AGP Executive Report

Crypto Security: Ethereum’s Vitalik Buterin warned that AI-driven advances in mathematics could weaken some cryptographic systems within two years; researcher Justin Drake urged the industry to prepare a calm, gradual shift to fresh wallet addresses. Europol said quantum threats target wallets with exposed public keys, not blockchain histories themselves. Stablecoin Fallout: Kyrgyzstan ordered the liquidation of USDKG’s issuer and state-owned Coin Nomad Exchange months after UK sanctions. Holders can seek redemption in fiat or USDT. Fraud Cases: US prosecutors charged Kishu Inu founder Alexander Sisemore over an alleged $9 million investor fraud, while a jury convicted the Uranium Finance hacker in a separate $55 million theft. Regulatory Shift: The SEC proposed new crypto custody rules for investment advisers and funds, while the CFTC advanced rules for leveraged crypto trading. FinCEN withdrew proposed rules targeting mixers and unhosted wallets. Privacy Concerns: UK tax authority HMRC is considering broader powers to obtain crypto firms’ records, but the proposals are not yet in force.

Quantum Warning: Ethereum researcher Justin Drake urged crypto holders to prepare for a possible future break in ECDSA signatures, moving funds from addresses whose public keys are exposed. Europol also flagged exposed wallets as the main quantum risk, while stressing that blockchains themselves remain resilient. Crypto Enforcement: A Manhattan jury convicted Jonathan Spalletta over hacks that stole more than $50 million from Uranium Finance. Separately, Kishu Inu founder Alexander Sisemore was charged in an alleged $10 million rug pull. Market Rules: The CFTC proposed a federal framework for leveraged retail crypto trading, but spot-market oversight remains outside the plan. Treasury, meanwhile, dropped proposed reporting rules for crypto mixers and unhosted wallets amid privacy concerns. Scam Risks: Newburyport voted to ban crypto ATMs after police linked them to $134,700 in reported losses, while Alberta RCMP warned that scammers are using fake government threats to push victims into Bitcoin ATM payments.

Crypto Market Slide: Risk-off selling hit majors on Oct. 7 as oil jumped, Treasury yields rose, and the dollar firmed—Bitcoin hovered near $84k, Ethereum slipped below $2,620, and XRP traded under $1.50. Regulation & Privacy: FinCEN withdrew two proposed rules that would have scrutinized self-custody wallet transfers and treated crypto mixing as a top laundering focus, while the CFTC pushed ahead with new crypto oversight plans despite Congress stalling. Quantum Security Push: Europol warned wallets are the weak spot for future quantum attacks, and UK defense firms demoed quantum-secure encrypted links; Zumo and Quantum Chain also announced quantum-secure financial infrastructure work. Custody & Banking Expansion: Russia added Sberbank to its approved crypto custodian register; South Africa’s FNB launched crypto trading for ~9M customers via VALR (BTC/ETH/XRP/SOL/USDT, no transfers in or out). Legal/Enforcement: Conduit sued Tether in New York over $2.76M in frozen USDT. Security & Scams: Europol and multiple reports kept spotlighting scams and wallet risk, while BTCC refreshed its Trust Center with proof-of-reserves claims.

Market Signals: Ethereum’s rally outpaced Bitcoin last quarter, but thinner order books and a record staking exit queue (843,000 ETH) are raising caution flags. Texas Security & Privacy: Texas regulators sued to block release of data-center and crypto mine location records, arguing the details could help terrorists. Crypto Adoption vs Scams: New U.S. research finds 33M Americans plan to buy crypto, yet confusion and scam fears still hold many back. Stablecoin Pushback: A survey of community banks shows most are wary stablecoins could drain deposits and reduce lending, with calls for clearer rules. Regulation Watch: The SEC’s updated crypto FAQ is framed as non-binding staff guidance, while the IRS issued staking safe-harbor updates for certain trusts. Custody & Compliance: Conduit sued Tether over a $2.76M USDT freeze, and Texas fined OKX and a Singapore payments firm for unlicensed stablecoin transmission. Cyber Threats: NordVPN says Roblox phishing has become a ready-made scam supply chain, and new reporting highlights synthetic identity fraud accelerating with AI. Banking Integration: South Africa’s FNB launched crypto investing inside its app (BTC, ETH, XRP, SOL, USDT) but keeps assets in a “walled garden.” Policy & Politics: Fairshake backed 32 House candidates tied to the CLARITY Act as crypto regulation fights continue.

Regulation Backpedal: FinCEN withdrew proposed rules that would have expanded reporting on unhosted wallets and foreign crypto mixers, citing concerns about overreach and burden on institutions. Banking Push: Rain filed for an OCC national trust bank charter to support stablecoin custody, reserve management, and US dollar-backed stablecoin issuance for institutions. Crypto Market Rules: The CFTC proposed a federal framework for exchanges offering leveraged spot crypto trading, creating a new “crypto asset market” category with anti-manipulation controls and reserve proof. Security & Scams: Cisco Talos detailed “ClickFix” attacks that hide malicious code inside trusted services like Chrome and Google Sheets, while Binance used Cybersecurity Awareness Month to urge African users to spot scam tactics. Institutional Tech: Solana Foundation launched Solana DvP to enable atomic delivery-versus-payment settlement for tokenized assets in seconds, with JPMorgan input. Exchange Moves: OKX launched OKX Money, turning local-currency deposits into dollar-backed stablecoins for saving, spending, and cashback. Legal/Crime: A “Crypto King” fraud trial began in Toronto for Aiden Pleterski, and a separate “Crypto King” sentencing highlighted bribery and theft tied to crypto-era schemes. Market Watch: Bitcoin again failed near $87K, slipping toward the mid-$85Ks as spot ETF flows cooled.

Crypto Policy Privacy Win: U.S. Treasury/FinCEN withdrew two proposed crypto surveillance rules targeting mixers and self-custody reporting, ending efforts that critics said would chill legitimate on-chain activity while keeping existing BSA obligations intact. Ethereum Security & Staking Friction: MetaMask’s staking exit is swelling Ethereum’s entry queue to ~25 days for new stakers, while the Ethereum Foundation says a stronger defense (native transaction assertions) won’t ship until 2027 and won’t stop most 2026 social-engineering/key thefts. Cybersecurity Shock: OpenSSL patched a DTLS flaw (CVE-2026-84782) that could leak unrelated memory during secure connection setup, urging teams to audit DTLS usage and bundled libraries. Fraud & Enforcement: Supreme Court of Canada will test jurisdiction in a Binance-linked crypto fraud case for Canadian victims; Greece remanded military personnel over an alleged $8M crypto pyramid scheme. Market/Industry Moves: Bank of North Dakota launched Roughrider Coin for tokenized interbank payments; Paxos rolled out PaxGy tokenized gold; Backpack launched a tokenized iShares MSCI Brazil ETF on Solana. Regulation Catch-Up: CFTC proposed new retail crypto transaction rules, aiming to prevent abusive practices as Congress stalls. Security Threat Landscape: Netcraft found nearly 40,000 phishing URLs hitting U.S. financial firms in H1 2026, powered by cheap hosting and fast switching.

Crypto Crime Crackdown: Greek police arrested 17 over an alleged $8M crypto pyramid scheme that reportedly recruited ~10,000 investors via a platform controlled by suspects, including two Greek servicemen. Home-Invasion Extortion: UK authorities reported a crypto robbery where attackers threatened a pregnant woman to force a transfer of thousands in cryptocurrency. Exchange Collaboration: MEXC and Payward (Kraken parent) say they’re exploring broader collaboration ahead of TOKEN2049 Singapore, focusing on market access, liquidity, and user experience. Regulation Watch: Hong Kong plans four new crypto licensing regimes before end-2026 covering dealing, custody, advisory, and management, with SFC oversight. Asia Stablecoin Reality Check: Visa’s APAC survey finds stablecoin awareness is rising, but only 6% understand how they work, with fraud concerns a top blocker. Security Alerts: Rejetto HFS is facing active exploitation of a session-forgery flaw (CVE-2026-61500) that can lead to admin access and remote code execution. Philippines Asset Freezes: A court froze 25 crypto wallets and 86 bank accounts in a flood-control corruption probe. DeFi Risk Scoring: S&P Global launched a Vault Risk Assessment for blockchain lending vaults as deposits hit about $10B in September.

Mobile Money Security: Kenya’s CBK is pushing rules for M-Pesa and Airtel Money to report mobile cash theft and cyber breaches immediately, with fines up to Sh1m or permit risk. AI Governance Push: Trump confirmed DNI chief Jay Clayton as head of a new “Super Intelligence Force,” while Anthropic is also calling for stronger AI regulation—sparking comparisons to how crypto-era influence politics worked. Crypto Custody & Stablecoin Mechanics: New Treasury/SEC-style market plumbing could change how stablecoin issuers convert reserves into dollars, as SEC deadlines target more Treasury trades through central clearing. Bitcoin Safety Upgrade: Bitcoin Core merged a fix that closes a signing gap in partially signed transactions, reducing the chance funds can be redirected without proper binding to the approved destination. Ethereum Staking Move: Sharplink deployed $200m in ETH to Lido, holding wstETH via Anchorage Digital. Security Threats: MacSync malware can hide commands inside iCloud calendar events, and passkeys are getting renewed attention as a phishing-resistant login upgrade. Scam Crackdowns: Philippines authorities arrested 244 suspects in an online scam crackdown tied to offshore gaming operations. Regulatory Watch: SEC crypto custody proposals keep drawing pushback as self-custody and DeFi vaults face uncertainty.

Crypto Terror Finance Crackdown: The US Treasury sanctioned a Hamas military operative and a France-based fundraising network, alleging over $2M moved via sham charities and cryptocurrency, with US asset blocks and transaction bans. Stablecoin Banking Debate: A BIS-style scenario argues stablecoins may not “drain” deposits, but can still make bank funding less dependable by shifting who holds the dollars. Philippines Court Freezes Crypto in Flood Scandal: A Court of Appeals order froze 116 assets tied to a prominent lawmaker, including 25 crypto wallets, under a plunder investigation tied to flood-control kickbacks. Exchange Security Watch: Europol says it dismantled KillSec, a ransomware gang behind nearly 1,000 attacks, while a separate report flags a critical GitLab AI Gateway flaw that could enable command execution on self-hosted setups. Market Pulse: Zcash (ZEC) heads into October with its NU7 upgrade on testnet soon, but price remains below September peaks. AI Governance: Reports say Trump picked Jay Clayton as the new AI czar to lead a White House “Super Intelligence Force.”

Major Exchange Breach: Chainalysis says Bitget’s $387M hack was tied to North Korea, with stolen XRP routed via cross-chain swaps into Bitcoin—pushing DPRK-linked theft totals above $1B in 2026. Regulation & Custody: The SEC proposed updated crypto custody rules for advisers and funds, while ESMA wants to extend EU stablecoin limits to custody and transfers for non-compliant tokens. US Banking Pushback: The Independent Community Bankers of America sued the OCC over “side door” national trust charters for crypto firms, as more approvals roll in. ETF Flows & Rates: CoinShares’ crypto ETF closures (taxable for holders) hit the spotlight as Bitcoin stays near $85K while Treasury yields jump. Scam & Crime Watch: A UK case highlights an NCA officer stealing Silk Road-linked Bitcoin; US prosecutors also charged a bank worker accused of moving nearly $1M into Coinbase-linked crypto accounts. Market Signals: XRP traders watch a triangle breakout above $1.54, while Zcash’s surge keeps questions alive about whether it can hold $1,000 into October.

UK Crypto Robbery: Masked attackers in Solihull beat a man with hammers and threatened to kill his pregnant wife’s unborn baby to force a crypto handover; police are investigating and Crimestoppers is offering a £10,000 reward. US SEC Custody Push: SEC Chair Paul Atkins says more crypto rules are coming, spotlighting a new proposal to clarify how investment advisers and funds can custody crypto. Bank Charter Fight: The ICBA sued the OCC over national trust bank charters for crypto firms, targeting approvals for Coinbase and Circle and warning about uneven standards. Prediction Markets Under Scrutiny: UK regulators are being urged to act after Polymarket let users bet on HSBC and Lloyds failing, raising market integrity and manipulation concerns. Security Breach Fallout: Chainalysis says it used AI to compress Bitget bridge tracing from 20 hours to under 10 minutes after the $387M hack, with DPRK-linked activity suspected. Crypto Fraud Warnings: UK/Europe saw fresh scam alerts, including romance fraud losses in Northern Ireland and impersonation calls demanding payment via crypto ATMs. Ripple Expands in Korea: Four Korean banks joined Ripple on the “XRP Seoul” stage as tokenized deposits and cross-border remittance pilots move forward.

SEC Crypto Custody: The SEC proposed new custody rules for investment advisers and funds, including limited self-custody and allowing state trust companies as custodians, while also signaling more crypto proposals ahead. Regulatory Pushback: Community banks sued the OCC over expanded trust-charter authority for crypto firms, arguing it exceeds legal limits and weakens safeguards. Protocol Governance: Aave proposed creating an ownerless Cayman foundation to hold Aave protocol IP for the DAO, aiming to close a legal-ownership gap without giving the foundation voting or veto power. Cross-Chain Liquidity: THORChain opened a Zcash (ZEC) liquidity pool, with validator nodes now tracking Zcash and swaps expected as the next step. Cyber & Scams: Greek police uncovered an alleged $8M crypto pyramid scheme promising double-your-money in 50 days using AI trading claims; separately, BBB warned about impersonation scams that use real account details to trick victims. Security Incident: Bitget said it froze about $1.1M of the ~$388M hack and expects limited recovery, while withdrawals resumed. Crypto Policy Abroad: Albania approved draft laws tightening crypto rules and setting up an independent fiscal council.

SEC Custody Push: The SEC proposed new crypto custody rules for investment advisers and funds, including a path for limited self-custody and state-chartered trusts—another step in the agency’s fast-moving overhaul. Sanctions & Crypto Rails: The U.S. Treasury sanctioned Russia-linked A7 as a significant transnational criminal organization, citing $17B+ in illicit flows tied to sanctions evasion. Stablecoin Payments: Fiserv’s digital-asset platform went live with Bank of North Dakota’s Roughrider Coin, using Solana for transactions inside a regulated banking setup. Major Heist & Violence: A UK crypto robbery case alleges attackers threatened to kill a pregnant wife and forced transfers of hundreds of thousands of pounds in cryptocurrency. Wallet Security Incident: A FlashLoopAdapter exploit drained about $305K from two Aave-linked Safe wallets on Ethereum, with SlowMist pointing to an access-control flaw. Ransomware Takedown: Europol and partners arrested a suspected teen behind KillSec and seized servers and stolen data in Operation KillSwitch. Cybercrime via AI: Researchers say attackers abused ChatGPT Custom GPTs to deliver RAT malware through ClickFix-style lures. Stablecoin & Payments Event: WasabiCard will host a TOKEN2049 forum on stablecoin liquidity flowing into card programs and cross-border payments.

Major Hack Fallout: Crypto hacks hit a brutal peak in September, with losses topping ~$766M as Bitget’s ~$387.5M breach and Liquid Network’s exploit dominated the month. Exchange Security: Bitget says the theft came via a zero-day in a third-party security product, with Circle/Tether/NEAR freezing about $1.1M while the platform works to restore withdrawals. Wallet/Validator Risk: MetaMask is exiting affected Ethereum validators after an infrastructure security incident; Lido expects final exits by Oct. 7. Regulation Watch: South Korea’s FSC is moving to expand tokenized trading to stocks, bonds, and funds starting Feb. 4, 2027, as lawmakers also push to postpone crypto income taxes. Stablecoin Debate: Switzerland’s central bank warns large stablecoins could complicate monetary policy transmission. Banking Infrastructure: 39 US state banking associations back a BankChain Alliance aimed at regulated stablecoin and tokenized-deposit rails by 2027. Fraud & Crime: US sanctions added TRON addresses tied to Tren de Aragua ATM jackpotting, while India/elsewhere reports keep surfacing on Telegram task-and-crypto investment scams.

Regulation Push: ESMA is urging stronger EU crypto enforcement under MiCA, including asset freezes tied to crime, faster takedowns of scam sites, tighter rules for misleading marketing, and clearer customer cost disclosures. UK Oversight: The FCA opened its crypto authorization application process, setting up full regulation ahead of the October 2027 regime. Prediction Markets Clash: The U.S. CFTC sent rules to the White House that would treat event contracts as swaps while carving out “casino-style” products—aimed at undercutting state gambling claims and shaping Supreme Court-level fights. Security Warnings: Authorities flagged rising impersonation scams, including fake law enforcement calls and delivery-driver home invasion attempts targeting crypto wealth. Market Watch: Bitcoin surged past $85K on inflation hopes, then slipped back within hours, while the quarter’s rally keeps momentum. Crypto Infrastructure: Circle launched developer kits for app-based USDC purchases, lending, and Bitcoin-collateral loans on Arc, reducing the need for custom smart contract builds. Funding & Tech: Relay raised $36M to expand AI-powered frontline operations, and DogeOS opened an EVM-compatible Dogecoin testnet to court programmable dApps.

Bitcoin as inflation hedge questioned: After oil jumped back above $100 on Sept. 28, Bitcoin slid about 1.8% to around $83,070, challenging the “safe haven” narrative as macro moves hit risk assets. Cybercrime & romance scams: Interpol says romance and crypto investment scams in Southeast Asia have escalated into a national security threat, with 2025 losses put near $442B. Fraud trial spotlight: Canada’s “Crypto King” Aiden Pleterski will represent himself at a $40M fraud trial after only about $3M was recovered for roughly 160 investors. Security patch for crypto users: Apple issued an emergency iOS fix for a CoreGraphics zero-day reportedly exploited to target crypto wallet data. Regulation pressure in Australia: ASIC’s temporary no-action relief for crypto licensing ends Sept. 30, pushing firms into formal authorization or risk penalties. Crypto payments go mainstream: Binance Pay launched USDT spending at PayPay merchants across Japan via HIVEX, while Axis Bank became India’s first bank to launch Apple Pay for credit cards. Institutional blockchain momentum: Ripple and CSD BR will use the XRP Ledger to record and audit tokenized fund shares in Brazil. Exchange recovery efforts: Bitget rolled out a rewards program after its $388M breach and said withdrawals are reopening in stages.