While 11 victims have been identified so far, the final count may still increase as investigators continue to trace more transactions. Polymarket has faced phishing and social engineering attacks since last year. Each one exploited different entry points but followed the same playbook: tricking users into handing over credentials, then clearing their wallets before they notice. Earlier this month, Polymarket’s VP of Engineering, Josh Stevens, addressed a case where a user was swindled out of more than $2 million.

The victim had entered a one-time password into a fake website that looked exactly like Polymarket, which allowed the attacker to compromise the victim’s Magic Link wallet (an email-based login system) and drain their funds instantly. Stevens stressed that while the impact was massive, the breach took place on a scam site and did not stem from a flaw in Polymarket’s own platform. That attack came after a $520,000 drain from the platform’s UMA CTF Adapter contract on Polygon in May. According to on-chain investigator ZachXBT, the attack was caused by a compromised deployer key.

Polymarket users continue to face phishing risks

The phishing risk facing Polymarket users is compounded by growing speculation around a potential POLY token airdrop. On June 25, X user Tiptop noted that Polymarket had quietly updated its FAQ page, removing language that previously stated the platform “does not have a token” and scrubbing references to having no plans for an airdrop or token generation. Polymarket CMO Matthew Modabber confirmed token and airdrop plans in an October 2025 interview.

Modabber said that the team wanted to create “a token with true utility, longevity, and to be around forever,” as Cryptopolitan reported. That confirmation prompted users to adjust their trading behavior in hopes of qualifying for a future distribution. The hype around potential airdrops makes it easy for scammers to trick people with fake eligibility checkers and claim pages. Another round of airdrop speculation has started spreading on social media, as Web3 profiles have reported that Polymarket recently removed the explicit denial of an airdrop from its FAQ page.

The risks on the platform have gone beyond phishing. Last December, SlowMist found a Polymarket copy-trading bot on GitHub embedded with malicious code meant to steal and transmit private keys to hackers. Another investigation conducted by StepSecurity in March also uncovered a compromised GitHub organization that was distributing fake trading bots designed to compromise user accounts. The platform also faces reputational headwinds.

According to a Wall Street Journal investigation, Polymarket paid influencers around $2,000 to $3,000 per month to post scripted videos showing fake trading profits. Apparently, the influencers were told to hide that they were being paid, and even ordered to redo clips if they weren’t exciting enough. They were also instructed to make the fake winnings appear as if they were real, organic experiences. In addition to the phishing campaigns and malicious bot issues, it raises concerns about user safety.

The post Polymarket users lose funds in suspected phishing attack first appeared on Coinfea.

The figure, reported by Blockworks, marked the highest daily total recorded for tokenized equity trading on spot DEXs and followed a weekly transfer volume milestone reached last week.

Solana dominates spot DEX activity

The record was highly concentrated across networks. Solana processed $553.3 million in tokenized stock volume, equal to 97.8% of all spot DEX activity in the category that day. 

Other chains handled a much smaller share. BNB Chain recorded $7.0 million, Base settled $5.2 million, and Ethereum accounted for only $94,000.

The distribution showed how strongly liquidity has gathered around Solana in this emerging market. Major tokenized equity issuers launched their first, and trading activity followed. 

The network’s low fees, fast settlement, and active DEX infrastructure have made it the main venue for traders using tokenized equities around market-moving events. 

The figures also showed that activity outside Solana remained limited, despite the presence of several supported networks and listed assets across the wider tokenized equity segment during the record session on June 24.

TradFi catalysts lift on-chain stock trading

The increase in tokenized equity activity aligned closely with two traditional finance events. Volumes began rising from June 12, the same day SpaceX, trading as SPCX, held its IPO. 

Separately, a token tracking Micron, listed as MU, began trading shortly before the chipmaker reported earnings on June 24.

These events helped explain why demand increased around specific names. Tokenized equities allow traders to seek exposure outside normal market hours, especially when an IPO or earnings report is drawing attention. 

In that setting, the on-chain version can attract activity from traders who want continuous access to stock-linked markets.

Concentration remains a key market feature

Data from Delphi Digital placed the total tokenized equity market at $1.49 billion. The top 10 names accounted for about 60% of that market. The top 20 represented nearly 75% of all listed values.

That concentration highlights how a small group of assets can influence overall market activity. A few large listings or high-profile events can move volume metrics sharply. 

Still, such concentration is common in early-stage markets where liquidity, listings, and trader attention remain focused on limited products.

The June 24 record set a new benchmark for tokenized equity trading on spot DEXs. It also showed that current activity remains tied to recognizable market events. 

SpaceX’s IPO and Micron’s earnings helped drive demand, while Solana captured nearly all recorded volume. 

The next measure for the market is whether activity remains strong during periods without major IPOs or earnings-driven catalysts.

The post Tokenized equity volume Hits Record as Solana Leads Spot DEX Trading first appeared on Coinfea.

The move follows Japan’s approval of USDC for corporate use and is intended to reduce settlement delays that currently take a few business days through traditional banking channels. Circle Internet Financial, the Boston-based stablecoin issuer, announced the partnership with Japan’s financial giant Nomura Holdings on Thursday. The agreement states that the companies will roll out the corporate settlement platform in Japan as early as 2027, once the required protocols and regulations are in place.

Circle and Nomura tap Japan’s USDC approval to launch new service

The service will allow businesses to convert Japanese yen into U.S. dollar-backed stablecoin Circle’s USD Coin (USDC). The digital asset will be accessible to companies for cross-border payments to suppliers, for transferring the asset between overseas subsidiaries, and for settling foreign exchange transactions. The project targets Japan’s import, export, and corporate foreign-exchange markets.

According to data from the Bank for International Settlements, Japan’s foreign exchange market recorded an average daily trading volume of approximately $440 billion in 2025. The announcement follows regulatory changes that expanded the use of stablecoins in Japan. According to a CryptoPolitan report, Japan’s Financial Services Agency previously approved USDC under new payment regulations, making it the first recognized U.S. dollar stablecoin authorized for local corporate business.

Following this, the partnership will see Nomura responsible for client onboarding in Japan, managing regulatory compliance needs, and bringing the settlement platform to the existing banking systems in the country. Both firms will spend the year finalizing the banking integrations, strengthening the custody side, and wrapping up the final details of the operating structure in preparation for the planned launch.

In the proposed situation, a corporate customer will convert yen to USDC through the Nomura banking system, and the stablecoins will be transferred through a blockchain network. In a smart contract, these two transactions would then be bound together to complete both sides of the currency conversion process. Circle already has requirements in place to accommodate this kind of community. Built on an open Layer-1 blockchain for stablecoin applications, its Arc blockchain also features a foreign exchange engine, StableFX.

The exchange engine allows for atomic payment-versus-payment swaps between pairs of stablecoins without the need for prefunding or bilateral credit arrangements. According to Circle’s technical model, combining currency exchange into a single encrypted transaction bypasses the settlement window in traditional correspondent banking. This means that both the sale and the purchase are carried out simultaneously, rather than at different times. The Circle-Nomura partnership comes as more financial companies move into Japan’s regulated stablecoin market.

The post Circle and Nomura to launch instant global USDC settlement first appeared on Coinfea.

His comments pushed back on the idea that Aave could be valued far below its current token-based market valuation.

Kulechov disputes discounted sale framing

The discussion followed claims that Payward had been negotiating to acquire a 15% equity stake in Aave for $385 million. 

That pricing would value Aave at about 30% of AAVE’s fully diluted token valuation, which was near $1.32 billion, based on DefiLlama data cited during the debate. 

“First off, there is NO WAY we’d sell AAVE at a 70% discount lol,” Kulechov said on X. 

Kulechov did not fully deny that Aave Labs, the for-profit company behind the protocol’s development, could sell part of its AAVE token allocation. 

He said several market participants had discussed buying AAVE, directly or indirectly, as part of a wider long-term partnership with Aave. However, he described the public framing of the matter as inaccurate.

The distinction matters because Aave Labs holds a separate AAVE allocation. A sale from that allocation would be a treasury transaction by the company, not a protocol-level sale by the Aave DAO.

Aave revenue strengthens valuation argument

Kulechov pointed to Aave’s revenue profile as a reason to reject any large discount. He said Aave generates about $134 million in annualized revenue and is preparing Aavenomics 3.0, which includes an automated and non-discretionary buyback mechanism.

Aave’s revenue approach was outlined through the Aave Will Win framework. That plan proposed sending revenue from Aave-branded products to the DAO treasury and setting a one-year development budget. The DAO later approved a $25 million stablecoin grant and 75,000 AAVE tokens for Aave Labs under the same framework.

DefiLlama showed AAVE trading near $82.49 when the debate emerged. The dashboard also tracks Aave’s total value locked, fees, revenue, active loans, and treasury metrics.

Governance tensions surround Aave

The Payward report comes as centralized exchanges and fintech firms seek exposure to DeFi infrastructure. Kraken and Aave already have a link through Ink, Kraken’s incubated Layer 2 network, which launched Tydro as a white-label version of Aave.

The timing is sensitive because Aave has faced governance disputes after the April Kelp DAO rsETH exploit. Aave was not the original target, but the attacker used unbacked rsETH as collateral, creating downstream lending risks.

Aave Chan Initiative, BGD Labs, and Chaos Labs have also moved away from DAO roles. Kulechov’s response aimed to reassure token holders that protocol value remains tied to Aave economics, rather than to discounted outside buyers or insiders.

The post Aave founder rejects Payward stake report and discounted token sale claim first appeared on Coinfea.

According to the official press release, RLUSD now reaches retail and institutional users through SBI VC Trade. This makes it the second foreign dollar stablecoin Japan has ever cleared after USDC. It also carries a label no other token holds in the country, becoming Japan’s first “Type 4” electronic payment instrument, which is a category that the JFSA built specifically for regulated stablecoins. This is extremely crucial since there is now a defined legal home for RLUSD inside Japanese payment law instead of operating on regulatory tolerance.

Ripple goes live in Japan after clearing MiCA

According to reports, all RLUSD transactions will have a cap of ¥1 million, which is roughly $6,200. This is to make it easier to monitor and keep the early flows at a lower volume. The token also runs on Ethereum rather than the XRP Ledger. The first version of RLUSD in Japan lives on infrastructure Ripple doesn’t control. Just days before this news dropped, Ripple picked up preliminary MiCA approval in Luxembourg, a CASP license that sets up passporting across all 30 EEA countries once it’s finalized.

The pair of achievements means that RLUSD gains legal standing across Japan and most of Europe in the span of a week. Stablecoins spent most of the last ten years growing by avoiding regulators. Issuers parked reserves offshore, set up in light-touch jurisdictions, and handled enforcement only when it caught up with them. RLUSD went the other way. It got licensed inside the regimes that matter most, and Japan and the EU sit near the top of that list. This is the part that matters for adoption. A dollar stablecoin cleared by both the JFSA and MiCA isn’t a workaround built to dodge oversight.

It is a product that banks and regulated exchanges can hold without legal guesswork. SBI handling distribution in Japan puts it in front of an established financial player, not a crypto-native niche. The ¥1 million cap and the Ethereum rails show how carefully Japan is stepping into this, but the direction is locked in. For a sector that has spent years arguing it can operate inside the rules, two clearances this strict in one week are a harder data point to wave off than another offshore launch. The open question is usage. Clearing the regulators was the hard part on paper. Whether RLUSD actually moves volume across both regions is the test that hasn’t run yet.

The post Ripple goes live in Japan as RLUSD goes global first appeared on Coinfea.

The adoption of Russia’s bill “On Digital Currency and Digital Rights” has been delayed, according to a high-ranking official from the Ministry of Finance in Moscow. While it is ready for further consideration, this will take place “with a slight delay,” according to Alexey Yakovlev, head of the Minfin’s Financial Policy Department. “Generally, everything is ready. We expect the State Duma [financial markets] committee to approve it soon, and then the second reading will follow.” “We probably won’t be able to adopt it before July 1, but somewhere around that time,” Yakovlev added in comments for the Interfax news agency.

Russia pauses its digital currency law

The draft is at its most advanced stage of preparation, and no major amendments are likely before it hits the floor of the Duma “in the next couple of weeks,” the official indicated. To come into force, the law must also be passed on third and final reading in the lower house before it’s approved by the Federation Council, Russia’s senate, and sent to President Putin for signing. The State Duma voted on the bill for the first time in April. According to earlier official statements, it had to be adopted and enforced no later than the first day of July.

Necessary bylaws and other regulations will be introduced by the Central Bank of Russia (CBR) this summer, and the country’s first regulated crypto transactions are expected in the fourth quarter. The upcoming cryptocurrency legislation is based on a new policy announced by Russia’s monetary authority in late December 2025. The comprehensive legal framework will regulate various operations with digital coins, including investing, exchange, and trading.

The CBR’s regulatory concept envisages expanding investor access to crypto assets beyond the current narrow category of “highly qualified investors.” Ordinary Russian citizens will soon be able to legally buy cryptos through licensed intermediaries, although their investments will be limited to less than $4,000 a year. Non-professional investors will be allowed to acquire only the largest coins, such as Bitcoin (BTC) and Ethereum (ETH), as well as major stablecoins like Tether’s USDT and Circle’s USDC.

Ban on crypto advertisements set to go live

Domestic transactions without the involvement of exchanges, brokers, trustees, and depositories authorized by the Bank of Russia will be prohibited, including transfers to non-custodial wallets. Russian authorities are also preparing to ban advertisements for decentralized digital assets. For example, the use of the names of specific cryptocurrencies like “Bitcoin” in ads, videos, and other materials will not be permitted.

The respective amendments will be introduced with the digital currency law, ahead of its second reading, the head of the CBR Department for Strategic Development of the Financial Market, Ekaterina Lozgacheva, unveiled at the end of May. At the time, she explained: “Services can be advertised and communicated to clients, but we still believe that cryptocurrencies themselves should not appear in advertising, because they are such a high-risk asset.”

On Wednesday, the Chairman of the parliamentary Committee on Financial Markets, Anatoly Aksakov, confirmed the upcoming restrictions and made some clarifications. Businesses from the industry will be able to reveal they are working in the crypto space, but without announcing their specific activities, the prominent lawmaker emphasized. “We are banning the advertising of cryptocurrencies, but at the same time, allowing organizations operating in this market to say so,” he elaborated during the St. Petersburg International Legal Forum held this week.

The post Russia moves to ban crypto ads after freezing digital currency law first appeared on Coinfea.

Security firm Novee said researchers identified over 300 exploitable workflow chains during a scan of 30,000 repositories. The flaws allowed attackers to steal credentials, inject code, and compromise software supply chains by abusing gaps between GitHub Actions workflow files. Novee said all disclosed issues have been fixed.

How Cordyceps attack chains worked

Novee described Cordyceps as a vulnerability class named after the parasitic fungus that controls its host. In this case, the weakness could allow anyone with a free GitHub account to influence trusted automation inside open-source projects.

GitHub Actions workflows are used to test, build, and publish software. However, researchers said these files are often treated as configuration rather than security-critical code.

The attack path began when an external user submitted a pull request or left a comment on a public repository. A lower-privilege workflow then accepted that outside input as trusted data. That output could pass into another workflow running with elevated permissions and access to credentials.

Researchers said the second workflow could contain cloud tokens, package registry credentials, or signing keys. At that stage, an attacker could steal non-expiring tokens or gain lasting control over repository operations. Each step could appear safe alone, while the full handoff exposed the risk.

Major repositories affected by disclosures

Novee reported confirmed vulnerabilities across major organizations. Microsoft’s Azure Sentinel contained a pull request comment path that could trigger attacker code on Microsoft CI infrastructure. Researchers said it could also expose a non-expiring GitHub App key, allowing persistent write access to security detection content sent to customer Sentinel workspaces.

Google’s AI Agent Development Kit repository, with more than 9,200 GitHub stars, contained a flaw where one pull request could give an attacker the highest permission level, listed as roles/owner, on the linked Google Cloud project.

Apache’s Doris Analytics Database had two zero-click attack paths. One could let a comment on any pull request steal hardcoded CI credentials. Another could let a forked pull request steal a token with full write permissions across code, packages, and pages.

Patches completed as AI risk remains

Cloudflare’s Workers SDK, centered on the Wrangler CLI toolchain, was vulnerable to command execution through a crafted branch name. The Python Software Foundation’s Black formatter, downloaded over 130 million times, had a flaw that could expose its bot token and allow further pull request approvals.

Novee confirmed to Dark Reading that these workflow patterns were not exploited before patches were applied. Meged recommended that CISOs treat CI/CD workflow files as security-critical code, especially as AI coding agents continue reproducing insecure patterns.

The post Cordyceps vulnerabilities expose CI/CD risks across repositories first appeared on Coinfea.

The move slowed crypto policy momentum, including the CLARITY Act.

Trump delays housing bill over voter ID demand

Trump said on Truth Social that the signing ceremony for the 21st Century ROAD to Housing Act was “hereby cancelled” until Congress passes the “desperately needed” SAVE AMERICA ACT. He described the issue as a National Emergency.

The SAVE America Act would require proof of citizenship and photo identification for voters in federal elections. The measure has stalled in the Senate because it lacks Republican support.

Trump has anchored any bill signing to progress on the voters’ reform act. Source: Truth Social

The housing bill cleared Congress with bipartisan backing. It passed the House by 358-32 and the Senate by 85-5. Karoline Leavitt described it as “one of the most significant pieces of housing affordability legislation in American history.”

CBDC ban remains in procedural limbo

The housing package contains language barring the Federal Reserve from issuing, creating, or distributing a central bank digital currency until at least December 31, 2030. Crypto industry supporters backed the provision because it aligned with Trump’s January 2025 executive order blocking the government from developing a digital currency.

Republican lawmakers have argued that a Federal Reserve digital dollar could become a surveillance tool. Tom Emmer previously described CBDCs as a “weaponized surveillance tool.”

The CBDC provision was added after Senate Banking Chair Tim Scott negotiated with ranking member Elizabeth Warren. The effort included coordination with House Financial Services members.

Without Trump’s signature, the CBDC restriction remains tied to the unsigned housing bill. House Speaker Mike Johnson defended the delay and said Trump was using “a little bit more” of the time available before a signing deadline. Johnson said he expected the President to act within 10 days.

NBC News reported that one unnamed House Republican called the decision “Crazy crazy crazy.” Senate Minority Leader Chuck Schumer said Congress could override if Trump refuses to sign. The Constitution also allows a bill to become law without the President’s signature after 10 days if Congress remains in session.

CLARITY Act timeline faces new pressure

The delay has raised concerns about the Digital Asset Market Clarity Act. The Senate has five weeks before summer recess, while the bill still requires negotiations and a floor vote.

Jaret Seiberg of TD Cowen wrote Wednesday that the SAVE America Act has no viable path to law because Senate Republicans would need to eliminate the filibuster. He said they had rejected that step. NBC News reported that House Republicans, led by Anna Paulina Luna, pledged to block other floor votes until the SAVE Act passes.

The post Anti-CBDC Bill Stalls as Trump Cancels Housing Signing first appeared on Coinfea.

The delay comes despite growth, with annualized revenue crossing $2 billion and the company’s private valuation reaching $22 billion.

People close to Kalshi’s finances said any public offering is unlikely before late 2027 or early 2028. The company held talks with investment banks.

Revenue Growth Accelerates Since 2025

Kalshi’s annualized revenue has nearly tripled from its level in November 2025. Sports prediction contracts have been the main driver, helped by activity during the NBA playoffs and FIFA World Cup.

Monthly trading volume reached $16.81 billion in May 2026, a 13.5% increase from April. During the opening week of the FIFA World Cup, Kalshi posted $5.1 billion in weekly spot volume. That was described as the largest single-week total recorded by any individual prediction platform.

Institutional activity expanded. Trading volume from institutions rose 800% in the six months through early May. That pushed annualized trading volume from $52 billion to $178 billion.

Fundraising Meets Legal Pressure

The delayed IPO discussion follows a major fundraising run. Kalshi closed a $1 billion round in May 2026 led by Coatue. Sequoia Capital, Andreessen Horowitz, IVP, Paradigm, Morgan Stanley, and ARK Invest also participated.

Since June 2025, the company has raised $2.685 billion across five funding rounds. Regulatory disputes remain a major overhang.

Kentucky filed a lawsuit this week against Kalshi and Polymarket, alleging they operated unlicensed sports betting platforms. Similar claims have emerged in Ohio, Nevada, New Jersey, New York, and Illinois.

The CFTC has entered related proceedings, arguing that federally regulated event contracts fall under its exclusive jurisdiction. A New Jersey court sided with Kalshi in April 2026. Still, the issue is widely expected to reach the Supreme Court.

Gaming groups, including the American Gaming Association and Indian Gaming Association, have pushed Congress to restrict sports prediction markets under federal derivatives rules. Some estimates place sports contracts at up to 90% of Kalshi’s revenue.

Crypto IPO Market Shows Signs of Cooling

Kalshi is among several crypto-adjacent firms delaying listing plans in 2026. Consensys pushed its IPO to at least fall 2026. Kraken suspended its billion-dollar offering after filing in late 2025. Ledger also paused a planned $4 billion listing.

BitGo remains the only crypto-native company to complete a U.S. IPO this year. By mid-May, its shares traded about 36% below the $18 offering price.

Bitcoin weakened in 2026, losing one-third of its value and trading below $60,000 on June 24. Bitcoin ETFs recorded more than $3.1 billion in net outflows this year, while investor capital shifted toward AI and semiconductor stocks.

The post Kalshi IPO Delayed as CEO Rules Out 2026 Listing first appeared on Coinfea.

The listing comes as the company faces a consolidated class action and a separate RICO claim that could increase its legal and financial exposure.

Co-founder Alon Cohen promoted the opening and said the company is seeking someone who can “own the company’s regulatory and litigation posture.” The role points to a wider legal push as Baton manages claims in the United States while also addressing compliance questions across major markets.

Lawsuits raise pressure on Baton

Baton is defending a consolidated class action in the Southern District of New York. Lead plaintiff Diego Aguilar filed the case through Wolf Popper LLP. The complaint alleges that tokens were launched through Pump.fun qualify as unregistered securities under Sections 5 and 12(a)(1) of the Securities Act of 1933.

The company is also facing a separate complaint filed on January 16, 2025. That case centers on the PNUT token, a Solana memecoin that plaintiffs say reached a $1 billion market capitalization before declining 89% from its peak. Brown Rudnick LLP has represented Baton on retainer.

Plaintiffs have also advanced a RICO theory, alleging that Baton operated a racketeering enterprise. The statute allows treble damages, and the case has been sized at about $5.5 billion. Plaintiffs have asked the court to appoint a receiver to take control of Baton’s operations.

Job listing reveals business scale

The CLO listing includes figures that Baton has not widely publicized. It states that Pump.fun handles more than $300 million in daily trading volume and generated over $500 million in profit last year. The listing also says the company operates with fewer than 100 employees.

Pump.fun was geo-blocked from the United Kingdom in 2024 after FCA action, according to a Change.org petition seeking a coordinated European criminal investigation into Baton’s operations. The same petition cites Dune Analytics data showing that more than 60% of about 4.25 million wallets trading on Pump.fun lost money. It also says nearly 1,700 wallets lost more than $100,000 each.

CLO role targets global compliance

The compensation range underscores the legal importance of the senior role. The job description requires at least 10 years of experience, New York Bar admission, and direct experience with regulatory investigations and enforcement actions.

The CLO would report to a general counsel and oversee risks tied to SEC, CFTC, FinCEN, OFAC, FCA, and MiCA obligations. The Aguilar case has no trial date. The court docket shows the most recent filing date as April 14, 2026.

The post Pump.fun legal chief role draws attention as lawsuits continue first appeared on Coinfea.