Bitcoin Policy Institute (BPI) has released an open letter, co-signed by multiple crypto companies and institutions, urging frontier AI labs to provide Bitcoin and open-source developers with early access to their strongest models to support cybersecurity efforts. The letter says digital asset defenders, including Bitcoin Core developers, lack access to labs' security programs and may be affected by safety limits on public frontier systems, forcing reliance on weaker open-weight models. It suggests establishing or expanding long-term trusted access programs for defenders of open-source financial infrastructure. Signatories include African Bitcoin Institute, Anchorage Digital, BitGo, Bitwise, Blockstream, Bull Bitcoin, MARA, Kraken, Ledger, and Trezor. The open letter also stresses that open-source software underpins critical financial infrastructure, with Bitcoin securing over $1 trillion in value. Separately, the report notes that crypto platforms suffered over $634 million in thefts in April 2026, the highest monthly figure since the Bybit hack, while related losses in February 2025 were about $1.4 billion.

A new paper from the Royal United Services Institute says North Korea is increasingly routing stolen cryptocurrency through the same laundering channels used by scam syndicates and organized crime, making it harder for investigators and compliance teams to distinguish proliferation-linked funds from routine criminal proceeds. The researchers estimate the regime stole at least $2.8 billion in virtual assets between January 2024 and September 2025, and they focus on the moment those assets are turned into cash rather than their already well-documented movement through decentralized services. The paper points to handoffs to third parties, use of mule accounts in the Philippines, Indonesia, and China, and repeated sales of small stablecoin amounts on peer-to-peer markets to stay below bank review thresholds. It also cites findings tied to the February 2025 Bybit hack, where incident responders said North Korea’s TraderTraitor group relied on launderers, OTC desks, and P2P traders, often Chinese nationals, to move funds and return cash. The paper also references U.S. action against infrastructure linked to Cambodia’s Huione Group and notes that Bybit has recovered or frozen only about 5% of the assets taken.

Tornado Cash recorded 968 deposits on July 23, marking its busiest day of 2026, according to L2Beat data. Onchain records show 29,573 ETH, worth about $57.2 million at that day’s prices, moved into the protocol’s Ethereum pools from 110 addresses. A single address labeled Drift Exploiter 4 accounted for 245 deposits totaling 23,095 ETH, or roughly $44.4 million, in less than two hours, representing 78% of the day’s inflows. Lookonchain and PeckShield both flagged the transfers, with PeckShield adding that the exploiter also sent 0.85 ETH to Bybit. The movement was the first involving funds tied to the April 1 exploit of Drift, the Solana perpetuals DEX that lost roughly $285 million in the largest DeFi hack of 2026. TRM Labs and Elliptic have attributed that attack with medium-to-high confidence to UNC4736, a North Korea-linked cluster also tied to the $1.5 billion Bybit hack. The jump in activity comes as Tornado Cash usage keeps recovering after the U.S. Treasury lifted sanctions in March 2025, while developer Roman Storm still faces a pending retrial fight.

The U.S. Treasury Department has sanctioned four Iranian cryptocurrency exchanges, including Nobitex, as part of an "Economic Fury" operation launched in April 2026. According to the report, authorities have frozen nearly $1 billion in crypto assets and traced $3.84 billion that moved through CoinEx. The reported flows were tied to wallets linked to Iran’s central bank and to the North Korean actors associated with the Bybit hack. Chainalysis estimated that crypto outflows from Iran reached $4.18 billion in 2025, up 70% year over year. The report added that while centralized stablecoins such as USDT can be frozen, decentralized protocols and cross-chain transactions still provide routes for sanctions evasion. Executives at the affected exchanges have now been added to the Office of Foreign Assets Control, or OFAC, list, and the Treasury Department is continuing to monitor blockchain fund flows.

North Korea's Lazarus Group stole $577 million from Drift Protocol and KelpDAO in April 2026, representing 76% of all crypto theft year-to-date, using social engineering and bridge vulnerabilities.

Exchanges let you buy, sell, and trade crypto; wallets secure your assets. Understand ownership, private keys, security risks, and use cases to avoid costly rookie mistakes.

A Wall Street Journal report citing TRM Labs says Iran-linked wallets moved more than $3.84 billion through CoinEx since 2019, with part of the traced flow tied to the $1.5 billion Bybit hack. CoinEx denied direct government ties.

BitMEX has connected with Zodia Custody’s Interchange system, letting eligible institutional and professional clients trade derivatives without moving collateral onto the exchange.