Security researchers linked a new “Mach-O Man” malware kit to a Lazarus campaign that uses fake meeting invites and ClickFix prompts to steal credentials and access corporate systems on macOS. Security researchers have linked a new macOS malware campaign to the Lazarus Group, the North Korea-linked hacking operation behind some of the crypto industry’s biggest thefts. Flagged on Tuesday, the new “Mach-O Man” malware kit is distributed via “ClickFix” social engineering schemes across traditional businesses and crypto companies, according to Mauro Eldritch, offensive security expert and founder of threat intelligence company BCA Ltd. Victims are lured into a fake Zoom or Google Meet call where they are prompted to execute commands that download the malware in the background, allowing attackers to bypass traditional controls without detection to gain access to credentials and corporate systems, the security researcher said in a Tuesday report. Read more
The exchange set maker fees at 0% and taker fees at 0.02% across all pairs, extending near-zero pricing to all users with no volume tiers or subscription requirements. Update (April 22 7:49 PM UTC): This article has been updated to reflect the relationship between Binance.US and Binance in the eighth paragraph. Binance.US has reduced spot trading fees to 0% for makers and 0.02% for takers across all trading pairs, extending near-zero pricing to all users without volume thresholds or subscription requirements. The new pricing replaces the platform’s tiered fee structure and applies to all accounts, with the company saying the move could reduce trading costs by as much as 98% compared with competitors such as Coinbase. Read more
Aave’s supplied balance has tanked since the Kelp DAO bridge exploit, as users pull funds amid uncertainty over how much of the rsETH-linked shortfall the protocol will ultimately absorb. Aave, the largest decentralized lending protocol, has seen around $15 billion in deposits withdrawn since the Kelp Dao exploit on Saturday. Total value supplied to Aave fell from $45.8 billion on Saturday to $30.8 billion on Wednesday, according to Aavescan data. The decline followed an attack that drained about 116,500 restaked Ether (rsETH), worth roughly $293 million, from Kelp DAO’s LayerZero-powered rsETH bridge. The exploiter then used part of the stolen funds to borrow on Aave. Read more
The Financial Conduct Authority has raided eight locations suspected of illegal peer-to-peer crypto trading, issuing cease-and-desist orders. The United Kingdom’s Financial Conduct Authority (FCA) has raided multiple sites suspected of running illegal peer-to-peer (P2P) crypto trading operations. The financial services and markets watchdog said Wednesday that it worked alongside HM Revenue & Customs and the South West Regional Organised Crime Unit to inspect eight locations linked to illegal crypto trading. Officials issued cease-and-desist notices on site, ordering operators to halt activity immediately, while gathering evidence tied to ongoing criminal investigations. “Unregistered peer-to-peer crypto traders operating in the UK are doing so illegally and pose a financial crime risk,” Steve Smart, the FCA’s executive director of enforcement and market oversight, said. Read more
Smaller crypto companies across Europe face mounting compliance costs as MiCA moves from framework to enforcement, raising fears of market consolidation. The European Union’s Markets in Crypto Assets Regulation (MiCA) transition period is entering its final stretch, forcing smaller crypto firms across the EU to either secure authorization quickly or prepare to shut down regulated services. The transitional period ends across the bloc on July 1, after which any crypto asset service provider operating without a MiCA license must stop serving EU clients. Early movers like United Kingdom-based exchange CoinJar, which said it secured MiCA authorization in Ireland in 2025, call the regime a necessary maturation that rewards compliance-first players, but founders in markets like Poland warn thousands of virtual asset service providers (VASPs) could fall off a regulatory cliff as deadlines hit. Companies face a hard stop of July 1 for the longest 18-month grandfathering window, with some national regimes already clos...
Russian lawmakers passed a first reading of a bill regulating crypto through licensed intermediaries, with key rules set to take effect in July 2026 and 2027. Russia’s lower house of parliament passed a bill in first reading on Tuesday that would create the country’s core legal framework for digital currency, moving Moscow closer to a system that channels crypto trading through licensed intermediaries under Bank of Russia oversight. The draft bill No. 1194918-8, titled “On Digital Currency and Digital Rights,” passed its first reading in the State Duma on Tuesday, according to official records. The bill would allow Russians to buy and sell crypto through approved intermediaries as early as July, while banning unlicensed crypto platforms beginning in July 2027, if the draft becomes law. Read more