🚨 Attackers took over $350 million from Bitget's hot wallets this week. The evidence points to North Korea. We traced stolen Bitget funds to addresses tied to previous DPRK-attributed exploits, including Bybit. If the attribution holds, DPRK-linked cryptoasset theft in 2026 has now passed $1 billion. We updated our datasets shortly after the first alerts, so Elliptic customers can already screen against the linked addresses. Read our analysis of the attack: hubs.la/Q04ykdwb0

👮‍♀️ Crypto lead prioritization has historically sat with specialist units, which has meant that front-line police officers who encounter a crypto address cannot immediately take action on what is potentially an important piece of intelligence. That's why we are launching Pulse, built with law enforcement for law enforcement. Officers enter an address or transaction hash and get a plain-language summary in seconds, with the evidence behind it and a clear escalation path to the appropriate investigations team. No crypto expertise required, at the front line or in the division picking the case up. Read more about Pulse: hubs.la/Q04ycmmT0

AI-enabled financial crime is scaling faster than regulators can write rules for it. Elliptic CEO Simone Maini joined @tokenizedpod to discuss why compliance can't wait, and how we're co-building agentic guardrails with Circle. 🎥 Full episode: hubs.la/Q04y7FJ90

Blockchains cannot read each other. A user holding Bitcoin cannot spend it in an application built on Ethereum, because the two networks share no ledger. Cross-chain bridges close that gap. The asset is locked, burned or pooled on one chain and the equivalent is issued on another, as two separate entries connected by a protocol. Our new blockchain basics article explains how bridges work, how they differ from decentralized exchanges and coin swap services, and where the compliance risk sits. hubs.la/Q04y1bYy0

The rules for agentic risk decisions haven't been written yet. So we published eight principles while there's still time to argue about them, developed with regulated institutions and shaped by direct regulatory engagement. We would rather be challenged on it now than defend it later. This is something the industry has to get right together. Read the Elliptic Standard ➡️ hubs.la/Q04xR4L50

🤖 Today we launched Decode, an AI agent that answers questions about on-chain risk in plain language. It provides easy and direct access to Elliptic's intelligence platform. Who does this address belong to? What is it exposed to? Which counterparties has this exchange dealt with? Ask and receive an evidenced answer in seconds, along with the query that produced it. The Decode agent was produced in line with the principles of the Elliptic Standard. Read more on how it works here: hubs.la/Q04xKcr60

🇺🇸 The CLARITY Act failed cloture 49-50, eleven votes short and one shy of a majority. Market structure stays with the SEC and the CFTC, to be worked out through rulemakings, litigation and no-action letters. The Bank Secrecy Act remains the obligation that makes an institution answer for every compliance decision it takes, including the ones its agents now take at agentic speed. Elliptic's Peter Phelan on what yesterday's vote changed and what it didn't: hubs.la/Q04xDrxC0

📑 Here's the latest in crypto regulatory affairs: - OFAC sanctions Xinbi Guarantee, the second largest illicit marketplace of all time. Elliptic worked with the U.S. Secret Service to identify and freeze 52 wallets holding $52.8 million in USDT. - Singapore consults on the legislation that will implement its stablecoin regime, including recognition of some stablecoins issued abroad. - Thailand finalizes Travel Rule requirements that go further than the FATF standard on self-hosted wallets. - Senate Republicans release updated CLARITY Act text ahead of tomorrow's cloture vote. Elliptic's David Carlisle on what each regulatory event means for compliance teams: hubs.la/Q04xl-5F0

Agents are already initiating stablecoin payments with no human in the loop. A 500%+ jump in agentic crypto transactions in three months. The job now: stop the bad payment before it settles. James Smith explains: hubs.la/Q04xdfc50

The Elliptic Standard. The first published standard for agentic on-chain risk. We wrote it. We build to it. We answer for it. Eight principles, published in the open. Challenge your vendors. Hold us to it. Read it here ➡️ hubs.la/Q04x8q3T0

🚨 Elliptic has worked with @SecretService to freeze wallets holding $52.8 million in cryptoassets linked to Xinbi Guarantee, the second largest illicit online marketplace of all time. Merchants on Xinbi sell victim personal data, communications infrastructure and money laundering services to scam operations worldwide. Since 2022 the marketplace has processed at least $24 billion. Guarantee marketplaces run entirely on trust. Merchants post deposits with the platform because criminals have no legal recourse against each other, and the escrow model substitutes for it. That only works while everyone believes their funds are out of reach. But that trust is misplaced. Every dollar that has moved through Xinbi left a permanent record on a public blockchain. We have been investigating that record for years, and this week our work brought those funds within reach of law enforcement. Read how Elliptic's work enabled today's freeze: hubs.la/Q04x20NN0

🇸🇬 MAS is proposing a separate regulatory track for systemic stablecoins, and formal recognition of foreign-issued ones. In this 45 minute session, June Lau will share Elliptic’s response to the consultation and what market participants should be thinking about now. Join us on Sept 17 at 3PM SGT ➡️ hubs.la/Q04x0nM40

A nested exchange is a cryptoasset business that serves its own customers through an account it holds at a larger exchange. Some of these arrangements are ordinary commercial relationships, run by licensed businesses with real controls. Others operate without the parent exchange knowing, and ask their own users for very little. Our new Blockchain Basics explainer covers how to tell the two apart, and what the second kind means for onboarding and monitoring: hubs.la/Q04wWLqG0

Dror Avieli has joined Elliptic as our Chief Customer Officer. Institutions are entering digital assets as AI reshapes how criminals operate. Dror is here to lead our customer organization through that shift. Welcome to the team, Dror! hubs.la/Q04wJtdP0

CBDC, stablecoin, cryptoasset. Three kinds of digital money that sometimes get used interchangeably when they shouldn't be. Our updated explainer covers what a CBDC actually is, how retail and wholesale designs differ, and where compliance obligations land. hubs.la/Q04wvpFn0

The US just gave itself the power to cut off correspondent banking for firms tied to Iran's crypto sector. It's the lead story in this edition of our crypto regulatory affairs update, alongside moves from the UK, US and Pakistan ➡️ hubs.la/Q04w4jf50

🇭🇰 Hong Kong is set to add four virtual asset licenses: dealing, custody, advisory and management. None of them is covered by an existing Type 1, Type 4, Type 9 or VATP license. There is also no grandfathering. Firms need to hold a license on the day the regime commences, and regulators have warned that those who haven't engaged the SFC may have to stop operating. The bill hasn't reached the Legislative Council yet, but the consultation conclusions are already detailed enough to act on. Our new post, from the pen of Elliptic's June Lau, maps readiness across five stages of the risk lifecycle. hubs.la/Q04v9c3c0

Blockchain forensics splits across two parties: A blockchain analytics provider builds the dataset: making attributions about addresses and grouping addresses that share an owner. That work runs continuously, independently of any particular case. The investigator works on top of it. Following the funds, deciding which branch to take where they mix with other funds, following them onto other blockchains, finding the point where the trail meets a regulated business and documenting the result along the way. Our new article covers all six steps that make blockchain forensics work: hubs.la/Q04v9bN10

🏦 Financial institutions assess new counterparties by asking them questions. For most counterparties, a bank cannot independently observe how they handle the flows they describe, so the bank verifies what it can and takes the rest on the counterparties' word. For virtual asset service providers, or VASPs, there is more to work with, as much of their activity sit on a public ledger. A bank can test an applicant's account of itself, both the controls it claims to run and the risk profile it claims to have. The due diligence questionnaire is still where you start. It just isn't where the assessment has to end. hubs.la/Q04tHnt90

We're excited to be featured on @thestablecon 2026 Stablecoins Ecosystem Map. A snapshot of the companies shaping stablecoins today, across infrastructure, payments, issuance, and financial services. Proud to be featured alongside so many teams pushing this forward.