We’d love your feedback.
Take a 30-second survey to help improve The Block.
The following article is adapted from The Block’s newsletter, The Daily, which comes out on weekday afternoons.
Happy Monday! Bitcoin slipped toward $86,000 late Sunday amid mounting U.S. government shutdown concerns, though prices since recovered near $88,000 this morning.
In today’s newsletter, ZachXBT ties an alleged $40 million government crypto wallet theft to a custody contractor’s son, Kraken rolls out “DeFi Earn” for onchain yield, Japan looks to approve its first crypto ETFs by 2028, and more.
Meanwhile, Michael Saylor’s Strategy buys another 2,932 BTC for $264 million as its total holdings reach 712,647 BTC ($62.5 billion). Plus, a snowstorm in Washington, D.C., delays the Senate Agriculture Committee’s crypto bill markup to later in the week.
P.S. Don’t forget to check out The Funding, a biweekly rundown of crypto VC trends. It’s a great read — and just like The Daily, it’s free to subscribe!
ZachXBT alleges $40M government crypto theft linked to custody contractor’s son
Onchain sleuth ZachXBT alleged that an individual named John Daghita was involved in the theft of more than $40 million in crypto from U.S. government wallets linked to seized assets.
* The investigator claims Daghita is the son of Dean Daghita, president of Command Services & Support (CMDSS), a firm contracted by the U.S. Marshals Service to manage seized cryptocurrencies.
* ZachXBT’s findings build on an earlier probe tying an online actor known as “John” or “Lick” to over $90 million in suspected illicit crypto activity.
* A recorded “band-for-band” Telegram argument — a crypto flexing contest to prove wallet ownership — first exposed addresses linked to the alleged threat actor, the sleuth said.
* During the exchange, the individual screen-shared wallets and moved funds live, which ZachXBT said helped him trace the crypto back to the U.S. government’s Bitfinex hack seizure addresses.
* CMDSS previously faced scrutiny after winning the Marshals Service contract, including a failed protest by a competitor alleging licensing gaps and potential conflicts of interest.
* The allegations have not been adjudicated in court, and no official charges have been announced. The Block could not reach CMDSS for comment.
Kraken rolls out ‘DeFi Earn’ to bring onchain yield to its crypto exchange users
Kraken launched “DeFi Earn” across the EU, Canada, and most U.S. states to offer its centralized exchange users direct access to onchain yield.
* The product offers variable returns of up to 8% APY while keeping the experience inside Kraken’s custodial platform.
* Kraken powers DeFi Earn through vault infrastructure provider Veda, with Chaos Labs and Sentora managing the first three USDC vault strategies across protocols like Aave, Morpho, Sky, and Tydro.
* The rollout reflects a broader push by centralized platforms to bring DeFi-native yield to traditional exchange users within a familiar interface.
Japan to approve its first crypto ETFs in 2028
Japan plans to approve its first crypto exchange-traded funds in 2028, with regulators preparing to recognize digital assets as eligible ETF base assets, according to Nikkei Asia.
* Nomura and SBI — two of Japan’s largest financial institutions — are expected to launch the country’s initial crypto ETF products on the Tokyo Stock Exchange, the outlet reported.
* The move follows the rapid success of U.S. spot crypto ETFs, where bitcoin ETFs have accumulated $115.8 billion in net assets — approximately 6.5% of BTC’s total market capitalization.
* Japan joins a broader regional push, too, as Hong Kong and South Korea advance their own crypto ETF and stablecoin frameworks.
Matcha Meta sees $16.8 million drained in SwapNet incident
DEX aggregator Matcha Meta disclosed a security incident tied to its SwapNet integration after attackers drained an estimated $16.8 million in users’ crypto, according to blockchain security firm PeckShield.
* Onchain data shows the attacker swapped millions in USDC on Base into ETH before attempting to bridge the funds to Ethereum.
* Fellow security firm CertiK said the exploit appears linked to an arbitrary call vulnerability in SwapNet contracts that allowed the attacker to transfer approved funds.
* Matcha Meta disabled the SwapNet integration and removed direct allowances on individual aggregator contracts as investigations continue.
South Korea’s Coinone selling major stakeholder shares, in talks with overseas crypto exchanges
Coinone, South Korea’s third-largest crypto exchange, is exploring the sale of a portion of chairman Cha Myung-hoon’s 53.4% majority stake as it seeks new strategic or financial partners, according to local media reports.
* The exchange is reportedly in early talks with overseas crypto platforms, including Coinbase, and local financial institutions, though no deal has been finalized.
* The potential stake sale comes as Coinone faces ongoing losses and a sharply lower valuation compared with prior years.
In the next 24 hours
* It’s quiet on the economic calendar front on Tuesday.
* President Trump is scheduled to speak at 1:30 p.m. ET.
Never miss a beat with The Block’s daily digest of the most influential events happening across the digital asset ecosystem.
