Roberto Capodieci

Singapore Clamps Down — Crypto Talent Floods into Dubai On June 30, 2025, Singapore’s MAS introduced a strict mandate: no unlicensed crypto firms may serve foreign clients — even from overseas. The penalty? Up to SGD 250,000 in fines and 3 years in prison. No grace period. No ambiguity. As a result, top exchanges like Bitget and Bybit are already shifting operations, licenses, and headcount to Dubai and Hong Kong. A UAE free zone regulator has confirmed what we’re now seeing in real time: a mass crypto exodus from Singapore to Dubai. Why Dubai? It's not just hype — it's strategy. ✅ Virtual Assets Regulatory Authority [VARA] provides the most progressive digital asset framework globally 🏢 Both Freezones & Mainland offer jurisdictional flexibility and fast-track licensing 🛡️ Dubai offers legal clarity without compromising innovation 🪙 Major institutions are going crypto: Emirates, Air Arabia, tokenized real estate with Dubai Land Department 💰 No capital gains tax. Near-zero corporate tax in most zones Dubai is not “catching up” — it’s leading by design. Takeaway for founders, funds, and fintechs: The world’s smartest crypto firms are repositioning fast. If you're building in this space, ask yourself: Is your regulatory strategy built for 2025+ — or stuck in 2021? At SecureVisa Group & ITSEC, we’re guiding this transition daily — setting up VARA-licensed companies, broker-dealers, exchanges, token platforms, and more. We understand both the opportunity and the fine print. The future of crypto regulation is being written in Dubai. Time to turn the page. #Dubai #Crypto #VARA #DigitalAssets #Web3 #Licensing #FinTech #Exchange #Compliance #SingaporeExit #SVG #ITSEC #RegulatoryStrategy

36

3 Comments

🕵🏽‍♂️🔎 The HIERARCHY of Crypto Recovery Services 🔎🕵🏽‍♂️ I have been in crypto compliance long enough to see all sorts of crypto recovery "services" and I think we tend to paint all of them with the same "SCAMMER" brush. So based on a post from Tushar Tiwari / JP Intelligence on Chain (IOC) (🔗 in the comments) and Aleks Ring ☘️ and being educated by CryptoForensic Investigators and other investigation teams - I decided to create a "hierarchy" of these services 💭⬇️ Tier 1️⃣🔎 LEA INITIATED - These are the recovery efforts that are taking place without the public knowing, we have seen huge cases with Internal Revenue Service, Chainalysis, Federal Bureau of Investigation (FBI), National Crime Agency (NCA) etc, that are going after ransomware attackers and those that have facilitated sanctions evasion or large scale crypto scams. We usually only hear about these efforts after a press release Tier 2️⃣🔎 - PUBLIC PRIVATE PARTNERSHIPS - These are coalitions that actually embed law enforcement into the asset recovery process. These are usually coalitions where the intelligence and expertise of the private sector is combined with the legal ability to seize funds and the best example of this is Operation Shamrock and the work they have done to handling 207 cases in 2025, representing $162+ million in reported losses Tier 3️⃣🔎 - EXPERIENCED PRIVATE FIRMS - These are companies that have established great relationships with LEAs and crypto exchanges all over the world. Although they DON'T have the power to seize without law enforcement they are extremely accurate in their tracing and have operationalized the process to allow law enforcement to take action. Obviously CryptoForensic Investigators and ZeroShadow LLC are probably the most recognizable companies - but I have also seen Recoveris, AMLBot and Match Systems have success with recoveries Tier 4️⃣🔎 - INEXPERIENCED PRIVATE FIRMS - These are usually small firms that may have access to paid tools and even with their best attempts haven't quite mastered tracing and are seeing this as a profitable business, but have very little results due to lack of relationships with LEA / exchanges and their lack of skill tracing complex obfuscation methods by criminals. I won't mention any names here - but I have seen some "interesting" reports from these companies. Tier 5️⃣🔎 - ALLEGED SCAMMERS - These have been highlighted by the industry as STRAIGHT scammers that usually already have a way to communicate with the victims, because they scammed them already., Aleks Ring ☘️ did a full breakdown of a Law Firm advertising on Meta p.s. CryptoForensic Investigators DOESN'T consider themselves a "recovery services" and Paul Sibenik always reminds me they don't recover funds, their job is to provide accurate forensic tracing so LEA can recover funds ⬇️💭 What Do You Think of the Current State of "CRYPTO RECOVERY SERVICES" 💭⬇️

59

21 Comments

🚨 BREAKING: Singapore takes the lead again and publishes its Model AI Governance Framework for Agentic AI [Bookmark it below]. Other countries should take note: As the document clarifies, the new components of an agent create new sources of risk. "The risks themselves are familiar – fundamentally, agents are software systems built on LLMs. They inherit traditional software vulnerabilities (such as SQL injection) and LLM-specific risks (such as hallucination, bias, data leakage, and adversarial prompt injections). However, the risks can manifest differently through the different components." Many countries and regions (including Europe) are still unsure how to apply their existing legal AI frameworks to agentic AI. Other countries seem to prefer the 'deregulatory trend.' Singapore understands that AI is evolving fast, and new risks are emerging, and the time to establish dynamic AI governance frameworks is NOW. Bookmark the document below and don't miss pages 6-7, which cover agentic AI risks. - 👉 To learn more about AI governance, join my newsletter's 89,300+ subscribers and don't miss the 27th cohort of my AI Governance Training (links below).

533

46 Comments

$2.02 Billion. ⠀ That is the price tag of "God Mode" keys in 2025. ⠀ North Korea didn’t break sha-256 encryption to loot Bybit. ⠀ They didn’t reverse-engineer the blockchain. ⠀ They simply stole the Admin Key. ⠀ In traditional architecture, if you have the key, you have the assets. It is a binary security model: Safe or Stolen. ⠀ This is a structural failure. ⠀ We are trying to secure institutional billions with the digital equivalent of a password under the doormat. ⠀ The fix isn't "better hygiene." It is Protocol-Native Governance. ⠀ Most solutions try to patch this with smart contracts, which just adds another layer of code to hack. ⠀ Certen Protocol is the only fully distributed, multisig governance solution that solves this directly at the protocol layer—removing the single point of failure entirely. Reach out to Jay Smith or any of the rest of the Certen team for a better way to secure any digital asset on any chain. ⠀ Here is the architecture that stops the next billion-dollar hack: ⠀ 1. Kill the "Master Key" Stop using simple wallets. Use KeyBooks (Authorities). Structure your cold storage so that no single key has "ultimate control." Authority should be hierarchical, not absolute. ⠀ 2. Logic Behind the Signature A signature proves identity, not intent. By integrating risk scoring directly into the protocol (Logic Behind the Signature), a transaction can be blocked pre-settlement even if the signature is valid. If the "Risk Oracle" sees an anomaly, it refuses to sign. ⠀ 3. The "And" Gate True security is an "AND" function. Security Team AND Cold Storage AND The Compliance Bot. If the hacker steals the Security Team key? The transaction still fails. ⠀ The Lesson: A bank vault doesn’t open just because you have a key. It opens because you have the key, the manager is present, and the time-lock is disengaged. ⠀ Crypto needs to learn that difference. ⠀ Are you securing your treasury with a key or a process? ⠀ Let’s discuss in the comments. ⬇️ https://lnkd.in/egmyUt4a ⠀ #CyberSecurity #BlockchainArchitecture #DeFi #Governance #CISO

9

[Part 1/3] Malaysian Navy Classified Documents Leak – Tracking the Dark Web Seller Part 1 of StealthMole’s 3-part investigation series. This episode focuses on the repeated banner-style phrase “Malaysian Navy Classified Documents Leak” found inside a DarkForums thread. Although the thread was titled with another leak, the same user “jrintel” used it to advertise multiple alleged classified materials and promote contact details through Telegram. In this video, we demonstrate how investigators track the poster’s activity, analyze metadata, and connect external handles to better understand who might be behind such sales pitches. (Note: The video examines forum posts and metadata, not the underlying Malaysian Navy documents themselves. Authenticity or contents of the claimed materials cannot be verified here.) #StealthMole #DarkWeb #OSINT #ThreatIntel #CyberInvestigation #MalaysianNavy #Telegram #CyberCrime Discover more case studies and tool demonstrations at StealthMole. You can request a free trial or demo through our website to see how these methods can be applied in practice. This video is intended for educational and investigative methodology purposes. The authenticity of the materials mentioned cannot be independently verified here. For any legal proceedings or investigative follow-up, please coordinate with the appropriate law enforcement authorities.

45

3 Comments

Beijing's hackers are playing the long game - Axios Chinese hackers are targeting more sensitive U.S. targets than ever — not to smash and grab, but to bide their time. Why it matters: Beijing is investing in stealthy, persistent access to U.S. systems — quietly building up its abilities to disrupt everything from federal agencies to water utilities in the event of escalation with Washington. Even the most routine spying campaign could leave China with backdoors to destruction for years to come. Driving the news: At least three China-based hacking groups exploited vulnerable SharePoint servers in the last month, according to Microsoft. Researchers at Eye Security, which first discovered the SharePoint flaws, estimates that more than 400 systems were compromised as part of the SharePoint attacks. In this case, hackers also stole machine keys. That means the attackers can regain access whenever they want — even after the system is patched — unless admins take rare manual steps to rotate keys. The big picture: China's state-linked hackers have been growing in sophistication over the last few years as they focus more on targeting technology and software providers with hundreds of customers, often including government agencies. By the numbers: More than 330 cyberattacks last year were linked to China, double the total from 2023, according to CrowdStrike data shared with the Washington Post. Those numbers continued to climb in early 2025, according to CrowdStrike. Between the lines: At least three major Chinese government teams have been targeting U.S. networks in recent years. Volt Typhoon has focused on breaking into endpoint detection tools to burrow deep into U.S. critical infrastructure, including pipelines, railways, ports and water utilities. Their goal is to maintain persistent access and be prepared to launch destructive attacks in the event of contingencies such as a war over Taiwan, experts say. Salt Typhoon, known for its compromises of global telecom networks, has focused on traditional espionage and spying. This group tapped cell phones belonging to President Trump, Vice President Vance and other top government officials. The FBI believes that threat is now "largely contained." Silk Typhoon — which has been linked to a recent breach of the U.S. Treasury Department and is known for the global 2021 Microsoft Exchange hacks — has been ramping up its work in recent months. The group uses previously undetected vulnerabilities, known as zero-days, to break into networks. Zoom in: Researchers at cybersecurity firm SentinelOne have uncovered more than 10 patents tied to Silk Typhoon's work — a rarity among nation-state hackers. State of play: China's growing cyber prowess comes as the Trump administration has diminished resources for its own cyber defenses. #cybersecurity #China #US #criticalinfrastructure #government #industry #universities

88

52 Comments

The DeFi protocol Balancer, specifically its V2 “Composable Stable Pools”, was attacked and more than US$100 million in digital assets were drained. The stolen assets included large amounts of ETH‐denominated tokens - WETH, wstETH, etc - across multiple chains according to early on-chain tracking. The exploit appears to have targeted a rounding error in the swap calculation and/or access control in Balancer’s vault architecture. According to analysis, the vulnerability relates to a rounding swap calculation in the “batchSwap” or “Exact_Out” path of the Composable Stable Pools, where repeated micro discrepancies accumulated into significant value. An insufficient authorization check (e.g., in a function like manageUserBalance or validateUserBalanceOp) may have allowed the attacker to bypass expected controls and drain funds. The attacker reportedly executed swaps across multiple chains and pools, automating the exploit. Estimates of the loss vary but exceed US$100 million, with some sources quoting US$110 million+ or even up to US$120 million. The breach affects Balancer’s V2 pools, protocols using the same architecture or forks may be at risk. The hack has triggered renewed scrutiny of DeFi’s auditing processes, pool architecture risks and “logic/math” vulnerabilities, not just code bugs, in smart contracts. The Balancer DAO issued an on-chain ultimatum: the attacker’s address was contacted via a message proposing a bounty, reportedly up to 20 % of the stolen funds, in exchange for return of assets. The DAO is conducting a forensic investigation, working with on-chain analytics firms to trace the stolen funds and identify off-ramp destinations. Other protocols using Balancer’s codebase or similar pool architectures have been warned and are reviewing exposure. To date, there is no public confirmation of significant recovery of the funds; the attacker continues to move assets across chains. This breach is more than a technical failure - it’s a structural stress test for DeFi’s maturity. When composability, automation, and speed collide, the smallest computational errors can have billion-dollar consequences. Block Intelligence - Top Blockchain & AI Development Company views incidents like this as urgent reminders that economic logic is the new attack surface in DeFi. Beyond smart contract audits, what matters is behavioral verification: understanding how value flows under stress, simulating adversarial sequences, and continuously monitoring for subtle deviations. Our approach focuses on making protocols resilient by design, not just secure by patch. Because in the next era of digital finance, true trust won’t come from code alone, but from systems that evolve faster than attackers. #DeFiSecurity #BalancerHack #Web3Security #BlockchainRisk #CryptoNews #SmartContracts #CyberSecurity #DeFiAudit #Web3Infrastructure #BlockchainInnovation #BlockIntelligence

9

Shanghai Futures Exchange and Guangzhou Futures Exchange have ordered local brokers to shift servers dedicated for high-frequency trading firms out of local exchanges’ data centers.The clampdown will hit China’s army of domestic quantitative hedge funds with high-frequency strategies but will also impact a swathe of global firms that are active in the country. The move is the latest sign that regulators are focused on leveling the playing field for investors and ensuring market stability after stocks rallied to multi-year highs this month. It is important to note that China's onshore stock market currently boasts over 240 million retail investors. However, statistics demonstrate that even in the favourable market conditions of 2025, 81.1% of retail investors experienced losses, with an average loss of CNY 21,000($3,014) per person. For small retail investors with accounts under CNY 100,000($14,355), the loss rate soared to an astonishing 98.7%. Chinese retail investors have a strong tendency to engage in short-term trading. However, when losses arise, they frequently attribute these to quantitative trading or high-frequency trading. Regulators are now aiming to create a level playing field for retail investors by restricting the trading activities of high-frequency trading firms. While the intention to encourage fairness is to be applauded, whether retail investors will ultimately benefit from these measures is doubtable.#China #regulators #highfrequencytrading

44

7 Comments

Vietnam has launched NDAChain, a new blockchain network that allows only approved participants to join. The move is aimed at locking down Vietnam’s government data. The network is built by the National Data Association and managed by the Ministry of Public Security’s Data Innovation and Exploitation Center. It will serve as the primary verification layer for tasks such as supply-chain logs, school transcripts, and hospital records. According to experts, NDAChain is based on a hybrid model, relying on a Proof-of-Authority mechanism to ensure only authorized nodes can verify transactions. It also adds Zero-Knowledge-Proofs to protect sensitive data while verifying its authenticity. According to officials, NDAChain can process between 1,200 and 3,600 transactions per second, a statistic that aims to support faster verifications in logistics, e-government, and other areas. https://lnkd.in/gsay_Er7

7

EPCYBER teamed up with HACKTORIA and created a China OSINT challenge. Trace a target across QQ → Baidu → Weibo → WeChat → and uncover their identity. Cross-platform investigation, beginner-friendly! 🔗 https://lnkd.in/d9vrYaTE

94

3 Comments

🔥The world of #stablecoins is accelerating fast... First there was (of course) - #USDT from Tether.io, #USDS (formerly known as #DAI) and then #USDC from Circle... ...plus new entrants like Circle's #EURC, Paxos's #USDP, Societe Generale - FORGE's #USDCV and the coins of PayPal #PYUSD and Visa, Walmart and others. Then there the #euro stablecoins - AllUnity's #EURAU and Circle's #EURC (among others....) Not to forget - J.P. Morgan's own #JPMCoin. The big question - which posed to Chris Zuehlke on RULEMATCH #SpotOn - is: ➡️ Which kind will win out? A fractionalized coin (much like bank deposits) or a fully-backed token, with all its implications? Chris's answer was not surprising ⤵️

11

1 Comment