For operators across crypto, iGaming and payments, we track the week hidden risk went public: leaked Curaçao ownership records, an eight-day iOS wallet exploit, and a CFTC warning on person-named prediction markets.
Inglorious · 21 SEP
MiCA was pitched as one licence, one rulebook, 27 markets. The ECB's formal consultation role for systemically significant CASPs quietly overrides that. This piece breaks down how Christine Lagarde used that mechanism to block Binance's MiCA licence before any national regulator ruled, and what that means for any large crypto firm assuming national authorities hold the actual decision.
Read the breakdownThe CFTC's Division of Market Oversight issued an advisory Tuesday warning that prediction market contracts settled on whether a person says or does something carry heightened manipulation risk. The advisory tells exchanges that listing these "mention markets" is only permissible in limited circumstances, and lays out four factors for review: manipulation surveillance, independent verifiability of the triggering conduct, external pressure on the subject, and the subject's outside obligations. The warning follows a case last month in which a former White House teleprompter operator was ordered to return $107,539 in profits plus a $65,000 penalty for trading contracts tied to Trump's speeches.
The CFTC was already reviewing mention markets before this advisory. Kalshi pulled sports-related mention contracts in August pending that inquiry, and separately faces scrutiny over nearly $5 billion in Ether-linked trades, a third of them in near-identical $5,500 increments.
If your platform lists contracts settled on a named individual's speech or conduct, expect exchanges to start pulling or restructuring those markets preemptively rather than wait for a CFTC enforcement action.
SlowMist traced roughly $580,000 in stolen crypto (579,984 USDT) to a malicious iOS app called FomoPeek that was distributed through Apple's App Store. Versions released September 9 and 12 contained two modules using kernel exploits, covering iOS 12.0 through 18.7.2 and 26.0 through 26.1, to escape the sandbox and pull Keychain data and files from other apps. Version 1.3, released September 17, removed the malicious code.
The hacker address went active September 15 and moved funds across multiple chains before consolidating them through FixedFloat, KuCoin and cce.cash. SlowMist is still tracing the rest.
If your compliance team relies on App Store vetting as a security baseline for user-facing wallet apps, this shows that assumption bought eight days of active exploitation before removal.
FomoPeek, an iPhone app distributed through Apple's App Store and marketed as a read-only crypto transaction tracker, contained malware linked to nearly $580,000 in stolen USDT. SlowMist and OKX found the malicious code in versions 1.1 (released Sept. 9) and 1.2 (Sept. 12), removed in version 1.3 on Sept. 17. The exploit used a kernel framework with eight attack methods to break iOS sandbox isolation and read Keychain data, private keys and seed phrases from other apps, without users ever connecting a wallet.
No wallet connection required is the detail that matters. Binance, OKX, Gate, Bitget Wallet and Rabby are now warning users because App Store review didn't catch a remote command-and-control module hiding behind eight days of live distribution.
If your exchange or wallet tells users that App Store distribution implies vetted security, this incident shows sandbox escapes can sit live for over a week before detection, exposing any locally stored keys regardless of which wallet app holds them.
XRPL validators are tracking a conditional activation of BatchV1_1 for Sept. 29 at 14:06:41 UTC, contingent on support staying above 80% for two weeks. As of Sept. 22, 30 of 35 trusted validators backed the amendment, above the 28-vote threshold. The rewrite fixes an authorization flaw found in February in the original Batch amendment, where a forged signer entry could let an unchecked transaction execute without the victim's keys. XRPL Labs says no funds were ever at risk since the flawed code never reached mainnet.
The fix closes the protocol hole. It does not patch every client.
If your platform integrates XRPL batch transactions through a wallet or node that hasn't been updated for BatchV1_1, then post-activation you risk silent inner-transaction failures reported as overall success.
A nine-month breach of the Curaçao Gaming Authority's licensing portal, carried out by Berlin researcher Lilith Wittmann under a fake trust-office identity, exposed ownership records for roughly 800 owners linked to nearly 650 licensed gambling firms. The leaked files include 897 beneficial-owner records covering 767 people across 646 entities, plus passports, tax filings and financial records tied to brands including Stake, 1xBet and Blaze.com.
The breach didn't just expose data. It exposed that CGA licensed companies while its own assessors still had open questions about who actually owned them.
If your platform holds a Curaçao license issued under the old master-license system, expect renewed due diligence pressure from banks and payment partners now that beneficial ownership gaps are public record.
The Curaçao Gaming Authority disclosed on September 17 that it contained unauthorized access to its online gaming portal but has not yet determined what data, if any, was viewed. The source of the access has been identified and extra monitoring is now in place, while forensic investigators have found no compromise of core technical infrastructure so far.
The portal is the mandatory intake point for all online gaming and supplier licence applications under the LOK, meaning any exposure runs through identification, financial and criminal due diligence records, not just contact details.
If your operator or supplier filed licensing, financial or due diligence data through the CGA portal since the LOK took effect in December 2024, that data sits inside the scope this investigation still hasn't closed.
Bally's Intralot shareholders approved the $325 million takeover of evoke (William Hill, 888) on September 18, with only 0.415% of votes against. Evoke's own investors backed the deal in August at 99.63%. What's left is a court sanction hearing and regulatory clearances, with completion targeted for Q4 2026 or Q1 2027.
Both sides bring heavy debt to the table: evoke carries roughly $2.5 billion, Bally's Intralot over $1.3 billion. Evoke went looking for a buyer after UK Remote Gaming Duty jumped from 21% to 40% on April 1, 2026, a hike that also triggered 200 more William Hill shop closures this year.
If your UK-facing online casino brand is still absorbing the RGD increase to 40%, expect more distressed sales like this one as operators with weaker balance sheets can't carry the same debt load through a tax-compressed market.
A National Association of Games and Lotteries (ANJL) study projects that a Brazilian government ban on online casinos run by licensed betting companies could push illegal operators' market share from 41% to 82%. ANJL estimates the ban could cost Brazil between R$3.6bn and R$7.4bn ($700m to $1.44bn) in annual revenue, affecting a market of more than 25 million registered bettors.
ANJL's monitoring from September 11-18 found 6,409 illegal betting domains still fully operational, with 13.7 new unauthorized sites registered daily between June and August.
If Brazil restricts online casino verticals on licensed platforms, PSPs and operators should expect user migration to offshore sites with no KYC, no self-exclusion tools, and no tax remittance, undermining the compliance infrastructure legal operators already built.
The FTC filed two September cases exposing how deep merchant underwriting scrutiny now goes. It alleges Nuvei opened or kept processing accounts for merchants it knew or should have known were running deceptive schemes, and separately accused Humboldt Merchant Services of processing for more than 1,000 shell merchants used as fronts for unauthorized billing operations. Nuvei's court order now requires five months of chargeback data, six months of processing statements where available, and checks on whether a merchant was placed in a card network monitoring program or terminated elsewhere.
If your acquiring program approves merchants without pulling prior chargeback monitoring status and processor termination history, then a shell-merchant pass-through scheme becomes your compliance liability, not just theirs.
The Fed's internal review of SVB's 2023 collapse, released Sept. 18, attributes the failure to concentrated deposits, interest-rate exposure and weak liquidity planning, not social-media panic. Circle held $3.3 billion of USDC reserves at SVB when it failed. USDC broke its dollar peg, then recovered once regulators guaranteed SVB's uninsured deposits.
The government never guaranteed USDC. It guaranteed the bank holding USDC's collateral, which amounts to the same protection without the label.
If your treasury team evaluates stablecoin risk by looking at chain mechanics instead of where issuer reserves are custodied and by whom, you're pricing the wrong risk entirely.
SoFi Bank has moved its entire card programme onto blockchain settlement, using its own SoFiUSD stablecoin to settle transactions across the Mastercard network.
This is not a pilot bolted onto legacy rails. SoFi is routing the whole card programme through the stablecoin, which makes it one of the first US banks to settle real card volume on-chain by default rather than by exception.
If your bank or PSP still settles card transactions through correspondent banking batches, then a chartered competitor settling instantly in stablecoin resets the baseline customers and card networks will expect on settlement speed.
Insights on banking, payments, crypto regulation, and licensing.
Weekly. No spam. Unsubscribe anytime.
Get a free assessment from our team within 24 hours. No obligation, completely confidential.
Contact Us