in Asia: Hong Kong’s HKDAP stablecoin goes live on Ethereum with Anchorpoint’s first mint/redemption cycle via HashKey Exchange and OSL as authorized distributors under the territory’s Stablecoins Ordinance. Ethereum Post-Quantum Shift: Ethereum Foundation researcher Justin Drake says L1 is moving off Poseidon toward established hashes like SHA/BLAKE as part of its post-quantum roadmap. Banking Meets Crypto: Israel’s Bank Leumi plans to let customers trade BTC/ETH/SOL inside its banking apps with Galaxy Digital/GK8, pending Bank of Israel approval. Crypto Fraud & Enforcement: South Korea sentenced Delio’s CEO to 15 years over a $50M crypto deposit fraud. Policy & Compliance: The CFTC schedules an Aug. 20 meeting to discuss crypto, AI, and prediction markets. Scam Risk Escalation: Uber Freight confirms a breach tied to extortion gang Helix, while Trezor’s leak highlights how real-world data can fuel long-tail scams.

SEC Crypto Rule Push: The SEC will vote Aug. 14 on “Regulation Crypto,” a first formal rulemaking that could create tailored pathways for crypto investment-contract offerings, including a decentralization off-ramp. DeFi Security Alert: An XRPL bridge bug reportedly drained about 199,000 XRP, underscoring how deposit-detection and relayer logic can turn into real losses. Token Economics Watch: Bitwise CIO Matt Hougan argues crypto valuations beyond Bitcoin could double if more protocols route revenue into token buybacks and burns. Regulation vs Growth (Kenya): Kenya’s new crypto capital rules are pressuring startups to raise big money fast or relocate, with stablecoin issuers facing Sh300m minimums. Consumer Fraud Crackdown: Arizona’s crypto ATM law is credited with full refunds for 35 victims totaling $171k, while police in Bristol recovered a $153k cashier’s check shipment tied to a scam. Stablecoin Rails: HTX Ventures’ Open USD report says stablecoin revenue and control rights are still “closed” even as the tech layer goes “open.” AI Transparency: Anthropic says newer Claude models will embed invisible watermarking and signed provenance metadata on supported files.

Truth Social Legal Fight: The Intercept and Freedom of the Press Foundation sued Trump over Truth API, a paid Truth Social early-access feed charging up to $100,000 a month for faster posts that can move markets. Crypto Custody & Scams: Hawaii’s new law bans cash deposits into crypto ATMs/kiosks starting Oct. 1, aiming to curb kiosk-driven fraud; Kentucky also warns of jury-duty scams that push victims to pay fines via Bitcoin. Self-Custody Risk: Coldcard’s seed-generation failure reportedly exposed about $116M in Bitcoin to theft, renewing scrutiny of how users verify hardware-wallet randomness. Exchange Security: OKX says it protected $1.1B in customer assets in H1 2026 and stopped $26.3M in scam transfers. Market/Protocol Updates: XRP defended the $1 floor amid a bridge exploit fallout and heavy derivatives bets; Ripple backed xrpld fixCleanup3_3_0 but it’s still short of activation support. Regulation Watch: The US-UK crypto pact sets direction (not binding rules) for stablecoins and tokenized markets. Cyber Threats: CrowdStrike reports cloud-focused crime up 171%, with voice-phishing and device-code phishing surging.

SEC/CFTC Crackdown: Regulators filed separate suits against Goliath Ventures and CEO Christopher Delgado over an alleged $400M+ crypto liquidity-pool Ponzi, claiming investors were promised 3%–10% monthly returns but funds were misused. Crypto Fraud & Scams: A Florida “fake jury duty” scam drained $25K from a woman after impostors used a bogus warrant story and pushed her to pay via crypto ATMs—until her husband checked with ChatGPT and called 911. Cybercrime & Security: Mozilla revoked a Linux signing key for Firefox/Thunderbird after an exposed copy landed in a private repo, and a Trellix report flagged a long-running Python tarfile directory traversal issue still affecting hundreds of thousands of repositories. Regulation & Markets: The CFTC ordered Kalshi to keep running prediction markets despite a New York lawsuit, arguing state gaming laws can’t disrupt a national derivatives market. On-Chain Incident: Harmony said it’s working with exchanges to freeze funds after an alleged unauthorized 4B ONE mint, while Ravencoin plunged to a record low after an exploited consensus flaw triggered exchange suspensions. Africa Payments: Coverage highlights stablecoins becoming “invisible” payment rails across Africa, with on-chain value surging via crypto-to-fiat rails.

Crypto Regulation: The SEC is moving to take control of the Consolidated Audit Trail (CAT) and reshape its funding and governance, with a transition that could run into late 2027. US Enforcement: The CFTC charged Goliath Ventures and CEO Christopher Delgado with a roughly $400M crypto fraud scheme involving claims of guaranteed profits and misappropriated customer funds. Cyber & Scams: Gunra ransomware is targeting Fortinet and VMware systems using critical remote code execution flaws, while researchers also flagged AI-driven, more personalized scam tactics. Crypto Crime: An address-poisoning attack drained about $100K USDT after a lookalike destination was planted in a victim’s transaction history. Market Moves: XRP slipped below $1 for the first time in nearly two years, and a Coreum XRPL bridge exploit reportedly drained nearly 200,000 XRP in under two hours. Policy Abroad: Russia’s central bank approved BTC, ETH, and USDT for trading on regulated exchanges for retail investors. Security Updates: Mozilla revoked compromised Firefox/Thunderbird signing keys, urging affected users to update. Corporate: Trump Media reported a $238M quarterly loss tied largely to declines in its Bitcoin and other crypto holdings.

SEC Watch: The SEC is set to hold an Aug. 14 open meeting on a tailored “crypto investment contracts” offering framework, a move traders are watching closely as XRP and the broader market wobble. Regulation Roadblock: The Digital Asset Market Clarity Act is still alive but odds are sliding after the Senate punted action to September, keeping crypto in a patchwork of enforcement. Market Mood: Bitcoin slipped back under $64K as ETF flows turned negative and traders waited on fresh U.S. inflation data; XRP also stayed under pressure. Security & Scams: BTCPay Server users are dealing with a Lightning exploit tied to exposed admin credentials, while OpenAI says it’s handing vetted security firms a model for defensive hacking work. Crypto Crime: A “Crypto King” kidnapping case added new charges for an investor accused of meddling in a co-accused’s case, and Belgium warned criminals are using short-term rental platforms as stash houses. Onchain/Infra: Pi Network’s Protocol 26 upgrade has an Aug. 11 cutoff that can disconnect lagging node operators. Tokenization Push: India’s SEBI confirmed its corporate bond tokenization pilot is still moving, with plans to link settlement rails to the RBI’s CBDC system. Asset Recovery: Bybit won a U.S. court order freezing assets tied to the $1.5B North Korea-linked hack.

Crypto Regulation: The U.S. Senate left for August recess without voting on the CLARITY Act, pushing the key crypto market-structure decision to September and dimming odds as election-season pressure mounts. Market Structure & Policy: TD Cowen put the bill’s September pass chance at 25%, warning Democrats could sink it with ethics and AML fights. Ethereum Roadmap: Vitalik Buterin updated Ethereum’s 2023 roadmap diagram, signaling higher priority for quantum resistance and privacy while deprioritizing some earlier items. Security & Scams: South Korea’s FSS is overhauling its voice-phishing refund software so victims can be repaid in the right crypto tokens, not just won. Exchange Incident: Coinsbuy reported a coordinated $7.9M+ drain across Ethereum and TRON, with attackers swapping proceeds toward Monero. Institutional Moves: Bitmine keeps stacking ETH, adding 7,391 ETH to reach 5.805M tokens, with weekly buys continuing. Stablecoins (UK): Nephos Group was named proof-of-reserves attestation partner for GBPA issuer Agant. Crypto Crime: A Mexican national pleaded guilty to laundering $1.9M in drug proceeds using crypto and wire transfers.

AI in Cybercrime: South Korea’s Genians says North Korea-linked Kimsuky is building local AI tools (Ollama, GPT4All, Msty) to automate cyberattacks, analyze stolen data, and craft more convincing phishing, including AI-made finance/crypto decoys. Crypto Crime Laundering: A report says South Korea’s crypto laundering surge is driven by one cross-border method, Hwanchigi, tied to $6.4B of $7.1B in illegal flows since 2021, with USDT a common vehicle. Exchange Legal Pushback: Bybit sued North Korea and Lazarus over the $1.5B 2025 hack and secured a preliminary asset freeze, aiming to recover stolen funds. Market Structure & Wall Street: Wintermute registered as a FINRA/SEC broker-dealer, signaling liquidity providers are moving deeper into traditional market plumbing. Regulatory Clampdown: Australia’s AUSTRAC suspended Cryptolink’s crypto ATM operator for three months over repeated reporting failures, shutting 96 ATMs. Scam Tactics: ANZ warns of “scam-coaching,” where criminals train victims to lie to banks—often in crypto investment frauds. Crypto Security Watch: CrowdStrike reports many publicly known vulnerabilities get exploited within 48 hours, faster than before, as attackers use AI and automation.

US Crypto Regulation: Senate Majority Leader John Thune filed to set up a procedural vote on the CLARITY Act when lawmakers return from August recess, aiming for a September floor path that still needs 60 votes and faces ethics/DeFi insurance friction. Market Watch: XRP held above $1 after Bitcoin reclaimed ~$65K, with traders watching the Sept. 15 CLARITY test as a potential catalyst. Stablecoin Update: Circle says its Arc Mainnet launches Sept. 16 and points to partnerships including DTCC and BlackRock. Security & Scams: Huntress details a fake “Claude Code” install guide that can drain crypto wallets via a multi-stage macOS malware chain; the IRS warns of fake “Digital Asset Compliance Portal” letters and follow-up calls targeting crypto holders. Crypto Crime: Bybit won U.S. court support to pursue and trace funds tied to the $1.5B North Korea-linked hack, though most stolen crypto is already hard to track. Cyber-Physical Research: VicOne released a free NVIDIA Isaac Sim extension to simulate robot cyber-safety attacks before deployment. DeFi Risk Snapshot: DeFiLlama reports 99 DeFi hacks in Q2 2026, while real-world asset use in DeFi hit a new high.

Crypto Regulation: US Senate Majority Leader John Thune filed cloture on the CLARITY Act, setting a Sept. 15 procedural vote when lawmakers return from August recess—an important step toward a full floor debate, but still short of the 60-vote hurdle and facing Democratic pushback over ethics provisions. Market Pulse: Bitcoin demand stayed firm as US spot Bitcoin ETFs pulled in about $865M over Aug. 3–7 and wallet creation hit a one-year high, even as traders weigh what a CLARITY delay means for altcoins like XRP. Security & Crime: US prosecutors charged three men in a kidnapping-and-bitcoin robbery plot that could bring up to 20 years; separately, regulators and police keep warning about crypto scams, including impersonation schemes targeting users after EU MiCA licensing deadlines. Scam Watch: Singapore authorities-linked reporting highlights how “Fun Coffee” allegedly lured investors with unusually high returns and staged events, while regulators in places like Saskatchewan warned about fake “T. Rowe Price” crypto investment apps. DeFi Rules: A coordinated G7-style crackdown on unlicensed DeFi lending protocols is rattling TVL and tokens, raising the stakes for compliance-first platforms.