Tag: Business – Decrypt

Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt. And check out our daily news show ‘FOMO HOUR’ covering all of the top stories and market action.

GM!

Today’s top news:

• Crypto majors rally 3-4% as oil and bonds cool; BTC at $86,400
• SEC proposes rules letting advisors and funds hold crypto directly
• ETH Foundation launches zkAPI for private AI
• Pump leads onchain protocols again with $2.6M
• The 7-Trait CryptoPunk sells for $5.9M in landmark sale on Gondi

🔓 NEAR Intents Hacked for $3.8M—Was It A Bullish Hack?

NEAR Intents shut down briefly on Thursday after an attacker took about $3.8 million.

The flaw sat in the layer that moves money in and out, and how it talked to the main contract holding user funds. ZachXBT traced the stolen money to KuCoin, where it was converted to bitcoin. The team reported it to law enforcement and says a full report is coming.

If you aren’t familiar with Near Intents, the tool lets you swap crypto across different blockchains with the ability to do so privately. It has been a big winner in the privacy boom, handling more than $30 billion in swaps across 35 networks.

As for the hack, the response was fast. The contract-side hole is patched and core services came back within about an hour. Deposits and withdrawals on 11 networks including BNB Chain, Polygon, and Optimism stayed down another 12 hours while the rest of the fix went in. And every affected user will get paid back in full.

NEAR fell nearly 9% to $4.86, and shares of the Bitwise NEAR ETF dropped more than 7%. That fund launched two days earlier, so its first week included a hack of the exact product Bitwise cited as proof the network was growing.

But on the spectrum of how hacks can go, this is as close to the best version of a bad event. Kelp DAO was exploited for hundreds of millions. Bitget lost $387.5 million and froze withdrawals for four days. MetaMask pulled validators offline and has said almost nothing since. NEAR Intents found the bug, stopped the service, patched it, restarted in an hour, named the problem publicly, called law enforcement, and committed to making users whole. It was a rapid response with a very contained hack with minimal damage.

That’s about as good as it gets. Some are going as far as calling it a “bullish hack” along the lines of the ZCash exploit found by their own team. Will this end up being a bullish event for Near? We will find out soon enough.

🌎 Macro Crypto and Markets

• Crypto majors are green up 2-4%; BTC +3% at $86.4k; ETH +2% at $2,740; SOL +3% at $122; HYPE +1% at $91; ZEC -1% at $1,380
• Top alt movers include SKY (+17%), AAVE (+11%), ZRO (+12%) and VVV (+8%)
• Oil -4% at $89; Gold +0.3% at $4,220
• Stock futures are green as oil and bonds fall; DOW +0.6%, Nasdaq +0.7%
• The SEC proposed rules letting investment advisers and funds hold crypto directly, including holding the keys themselves when no custodian is available; the 760-page plan also lets state trust companies act as custodians, and checks in quarterly on whether a custodian has become available.
• Illinois agreed to delay its crypto tax by six months while a court fight continues
• Trump is hosting a third dinner for his memecoin’s biggest holders on November 22 at his Virginia golf club; the top 185 get in, the top 29 get a reception, and the top four get an 18-karat gold watch
• Evernorth’s shareholders approved its Nasdaq listing, making it the largest public company built purely around XRP; it closes October 7 and starts trading as XRPN on October 8 with about 473 million XRP, worth roughly $705 million
• USDT is coming back to Bitcoin this month through Utexo, a Tether-backed company with a license to issue it there; it uses a system called RGB that lets users hold dollars and bitcoin in one wallet, with Lightning support planned next
• Fiserv’s digital asset platform went live Thursday, starting with Roughrider Coin from the state-owned Bank of North Dakota

Corporate Treasuries & ETFs

• The Bitcoin ETFs saw $103M in net inflows on Thursday; the ETH ETFs saw $55M in outflows and Solana had $1.1M in outflows

Meme Coin Tracker

• Meme leaders were green up 2-5%; DOGE +2%, SHIB +2%, PEPE +2%, PENGU +2%, TRUMP +4%, SPX +2%, BONK +4%
• Robinhood chain leaders were mixed; Pons -2% to $360M; AI -2% at $154M; Cashcat +3% at $174M; Genie +500%, Shroom +24% and Moo +80% led top movers
• Solana top movers were led by www +135x, Hooked +180%, Cards +26% and Sapling +170x

💰 Token, Airdrop & Protocol Tracker

🚚 What is happening in NFTs?

• NFT leaders were mixed; Punks even at 33 ETH, BAYC -1% at 6.18 ETH, Pudgy -7% at 3 ETH
• Quotrons (+6%) and OTC Desks (+14%) led top movers
• The only 7-Trait CryptoPunk sold for ~$5.9M on Gondi, though the full sale details were not disclosed overnight

Bitcoin was trading at $86,757 on Friday, up 3% over 24 hours and 2% on the week, according to CoinGecko data, after a September that broke the month’s losing reputation. It remains about 31% below the record it set a year ago.

The move follows Wednesday’s inflation reading. August core PCE came in at 3.0% against expectations of 3.3%, and the repricing that followed has swung the odds toward the Federal Reserve holding rates at its October 28 meeting. Futures put a hold at 74%, according to CME’s FedWatch tool, against 35.8% a week ago, and traders on Myriad, a prediction market owned by Decrypt’s parent company Dastan, price it at 75%. The shift came from an even split as recently as September 29, Nexo analyst Iliya Kalchev told Decrypt.

New York Fed President John Williams said on Tuesday there was “no need for urgency” after September’s hike, while keeping one more increase in his baseline for later in the year. Vice Chair Philip Jefferson said on Thursday that policymakers needed more time, and that adjustments should follow the data and the balance of risks. High Treasury yields had been capping Bitcoin, and short covering added to the buying once price broke its range, said Tim Sun of HashKey.

Jobless claims fell to 197,000 in the week to September 26 and continuing claims to 1.7 million, their lowest since March 2023, while ADP private payrolls rose 90,000, comfortably ahead of forecasts.

Friday’s official report was weaker. Nonfarm payrolls rose 29,000 in September against forecasts of about 90,000, the Bureau of Labor Statistics said, and unemployment edged up to 4.2%. July and August were revised down by a combined 60,000, leaving July at a loss of 10,000, and average monthly gains over the past year now stand at 45,000. The analysts quoted here commented before the release; a print that soft strengthens the case for a hold while raising the question the Fed has been trying to avoid, of whether the labor market is turning. September’s CPI lands on October 14. “Cooling inflation without labor weakness is generally supportive of risk assets, Bitcoin included,” Kalchev said.

Spot Bitcoin ETFs took in $2.65 billion in September, behind only August’s $3.52 billion since October 2025, and $6.34 billion across the third quarter, according to SoSoValue. Net assets stand at $109.3 billion. Kalchev counts inflows on 10 of the last 11 sessions, totaling roughly $3 billion.

That quarter mostly undid earlier damage. The funds lost $4.97 billion in the second quarter and $490 million in the first, leaving 2026 net inflows under $1 billion.

That intake came against a 25-basis-point hike and a 10-year yield above 5%, which Sun said showed the money was “not merely chasing liquidity, but are rather allocation-driven inflows.” Morgan Stanley’s ETF took in more than $200 million last month, a sign that “major investment banks’ wealth management systems are starting to incorporate Bitcoin into client asset allocation plans,” he told Decrypt.

The analysts disagree on positioning. Kalchev has futures open interest down about 12% from its September 22 peak and in the bottom decile of its one-year range, so the advance is not leaning on leverage. Sun says open interest rose as price climbed. Options show “a market hedged against a drawdown but positioned for continuation,” Kalchev said, with protection at $80,000 and below and calls at $89,000 to $92,000.

Into Uptober

October and November have historically been Bitcoin’s best months, a pattern traders call Uptober, averaging an 18% October gain and 46% across the quarter over the past decade, said Stephen Wundke of Algoz, who told Decrypt that “traders feel there is more upside currently than there is downside.” He added: “There is a welter of money sitting on the sidelines waiting for more positive figures. If we get those softer figures and no rate rise, BTC will move very quickly and drag the rest of the quality assets with it.”

The 10-year Treasury yield is at its highest since 2002 and the Fed still projects another hike this year, so a strong payrolls print or a hot CPI would put December back in play. Wundke puts the chance of an October hike at 40%, well above the 26% futures now imply.

Owen Yang, chief executive of payments platform UPay, was more cautious. ETF flows and the SEC’s work on custody keep the institutional case moving, he told Decrypt, but “institutions entering at these price levels could mean less upside momentum.”

“Whether Uptober lives up to its name will depend on the macroeconomic environment and the Fed,” Kalchev said, “and Bitcoin is actively pricing those outcomes.”

Bad news for the economy is, once again, good news for risk assets.

The U.S. added just 29,000 jobs in September, far below the 84,000 economists expected. The two previous months were revised down by a combined 60,000, and unemployment ticked up to 4.2%, according to the Bureau of Labor Statistics.

Wall Street’s reading: the pressure to keep hiking rates just eased, which generally bodes well for risk assets like Bitcoin. The largest cryptocurrency by market capitalization rose sharply following today’s macro moves, and the charts suggest Bitcoin could go higher still during the month affectionately known as Uptober.

Before diving into the data, here’s some context traders and investors should know: The Federal Reserve raised rates by a quarter point on September 16, in a unanimous vote, lifting the target range to 3.75%-4.00%. It was the first hike since 2023. Higher rates means less “cheap money” for investments, but Bitcoin shook it off far better than Wall Street.

Since then, though, officials have been tapping the brakes. New York Fed President John Williams said Tuesday there was “no need for urgency,” and Fed Vice Chair Philip Jefferson said Thursday that policymakers may need more time before deciding whether to raise rates again.

CME FedWatch odds of a hike at the October meeting dropped sharply after the report, falling to 14% from 70% earlier this week. Prediction markets Kalshi, Polymarket, and Myriad agree: 80% odds of a hold on October 28.

Crypto liked this a lot. The total crypto market cap is above $3 trillion, up 2.5% in 24 hours, and the Fear & Greed Index reads 71, firmly in “greed” territory. ETF flows are green at +$102 million today, and Bitcoin dominance sits at 59.1%.

Bitcoin price: Staring at the ceiling

Bitcoin is up 1.57% on the day, trading at $86,152.75 after opening at $84,824.05. Today’s candle has already tested a high of $87,173.15, just shy of the $87,354.33 September high that marks the top of the range, the yearly resistance bulls need to clear. The low was $84,492.18.

That September high came at the end of a rally from the $74,977.57 swing low, a 16.5% climb. Since then, Bitcoin has been moving sideways around that mark. Here is what the indicators say about whether it breaks through.

The Average Directional Index, or ADX, measures how strong a trend is, regardless of direction. Readings above 25 confirm a real trend, and BTC sits at 41.8. The directional lines show buyers (DI+) above sellers (DI-), so this is a strong uptrend, not a choppy market. Very high ADX readings also mean a trend is mature.

The Exponential Moving Averages, or EMAs, track average prices, giving more weight to recent days. The chart shows the fast 50-day EMA above the slower 200-day, a bullish setup that usually means short-term momentum is outpacing the longer trend. The shaded cloud beneath price has also stayed green since mid-August, acting as a cushion.

The Relative Strength Index, or RSI, gauges buying pressure on a scale of 0 to 100. At 68.1, it signals strong momentum but is knocking on the 70 line, where traders tend to start taking profits.

The Squeeze Momentum Indicator is “off” with a positive reading of 2.2, which means the compression that preceded this move is over, and volatility has been released to the upside. Bitcoin’s price sits at 78.4% of the band range, in the upper half.

The technical picture leans firmly bullish, but the setup has trade-offs.

RSI is near overbought, and the macro backdrop is not exactly dovish: A December hike is still the market’s base case, and yields remain elevated. Traders will want to see a daily close above $87,354 with ADX holding up before calling it a breakout, while the Fed’s October 28 meeting is the next big macro test.

A CFTC roundtable on prediction markets turned heated Thursday when CME Group Chairman Terry Duffy and Kalshi co-founder Luana Lopes Lara traded insults over market manipulation and regulation.

The confrontation unfolded during a Commodity Futures Trading Commission meeting in Washington, D.C., as executives from traditional finance, crypto, and prediction markets debated how event contracts should be regulated.

Duffy, whose CME Group operates the world’s largest futures exchange by volume, said he was “a lot concerned” about prediction markets and argued that some contracts are susceptible to manipulation.

“We’re not a bunch of carnival barkers at a circus,” Duffy said. “We are running the most envious markets in the world in the United States of America.”

Duffy then took aim at the types of contracts Kalshi offers, mocking one in particular.

“There’s another really economic contract that has been massively important for the United States. That’s a Nathan’s hot dog eating contest,” Duffy said sarcastically.

He also questioned why Kalshi could offer a compute prediction market while CME’s proposed compute contracts remained under review.

After Kalshi was called out by name, Lara challenged Duffy on CME’s own history.

“I just wanted to respond since we were called by name here,” Lara said. “I would actually have to ask Terry: Has CME ever had any issues with any market manipulation, any issues ever in its history?”

“If you’d like to have a debate, I’m happy to have a debate with you,” Duffy replied.

“I’m just asking a simple answer to a question,” Lara said.

“I have more people in my regulatory department than you have in your whole company,” Duffy said, referring to the size of CME Group’s operation compared to Kalshi.

“Maybe you should learn a bit about efficiency then,” Lara fired back.

“Well, maybe you should learn about credible markets,” Duffy replied, before moderator Walt Lukken stepped in.

Lara then argued that the problems Duffy raised were not unique to prediction markets.

“Every market has risk and every nascent market will have risks as well, and there have been issues in every single traditional market and every single exchange here, onshore and offshore,” she said. “And I think the point of having regulation is that you find these issues, you address these issues, and there’s a way to address them in a correct way.”

DraftKings CEO Jason Robins later urged participants to stop attacking each other’s businesses.

“I would just ask everybody, both in this hearing and then also in future communications, to try to refrain from taking shots at each other’s business models or decisions you may not 100% agree with,” Robins said. “That doesn’t advance the discussion.”

Prediction Markets Face Regulatory Fight

Prediction markets allow their users to wager on the outcome of virtually any event through futures contracts that settle for $1, with the price of the contract implying the odds of the event. For instance, on Myriad—a prediction market operated by Decrypt’s parent company Dastan, the event contract for “Bitcoin highs in August” is priced at 59 cents on the $75K outcome, implying users believe there’s a 59% chance Bitcoin reaches $75,000 before the end of the month.

Prediction market platforms that operate in the United States, like Polymarket and Kalshi, have become the focus of a fight between federal regulators and states over whether contracts tied to sports, elections, and other real-world events are federally regulated derivatives or gambling products subject to state law.

CFTC Chair Selig has defended the agency’s jurisdiction over federally regulated prediction markets, warning states challenging that authority in February.

“We will see you in court,” Selig said in a video posted to X. The agency has since taken legal action against states seeking to regulate event contracts under their gambling laws.

In June, the CFTC proposed restrictions on certain contracts involving war or assassination and some sports proposition bets considered particularly susceptible to manipulation.

Earlier this month, nine Democratic senators urged Selig to prohibit wildfire event contracts, warning they could create incentives for arson, insider trading, and disaster profiteering.

Kalshi has faced legal setbacks in several states. Last week, a Washington judge ordered the company to stop offering contracts on sports, elections, politics, and other events in the state, finding it likely violated state gambling and consumer protection laws. Two days earlier, the CFTC ordered Kalshi to keep trading amid a separate dispute over New York’s attempt to block its contracts.

Bitcoin’s rally above $72,000 wiped out billions of dollars in bearish bets, but analysts say it will need fresh buyers to keep climbing.

Bitcoin reached its highest price since June on Thursday after gaining nearly 15% since Monday, with more than $3 billion in crypto short positions liquidated. That’s the largest liquidation of short positions on Bitcoin since at least 2021. What’s more, spot Bitcoin ETFs pulled in $517 million Wednesday, their largest single-day inflow since May.

Julio Moreno, head of research at CryptoQuant, attributed the rally to the U.S. Treasury buying long-dated government bonds, which markets interpreted as increasing liquidity, and President Donald Trump suggesting that the U.S. government could purchase Bitcoin.

“The rally may be sustainable if spot demand growth continues after the initial impact of these macro events,” Moreno told Decrypt. “Officially we are still in a bear market, so a price pull back is possible, more so after this sudden increase.”

Moreno said he is watching Bitcoin’s 365-day moving average, currently around $83,000, along with CryptoQuant’s profit-and-loss index and bull score, neither of which has turned bullish.

“To confirm that a bull market has started, I’m watching CryptoQuant’s P&L Index, specifically if it crosses its 365-day moving average to the upside, which it has still not crossed,” Moreno said. “Moreover, CryptoQuant’s bull score continues in bearish mode, so I’m waiting for it to switch into bull territory.”

Nansen Senior Research Analyst Nicolai Sondergaard said Bitcoin’s technical picture has improved after reclaiming its 200-day simple moving average around $69,000. Bitcoin also sits about 8% above its 20- and 50-day moving averages, while its MACD, a momentum indicator used to track changes in price trends, has turned bullish.

“The key line is the 200-day SMA near $69,000 and holding above it keeps the breakout valid, while a close back below would signal a failed move,” Sondergaard told Decrypt. “Above, the recent high ~$72,824 is immediate resistance.”

However, Sondergaard warned that much of the rally was driven by liquidations rather than sustained buying, leaving Bitcoin vulnerable once the short squeeze runs out. Positioning remains mixed, he said, though whales and public figures on Hyperliquid are net long by $27.9 million and $33.9 million, respectively.

“The largest risk is that this was a short-squeeze spike, not fresh sustained buying,” he said. “Once forced covering exhausts, thin follow-through can reverse quickly.”

Sondergaard said trader positioning remains mixed and warned that “any reversal in that narrative or a broader risk-off move could stall the rally fast.”

Adam McCarthy, a researcher at crypto trading firm Lo:Tech, also attributed the move to the Treasury’s expanded buyback program and the short squeeze. More than half of Wednesday’s gain occurred within a single hour as traders were forced out of a one-sided short position, he said.

“The Treasury’s buyback expansion gave the market a reason to reprice, but more than half of Wednesday’s gain came in one hour when a one-sided short position was forced out,” McCarthy told Decrypt. “That fuel is spent, so the next leg has to be bought rather than squeezed.”

McCarthy said he is watching the 30-year Treasury yield, particularly whether it moves back toward 5.3%, and crypto funding rates for signs of sustained buying.

“In crypto, whether funding starts showing a real long premium, because that’s what actual buying looks like,” he said.

McCarthy warned that the short positions that helped drive Bitcoin higher have largely been cleared.

“The short base is largely cleared and nothing has replaced it, so the move that got us here can’t repeat,” McCarthy said. “And if dealers are short gamma at $70k as we think, the hedging that exaggerated the way up exaggerates the way down.”

Bitwise Research Analyst Ishmael Asad was more bullish, calling the rally the strongest indication yet that Bitcoin has bottomed. He pointed to the Treasury’s expanded bond buybacks, the SEC’s proposed Regulation Crypto Assets framework, and this week’s White House crypto summit as catalysts.

“After this steep leg up, I wouldn’t expect the rally to continue at the same pace from here,” Asad told Decrypt. “But I would take this move as the strongest confirmation we’ve seen yet that the bottom is in.”

Asad said much of the potential downside, including the failure to pass the Clarity Act this year and possible rate hikes, has already been priced in. Still, he said a return to a bull market would require additional catalysts.

“The market will likely move sideways or higher in the coming months as we look towards the next milestones, like a potential Senate vote on Clarity in September,” he said.

CoinShares Head of Research James Butterfill also expects conditions to remain favorable, but said Bitcoin is more likely to trade within a range than enter a sustained breakout.

“The rally is primarily a macro story rather than a crypto specific one,” Butterfill told Decrypt. According to Butterfill, recent inflation and employment data have weakened expectations for further Federal Reserve tightening, while large Bitcoin holders have stopped selling and begun accumulating again.

“We expect the constructive backdrop to persist, but we would characterize the market as range-bound for now rather than in a sustained breakout, as accumulation by large holders is not yet at a scale that would imply one,” he said.

Digital asset investment products have also attracted about $1.3 billion so far this week. Still, Butterfill expects Bitcoin to remain range-bound because accumulation by large holders is not yet strong enough to support a sustained breakout.

Bitcoin’s move above its 200-day moving average has improved the technical picture, Butterfill said, with $80,000 now a key level to watch.

“On the upside, the US $80,000 area remains the important boundary, and a decisive move through it would likely require clearer confirmation from the Federal Reserve that policy risks have shifted away from further tightening,” he said.

Monetary policy, he added, remains the biggest risk, noting that persistent inflation could force the Federal Reserve to keep policy tighter for longer, reversing the liquidity conditions supporting Bitcoin’s rally.

“With accumulation by large holders still modest in scale, the market lacks the depth of conviction that typically underpins a durable breakout,” Butterfill said.

Commodity Futures Trading Commission Chair Michael S. Selig has directed agency staff to begin developing crypto market structure rules, preparing the regulator to act if Congress fails to pass the Clarity Act.

Speaking Thursday at the inaugural meeting of the CFTC’s Innovation Advisory Committee, Selig said passing bipartisan market structure legislation remains his preferred path. If the bill remains stalled, however, he said the CFTC will use its existing authority to establish a regulatory framework for crypto markets, calling it “the most important step towards future-proofing this industry is passing this bipartisan bill.”

The Clarity Act would establish a federal framework for digital assets and clarify the CFTC and SEC’s roles in overseeing crypto markets. Selig said legislation would make those rules harder for a future administration to reverse.

“Passing Clarity is the surest way that we can prevent another Gary Gensler from running a rogue campaign of lawfare against the individuals and companies in this room today,” Selig said, referring to the former SEC chair who brought several costly lawsuits against crypto startups.

On Wednesday, President Donald Trump urged Congress to pass a “fair version” of the Clarity Act. However, if Congress fails to act, Selig said, the CFTC is prepared to move ahead on its own.

“If Clarity continues to stall because of Democrat obstruction, the CFTC will utilize its existing authorities to begin establishing a regime for crypto asset markets,” he said.

Selig has already directed staff to begin exploring what those rules could look like.

“To achieve this, I’ve directed the CFTC staff to begin exploring rules to codify a CFTC market structure for crypto assets using the agency’s existing authorities,” he said.

Under the framework outlined by Selig, current CFTC registrants and currently unregistered crypto exchanges could come under CFTC oversight and offer leveraged or margined crypto trading under rules tailored to digital asset markets.

Selig also directed staff to work with developers of on-chain finance protocols on how they could legally operate in the United States.

“I’ve also directed staff to engage with developers of on-chain finance protocols to establish ways in which developers can offer their protocols in a legal and compliant manner in the United States, future-proofing developer protections once and for all,” he said, referencing previous comments made by President Trump.

During the press conference with leading crypto executives on Wednesday, Trump also said Selig is working to bring decentralized perpetual futures exchange Hyperliquid into the United States.

Selig said the agency will give Congress more time to pass the Clarity Act before moving forward on its own.

“Rest assured, I will direct CFTC staff to move swiftly to propose these rules for the industry,” he said.

Nearly 2,000 hacked WordPress websites were used to distribute malware, steal data, monitor victims, and deploy ransomware, according to cybersecurity firm Check Point Research.

In the report published on Tuesday, researchers said the StopAndProtect ransomware family was first discovered in mid-May before tracing it to a broader operation. The hacked websites hosted malware, sent commands to infected computers, and stored stolen documents, screenshots, and activity logs.

“The operation doesn’t rely on a single piece of malware, but on a whole toolkit of criminal software working together,” Check Point researcher Jaromír Horejsi wrote. “Some components encrypt files, others silently steal documents or lock the screen, and another acts as a live chat between the attackers and their victims.”

According to Check Point, the malware targets Windows users and begins with a fake CAPTCHA on a compromised website. The ClickFix prompt instructs victims to run a PowerShell command that installs malware capable of stealing credentials, cryptocurrency wallet seed phrases, spreading through networks and USB drives, locking screens, and deploying ransomware.

The report did not say whether macOS and Linux users are affected.

However, mistakes by the attackers gave Check Point researchers a deeper look inside the operation, the company said.

“Operational security (OPSEC) failures by the developer exposed lots of files, including detailed infection logs from victims’ machines, screenshots from infected computers, and source code of tools the criminals use to mass-manage compromised websites,” Horejsi wrote.

By July 24, the campaign had compromised more than 6,000 unique IP addresses, including 1,852 in the United States and 630 each in Russia and India.

Exposed directories contained infection logs and screenshots from victims’ computers. Researchers said they were able to collect over 31,000 screenshots between mid-May and the end of July, along with more than 700 archives containing stolen data, including documents, passwords, and cryptocurrency wallet files.

Check Point believes the threat actor also accidentally infected themselves.

“We collected a few hundred files exfiltrated from victims’ machines, and we believe that in one instance the threat actor infected themselves, as one archive contained several unusual files with suspicious content,” Horejsi wrote. “This also helps us better understand how the actor operates and how many compromised domains they likely control.”

ClickFix has surfaced in several other malware campaigns this year.

In May, an apparel website linked to FBI Director Kash Patel was taken offline after macOS visitors were reportedly targeted with ClickFix malware. Users were prompted to paste a command into Terminal that installed an infostealer capable of targeting browser data, session tokens, and crypto wallets.

In July, Jamf Threat Labs found ClickFix-style malware being distributed through a sponsored ad on X. The ad redirected users to a website that instructed them to open Terminal and run a command that installed a variant of the Atomic infostealer. In August, Microsoft researchers warned that hackers were using compromised websites and BNB Chain smart contracts to distribute malware through fake CAPTCHAs.

Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt

GM!

Today’s top news:

• Crypto majors are up 10-20% after Trump’s crypto meeting; BTC at $72k, ETH at $2,300
• Trump says CFTC is working to bring Hyperliquid to US; HYPE and LIT jump 20%+
• Over $3 billion in shorts liquidated in past 24 hours, most since tracking began
• BTC ETFs see $517M in net inflows (most since May), now over $1 billion for week; ETH had $187M
• Coinbase added Hyperliquid perps to the Base app, launched new $1 million accelerator

🏛️ Trump Says the CFTC Is Working to Bring Hyperliquid Onshore

Trump dropped an absolute bullish bombshell yesterday for crypto and perps.

Sitting in the White House with the heads of Coinbase, Ripple, Robinhood, Nasdaq, and ICE, President Trump said his CFTC chair is working to bring Hyperliquid into the United States.

“I understand that Mike is also working to bring Hyperliquid into the United States in a fully compliant and legal fashion,” Trump said, referring to CFTC Chair Michael Selig. “Working very hard on that. We would really like to see it.”

And the market exploded. HYPE jumped 23% to $72 at peak. Another perps leader in LIT popped 20% as well to a new local high. The broader crypto market legged up as well (albeit perhaps for other reasons as well, like Bessent’s yield curve control actions). BTC hit $72k, ETH put up a 20% candle to $2,300+ and SOL hit $87. Coinbase (+17%), Circle (+17%) and Robinhood stock (+10%) all soared as well.

For those unfamiliar, Hyperliquid is the offshore venue where traders take leveraged bets through perpetual futures, contracts with no expiration date, by connecting a wallet instead of opening a brokerage account. Americans can’t legally use it. That design routes around the intermediary that U.S. derivatives rules assume exists, which is exactly why registration, customer protection, and market oversight requirements have kept it and most crypto platforms offshore. The CFTC has been building toward this for a year, clearing Coinbase Derivatives for perp-style Bitcoin and Ethereum futures in April 2025 and later approving Kalshi for a similar product.

The rest of the meeting was a pitch to the Senate. Trump asked Congress to pass what he called a fair version of the Clarity Act, the market structure bill that would split SEC and CFTC authority over digital assets, calling it a way to stay ahead of China. That bill returns to the Senate floor in September after lawmakers left for recess without a procedural vote, and Republicans still need roughly six Democratic votes to clear 60.

So where does this leave us? Two days ago the SEC proposed its first formal crypto rules, and Wednesday the president publicly told his CFTC chair to find a path for the biggest offshore perps venue in crypto. The agencies are clearly moving ahead while the Clarity Act sits stuck. And they’re putting serious pressure on Congress to act, or let the SEC and CFTC make their own rules without legislative input.

Now we wait for the CFTC’s Innovation Advisory Committee, which meets Thursday for the first time.

🌎 Macro Crypto and Markets

• Crypto majors are very green up 10-20% after Trump’s crypto meeting yesterday and ahead of today’s CFTC meeting; BTC +12% at $72.1k; ETH +20% at $2,300; SOL +13% at $87; HYPE +23% at $72.30
• Top alt movers include PEPE (+21%), ENA (+20%), SPX (+20%) and LIT (+20%)
• Oil +3% at $88.40; Gold +3% at $4,540
• Stock futures are slightly red as bonds rebound and oil rises; DOW -0.2%, Nasdaq -0.1%
• Over $3B in shorts were liquidated over the past 24 hours as BTC, ETH and other alt leaders legged up 10-20%
• VanEck flagged 8 of 12 capitulation signals firing on Bitcoin, while noting similar setups have produced below-average 90-day and 180-day returns
• FalconX and Ethena set up a $1 billion secured facility deploying assets backing USDe into overcollateralized institutional loans, reducing reliance on perp funding rates
• Fidelity Digital Assets warned that AI agent activity may route to banks and fintechs instead of public blockchains, with stablecoin issuers capturing more upside than base-layer tokens
• Fairshake spent more than $2 million trying to beat Oliver Gilbert in a Florida Democratic primary and lost, drawing criticism for ads built on faked Miami Herald headlines

Corporate Treasuries & ETFs

Meme Coin Tracker

• Meme leaders were very green up 10-20%; DOGE +10%, SHIB +9%, PEPE +21%, PENGU +10%, TRUMP +18%, BONK +13%
• Robinhood chain saw more major rebounds with Cashcat +22%, PONS +34%, Pipedog +17% and Tendies +31%; GOOD ran 10x to $4M
• Solana leaders included Bome (+69%), Cate (+26%) and Troll (+17%); Ansem +5% to $250M
• On BSC, Niu Lai ran 60% to $65M and CETS +33% to $13M

💰 Token, Airdrop & Protocol Tracker

• Kalshi filed with the CFTC to launch a cash-settled copper perps contract priced off Pyth Network data
• Coinbase added perps to Base App through Hyperliquid, giving eligible users 290-plus markets at up to 50x leverage, though not in the U.S., U.K., or Canada
• Base opened applications for Batches 004, a $1 million accelerator investing $100,000 each in 10 pre-seed teams building AI agents, payments, trading, and financing products

🚚 What is happening in NFTs?

• NFT leaders were mixed; Punks +1% at 32.4 ETH, BAYC -4% at 7.6 ETH, Pudgy even at 3.78 ETH; Stonkbrokers -17% to 5.7 ETH
• Cashcats (+20%) and Fuego (+20%) led top movers
• FWA introduced their first FWAir launch project, priced at 0.25 ETH each for 111 NFTs

Flock Safety, the surveillance company whose cameras log vehicles across more than 6,000 U.S. communities, has built an AI tool that can identify and follow drivers using nothing but their movement.

The findings come in a report from Wired after it pulled the system’s code from files on Flock’s own site served to anyone who loaded its login pages.

The software—first called Nightshift, now renamed OS Investigate—is still in development and in testing with a small group of law enforcement partners, the company said.

An officer opens a chat box and picks from a menu of 69 canned prompts, or writes their own. One built-in query lists “witnesses” as the vehicles most seen in a neighborhood over the past two weeks.

Another finds everyone arrested more than twice in two years—exempting only drug offenses—then builds dossiers on the top three. A “workup” turns a name and birth date into relatives, phone numbers, and online accounts pulled from police records and commercial data brokers.

Fourteen of the prompts need no plate, name, or description at all. The officer supplies a location, a window of time, and a behavior—cars that hit three retail stores in three days, or several banks in a week—and the system returns the people who fit. A filter strips out buses and delivery vans, so an ordinary driver making those rounds stays on the list.

The associate-finding logic is spelled out in the code. It counts how often other plates appear at the same cameras within a two-minute window of a target car, flags any that show up three or more times above a 0.75 confidence score, and hands back up to 20 names.

“I don’t know how else to say this, but this sounds completely insane,” Noel Pichardo, a former Pawtucket, Rhode Island, police officer who reviewed the prompts, told Wired. “I don’t know how anyone can argue against the idea that Flock literally tracks people.”

Jay Stanley, a senior policy analyst at the ACLU, said the gap between what Flock’s cameras can do and what the company is already doing leaves “very little space… like China.”

Flock has long told the public its technology “cannot recognize, identify, or track individuals” and is “not for watching people.” Spokesperson Paris Lewbel called OS Investigate a separate product from the company’s license-plate readers, built to help investigators work across records their agencies already hold, and said its capabilities may change significantly before any wider release. The company didn’t dispute Wired‘s reporting.

The confrontation has already spilled into the streets. In June and July, activists spray-painted, taped over, and destroyed Flock cameras across the country; The Guardian counted at least 33 incidents across 23 states. The anger tracks with how police have actually used the network. A report by the Institute for Justice found over two dozen cases of officers resigning or being arrested for allegedly using license-plate readers to stalk current or former partners.

The pushback has reached Capitol Hill, where Rep. Thomas Massie’s planned bill would withhold federal funding from agencies that deploy the technology.

Researchers have built AI-generated patterns that confuse the plate-reading software, and Flock isn’t alone in pushing the boundary: Meta has patented cameras that recognize faces and log a person’s actions.

The top U.S. banking regulator says it will finalize its rules for stablecoin issuers by November, moving to beat a fast-approaching deadline for the country’s landmark digital-dollar law.

Jonathan Gould, head of the Office of the Comptroller of the Currency, laid out the timeline Wednesday at the Wyoming Blockchain Symposium, an event hosted by SALT in Jackson. He said the agency is working at a rapid pace and expects to publish a final rule by November as it weighs feedback gathered from the crypto industry.

“We are very intent on moving quickly and getting a final rule out by November so that we will be able to start processing applications within the new year,” Gould said.

The rules will implement the GENIUS Act, the stablecoin framework President Donald Trump signed in July 2025. The law tasks federal regulators with writing the details governing payment stablecoins, and it takes effect in January 2027. Agencies face a statutory deadline of Jan. 18 to have regulations in place, and the OCC has already blown past an earlier July target, a slip that has fed concern about lingering regulatory uncertainty.

The OCC’s proposal, a 376-page draft released in February and opened for public comment through May, covers the full life cycle of a payment stablecoin. The framework spells out requirements for reserve assets, redemption at par, liquidity, risk management, audits, custody and supervision, along with the process for winding down a failed issuer. Anti-money-laundering and sanctions requirements were carved out into separate rulemaking coordinated with the Treasury Department.

Gould said the agency expects to begin processing applications from stablecoin issuers starting in 2027. He also pointed to a surge of interest in federal oversight, saying digital-asset chartering activity has jumped eightfold compared with the Biden administration, and he criticized the prior administration’s approach to crypto risk as shortsighted.

The stakes for the industry are steep. Under the GENIUS Act, only permitted issuers will be able to offer payment stablecoins to Americans, and Treasury has separately proposed rules that would bar platforms from selling noncompliant stablecoins to U.S. customers once the law’s provisions kick in.

The OCC did not lay out a firm date within November for the final rule.