Drift Protocol suffered a $285 million exploit on Solana. Attackers used social engineering to gain multi-sig control, introduced a fake token, and drained liquidity. Experts highlight multi-sig centralization risks, call for time locks and circuit breakers, warn of more attacks ahead.

Drift Protocol suffered a $285 million exploit on Solana via social engineering, compromising its multisig wallet. Experts question why time locks weren't enforced and warn that AI-driven attacks are emerging as a new threat to DeFi.

The US Treasury has officially removed Tornado Cash from the OFAC sanctions list, marking a major turn in one of the crypto industry’s most closely watched legal and regulatory battles. Tornado Cash, an Ethereum-based privacy mixer launched in 2019, was sanctioned in August 2022 after US authorities alleged it helped facilitate more than $7 billion in money laundering, including funds linked to North Korea’s Lazarus Group. The sanctions barred US persons from using the protocol and were followed by criminal cases against co-founders Roman Storm and Roman Semenov in 2023 over transactions tied to more than $1 billion. The policy reversal came after six Tornado Cash users, backed by Coinbase, challenged Treasury in court. A Texas federal court ruled in January 2025 that the protocol’s smart contracts could not be sanctioned, and the Fifth Circuit had already upheld that direction in November 2024. Even while lifting sanctions, Treasury stressed that it remains deeply concerned about DPRK-linked hacking, money laundering, and digital asset abuse, including references to the recent $1 billion-plus Bybit hack allegedly tied to Lazarus. The decision may be seen as a win for privacy software developers and a sign that sanctions law has limits when applied to decentralized code, but its broader implications for crypto enforcement, future cases, and industry regulation remain uncertain.

The U.S. Treasury Department has submitted a 32-page report to Congress acknowledging that Bitcoin and crypto mixers can serve legitimate financial privacy purposes, signaling a shift from previous enforcement actions like sanctioning Tornado Cash. The report proposes a new 'hold law' to give financial institutions temporary safe harbor to freeze suspicious digital assets, and provides original data on stablecoin and cross-chain bridge mixing activity. It also recommends Congress clarify AML/CFT obligations for DeFi actors and expand Section 311 of the USA PATRIOT Act. The report reflects an inflection point in crypto regulation following the lifting of Tornado Cash sanctions and ongoing legal cases.

On July 2, 2026, the U.S. Department of the Treasury officially removed Tornado Cash, an Ethereum-based cryptocurrency mixer, from the OFAC sanctions list following a series of court rulings that deemed smart contracts cannot be sanctioned. The decision ends nearly four years of legal battles, but the Treasury simultaneously warned of ongoing illicit crypto activities linked to North Korea, particularly after the $1 billion+ Bybit hack attributed to the Lazarus Group. This article reviews the full timeline of Tornado Cash's sanctions, the legal challenges, the Treasury's reasoning for lifting them, and the continuing geopolitical tensions that may shape future regulation of privacy-focused crypto tools.

On July 2, 2026, the U.S. Department of Treasury officially removed Tornado Cash, an Ethereum-based smart contract mixer, from the OFAC sanctions list, following court rulings that smart contracts cannot be sanctioned. Tornado Cash launched in 2019 and was sanctioned in August 2022 for allegedly laundering over $7 billion, including funds linked to North Korea's Lazarus Group. Its co-founders were indicted in 2023. A Texas federal court ruled in January 2025 that the sanctions were invalid, upheld by the Fifth Circuit in November 2025. The Treasury cited evolving legal and technological considerations but reiterated its commitment to combating DPRK-related illicit activities. This decision is a positive sign for privacy tool developers, but its broader impact on the crypto industry remains uncertain, especially with ongoing cases like that of Samurai Wallet.

The U.S. government has moved to seize 127,271 BTC (worth ~$14 billion) linked to a massive online investment scam run by Chinese émigré Chen Zhi (Vincent Chen) and his Cambodia-based Prince Group transnational criminal organization. Announced by OFAC and FinCEN, the action targets “pig-butchering” scams that defrauded victims globally. The operation involved fake crypto platforms, forced labor, and extensive money laundering through shell companies, real estate, and Bitcoin mining. If confirmed, U.S. bitcoin holdings would reach 325,283 BTC worth over $37 billion. President Trump’s Executive Order on a Strategic Bitcoin Reserve mandates that seized assets be held, not sold. The indictment details corruption, bribes, and abuse. The U.K. also imposed parallel sanctions. Additionally, Treasury severed Cambodia’s Huione Group from the U.S. banking system for laundering billions, including $300 million in cybercrime proceeds. OFAC sanctions target 146 entities and individuals.