Wallet

Bitcoin adviser and author Terence Michael cautioned the community after a client who had saved for years lost 1 BTC to a romance-style pig-butchering scam. In a post on X, he described how social engineering prevailed despite multi-signature safeguards and advisory interventions. The case underscores limits of custody tools when victims authorize transfers.

Security researchers report a surge in social‑engineering scams using fake Zoom or Teams meetings to install malware that siphons data and drains crypto wallets. Attackers impersonate known contacts via Telegram, use pre‑recorded video, and push a bogus audio or SDK patch during calls. Losses have topped $300m, with attempts observed on a daily basis across the sector.

React Server Components’ CVE-2025-55182, rated CVSS 10.0, is being actively exploited to drain crypto wallets across frameworks like Next.js. Attacks surged following the Dec. 3 disclosure; patches shipped in React 19.0.1, 19.1.2, and 19.2.1, with Next.js updates across 14.2.35–16.0.10. Sites should upgrade, deploy WAF rules, and review front-end code for malicious assets.

On December 15, 2025, Binance recorded the fewest BTC deposits from wallets holding at least 1 BTC, reaching lows not seen since 2018. According to Bitcoin Magazine Pro, retail inflows slowed throughout 2025 while miners increased deposits. CryptoQuant reported that over 6,400 BTC moved into accumulation addresses around December 10 as more users shifted to self custody.

From 2027, the UK plans to bring crypto markets within a framework comparable to mainstream financial products under FCA oversight. The UK Treasury said legislation extending current financial services rules to crypto firms will be tabled in Parliament in the coming months. Ministers are also pursuing a proposal to outlaw political donations made in cryptocurrency.

The UK Treasury said it is drafting rules to bring crypto assets under FCA supervision beginning in 2027. Britain plans formal regulation from October 2027, with digital assets treated similarly to other financial products. The government also signaled a draft bill and cooperation with the US via a Transatlantic Taskforce.

The SEC issued an investor bulletin on crypto asset custody, urging retail users to weigh security trade-offs and the consequences of private key loss. On December 13, 2025, the agency highlighted the guidance via its official account. In parallel, regulators advanced integration with banking, as the OCC conditionally approved five crypto firms for national trust bank status and the SEC cleared DTCC to tokenize select securities beginning in late 2026.

On Friday, the U.S. Securities and Exchange Commission released an investor bulletin on crypto wallets and custody, outlining basic practices and key risks. The guide contrasts self-custody with third-party arrangements, flags issues like rehypothecation and asset commingling, and explains hot-versus-cold wallet trade-offs.

YouTube has added PayPal's PYUSD as an opt in payout rail for eligible US creators, according to Fortune. The workflow issues earnings, makes them available via PayPal Hyperwallet, and lets creators cash out to PYUSD, with the stablecoin's market cap around $3.91 billion and YouTube's creator payments exceeding $100 billion in four years.

On December 12, 2025, the front-end of the ZEROBASE zero-knowledge proving network was hijacked, leading to more than 270 users losing over $240,000 in USDT via a phishing smart contract on BNB Chain. One victim alone lost 123,597 USDT, while security teams later identified the malicious contract, blocked related domains and blacklisted approvals to limit further damage.