Category: Business

A fake Mac app impersonating Ledger’s self-custody software led to the loss of more than $9.5 million in crypto assets from over 50 total users in the last week, according to a new investigation from pseudonymous on-chain sleuth, ZachXBT.

The application, which pretended to be the Ledger Live app from which users can manage assets held by Ledger hardware devices, impacted victims from April 7 until April 13, when it was removed from the Apple App Store. 

“Stolen funds were laundered via 150+ KuCoin deposit addresses tied to AudiA6, a centralized mixing service that charges high fees to launder illicit funds,” ZachXBT posted in a message to his Telegram channel.

According to his analysis, at least three victims lost more than $1.95 million apiece, with one wallet being drained of $3.27 million USDT. Swiped assets included Bitcoin, Solana, XRP, USDT, and others.

Musician G. Love—aka Garrett Dutton, frontman of the long-running rock band G. Love & Special Sauce—was among the victims impacted by the fake app, losing 5.92 BTC valued around $447,000. He shared his story on X over the weekend.

“I had a really tough day today. I lost my retirement fund in a hack/scam when I switched my Ledger over to my new computer and by accident downloaded a malicious Ledger app from the Apple Store,” he posted on X on April 11. “All my BTC gone in an instant.” 

The fake app would remain in the App Store for nearly two more days, according to ZachXBT’s analysis. A representative for Apple did not immediately respond to Decrypt’s request for comment. 

Upon noting that the stolen funds had been traced to KuCoin, the exchange’s support team responded to the musician, indicating that they had frozen a suspicious account related to the funds. 

“Please note that while we may assist [in] freezing the suspicious account upon receipt of relevant information or a credible complaint, such actions are still subject to due legal documents and processes to ensure compliance,” it posted on X. 

The exchange has reportedly been dealing with an increase in illicit activity on its platform, according to ZachXBT. Last month, it was barred from offering access to U.S. users unless it registered as a foreign board of trade. Last year, KuCoin was hit with a $14 million fine, the largest ever anti-money laundering fine in Canadian history, by the nation’s financial regulator. 

Fake applications and websites are among the most common phishing vectors for Ledger users, according to the firm’s dedicated phishing campaign page, along with fake calls, emails, and letters.The U.S. Attorney’s Office for the District of Connecticut recently recovered $600,000 worth of crypto assets that had been part of a fraud scheme using fake letters purported to be from Ledger. 

A representative for Ledger did not immediately respond to Decrypt’s request for comment and it has not issued a public statement about the recent phishing campaign. 

Goldman Sachs filed an application for an exchange-traded fund on Tuesday that seeks to generate income for investors by selling options tied to Bitcoin’s price, underscoring the Wall Street giant’s incremental approach toward the digital assets space.

The Goldman Sachs Bitcoin Premium ETF would allocate at least 80% of its assets to investments that provide exposure to Bitcoin, including ETFs that track the digital asset’s spot price as well as derivatives tied to those products.

To generate income for investors, the fund would sell options tied to Bitcoin ETFs, generating returns from the premium that investors pay to gain leveraged exposure to Bitcoin.

With Goldman Sachs managing $3.65 trillion in assets (AUM), the filing represents a new entry into “the Bitcoin ETF game,” according to Bloomberg Senior ETF Analyst Eric Balchunas, who expressed a sense of shock on X at the investment bank’s latest filing.

The analyst noted that Goldman’s fund is based around a subsidiary located in the Cayman Islands, allowing it to manage regulatory limitations associated with holding commodities. That stands in contrast with a similar ETF that BlackRock has filed for, he said.

“Goldman may sense [an opportunity] to leap frog them,” Balchunas added, suggesting that the ETF could debut first due to its regulatory structure. “Anyway, I can’t say I saw this coming.”

In January, BlackRock filed an SEC registration for an iShares Bitcoin Premium Income ETF that generates income through call options. The fund, if approved by the SEC, would compete with other Bitcoin covered-call ETFs like NEOS’ BTCI, which has $1 billion in AUM.

Because BlackRock’s Bitcoin premium income ETF is actively managed, the product is set to have a higher expense ratio than its flagship offering tracking Bitcoin’s spot price.

Since BlackRock’s spot Bitcoin ETF debuted in 2024, the product has generated $63.8 billion worth of net inflows, according to crypto data provider CoinGlass. Meanwhile, Morgan Stanley last week debuted its own spot Bitcoin ETF, which has taken in roughly $68 million.

In February, Goldman Sachs CEO David Solomon revealed that “very little, but some” Bitcoin, describing himself as less of an investor and more of an observer of the largest digital asset.

The SEC unveiled a new policy Monday exempting certain decentralized finance interfaces from key registration requirements—a proactive move that indicates the regulator is moving full-steam ahead on its crypto agenda, with or without Congress.

The new policy, laid out today in an SEC staff statement, allows user interfaces for DeFi tools to forego registration as broker-dealers, so long as they meet certain requirements. User interfaces, as defined by the SEC, are services, created by crypto companies, that make it easier for self-custodial wallet holders to complete on-chain transactions.

Prior to President Donald Trump’s return to power, the SEC viewed such interfaces as squarely under the agency’s purview, given they technically involved a crypto company playing some role in connecting independent DeFi users to a marketplace. Crypto industry leaders have long argued such interfaces should not be considered akin to hands-on, traditional Wall Street brokers like Charles Schwab.

Now, crypto leaders have appeared to have gotten their wish. Should a user interface adhere to a list of requirements, the SEC has said it will not obligate the companies behind those interfaces to register with the agency—even when the interfaces engage with securities.

To qualify, an interface must not handle or hold user funds; arrange financing; solicit users to engage in any specific crypto transactions; or pressure users to choose one transaction path over another. It must also give users multiple options for executing transactions and list the options by objective criteria such as price, and charge users only flat rates or fixed rates for assisting with transactions, among other requirements.

“Crypto is forcing the Commission to confront its inner demons that have driven it toward ever more expansive readings of the securities laws,” SEC commissioner Hester Peirce, a noted crypto advocate, said Monday of the staff statement. “Recent history is littered with a patchwork of no-action letters and enforcement actions that have contorted the term ‘broker’ beyond recognition.”

Decentralized finance leaders hailed the announcement as a major step forward for the sector.

“Tough day for the gatekeepers and the moat protectors,” Amanda Tuminelli, executive director of the DeFi Education Fund, said Monday. “Good day for builders.”

“This is an incredible moment,” Matt Corva, general counsel at Ethereum software giant Consensys, proclaimed. (Disclaimer: Consensys is one of many investors in an editorially independent Decrypt.)

“If decentralized applications meet their promise,” he continued, “you can pencil this down as the day centralized intermediaries were dealt a critical blow by allowing fair competition against them.”

Miles Jennings, the head of Andreessen Horowitz’s crypto arm, dubbed the SEC statement a “huge win for DeFi.”

Other industry leaders noted the SEC’s statement shows the agency is moving ahead with the key pillars of its crypto agenda despite having not yet received specific guidance from Congress on the subject.

Though SEC Chair Paul Atkins has repeatedly voiced his support for the Senate’s pending crypto market structure bill, he has also said he does not need the legislation to pass in order to realize his aggressively pro-crypto agenda. 

The Senate bill, dubbed the Clarity Act, has remained in limbo for months, hung up on several thorny issues. Backers of the bill have warned in recent days that, with November’s midterms fast approaching, the legislation may not become law if it doesn’t pass imminently.

MiniMax M2.7 is here, the weights are on Hugging Face, and it’s legitimately competing with the best closed models out right now.

The numbers: 56.22% on SWE-Pro (a benchmark for software engineering tasks), nearly matching Claude Opus 4.6; 57.0% on Terminal Bench 2. An ELO of 1495 on GDPval-AA (a benchmark for real-world knowledge work tasks across jobs). For context: This is the highest among open-weight models, only slightly below Opus 4.6, Sonnet 4.6, and GPT-5.4.

It’s a 230B-parameter Mixture of Experts model with only 10B active per inference pass, so you get frontier-level output without paying frontier-level compute. MiniMax said it was the first model to participate in its own development—an internal version ran 100+ autonomous rounds of self-optimization, rewrote its own scaffold, and came out 30% better. No human in the loop.

Then the license changed, and the community lost it

But shortly after the weights dropped, the Chinese AI lab MiniMax quietly updated the terms: commercial use now requires written authorization from MiniMax.

Non-commercial use stays free and unrestricted. Research, personal projects, fine-tuning for your own setup—none of that changed. But if you’re running a hosted service or building a commercial product, you’re in “needs authorization” territory now.

Hacker News and a Hugging Face discussion thread filled up fast with developers calling it out. The specific friction point is this: MiniMax is labeling the license “MIT-style,” but MIT permits commercial use by definition. Calling it “Modified-MIT” while restricting commercial use is, to put it charitably, confusing.

Ryan Lee, MiniMax’s Head of Developer Relations, posted a detailed response rather than the usual corporate non-answer. His explanation: bad-faith hosting providers had been deploying degraded versions of previous MiniMax models—wrong templates, aggressive quantization, sometimes not even MiniMax’s actual model—then letting users walk away thinking MiniMax ships mediocre work.

“They walk away thinking MiniMax is mid,” Lee wrote. “We get the reputational bill, the user gets a bad experience, and the serious hosting providers who do the work properly get drowned out in the noise.”

“A fully permissive license meant we had no way to push back on any of that,” he added. “If the license has edge cases that hurt legitimate community use, tell us. We’d rather fix the text than defend it.”

This fits a wider pattern. MiniMax built its developer reputation on fully open releases—M2 under MIT in October 2025, M2.5 under the same terms in February 2026. M2.7 is the first break from that streak, and it came just months after the company listed on the Hong Kong Stock Exchange in January 2026, raising around $620M with Alibaba and Abu Dhabi’s sovereign wealth fund among its backers.

Other Chinese companies, which dominate the open-source space, are also testing the waters of close-sourcing AI. Alibaba’s Qwen team reportedly shifted toward proprietary development after senior leadership departures, according to the Financial Times, Xiaomi also released its new MiMo v2 models under a close source license. The shorthand that Chinese labs are open and U.S. labs are closed no longer holds.

For those interested in using it commercially, Lee says the authorization process will be fast and reasonable.