Wallet

On Tuesday, the Canadian Investment Regulatory Organization released a Digital Asset Custody Framework that introduces a four-tier structure for crypto custodians. The rules cap internal custody at 20% of client crypto holdings and allow top-tier external custodians to hold up to 100% of client assets, aiming to address risks highlighted by past failures such as QuadrigaCX.

Moltbook, an AI-focused social media site that attracted about 1.5 million bot accounts, has been shown to contain serious security flaws including open databases and malicious tools targeting crypto wallets. Security researchers documented prompt injection attacks, fake crypto trading utilities, and a major database exposure that revealed roughly 1.5 million bot passwords and tens of thousands of email addresses. Experts warn that as local AI models advance over the next one to two years, it may become impossible for major providers to use "kill switches" to stop harmful AI agents.

On February 3, 2026, U.S. investigators opened a probe into crypto platforms suspected of facilitating Iranian sanctions evasion, according to Ari Redbord at TRM Labs. TRM Labs estimates about $10 billion of crypto activity in Iran in 2025, while Chainalysis reports $7.8 billion received by Iranian wallets, and Elliptic says the central bank bought at least $507 million in USDT.

In 2025, verified physical assaults and kidnappings targeting crypto holders reached 72, a 75% year-over-year jump. Europe made up more than 40% of cases, while kidnappings rose 66% and physical assaults surged 250%. Reported financial losses exceeded $40.9 million.

Wrench attacks against crypto users rose sharply in 2025, with 72 verified cases and $40.9 million in losses. The count climbed about 75% from 2024, while Europe saw around 40% of global cases and France recorded 19. Examples included kidnappings and coercion to obtain private keys or ransom.

According to CertiK, physical coercion of crypto wallet holders increased sharply in 2025, with 72 verified cases worldwide and an approximate 75% rise from 2024. Confirmed losses reached $40.9 million, while France tallied 19 incidents and Europe accounted for about 40% of global cases. The firm warned this threat now sits at the center of ecosystem risk.

On February 2, 2026, Charles Hoskinson announced a major security upgrade for Logan, Cardano's AI agent, adding an HSM key management system and a two-container Docker running on WSL. The changes aim to curb hacks affecting wallets, bridges and DeFi. He also referenced past poisoning-attack concerns and Cardano's UXTO model protections.

On January 30, 2026, BitGo said $BTGO went public, and CEO Mike Belshe framed the move as a maturity milestone. In an interview with CryptoNews, he argued that crypto must separate custody from trading and clearing to avoid single points of failure. BitGo reports assets under custody exceeding $100 billion and entered the listing profitable, focusing on institutional-grade infrastructure.

On January 31, 2026, Step Finance said several treasury and fee wallets were compromised during APAC hours, with about 261,854 SOL valued near $30 million stolen. CertiK noted the stake authorization had been transferred before withdrawal, and the STEP token fell over 90% within 24 hours as the team stated user funds were not impacted.

The U.S. Department of Justice has finalized the forfeiture of more than $400 million in cryptocurrencies, cash, and real estate connected to the Helix Bitcoin Mixer, concluding litigation against its operator Larry Dean Harmon in January 2026. Helix, active from 2014 to 2017, processed over 354,468 Bitcoin allegedly tied to criminal activity, while Harmon was charged in 2020 and later sentenced in 2024 to prison time, supervised release, and asset forfeiture. The case unfolds amid broader U.S. regulatory action on crypto mixers and a policy shift on criminal enforcement for certain regulatory violations involving exchanges and developers.