Register updates, week 39 of 2026
Between 2026-09-21 and 2026-09-27 (ISO week 39 of 2026), the register recorded 23 events on 7 entries across 2 families: 11 authorisation records, 7 entries published and 5 incidents recorded.
Every event this week
Newest first. Each event’s anchor on this page is its permanent address; the citation under it is ready to paste.
Bitget: authorisation recorded
Record Authorisation with Comision Nacional de Activos Digitales, El Salvador (Digital Asset Service Provider)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "Bitget: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bitget-authorisation-29270a88 (data CC BY 4.0)
Bitget: authorisation recorded
Record Authorisation with Australian Transaction Reports and Analysis Centre (AUSTRAC) digital currency exchange register
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "Bitget: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bitget-authorisation-5b23ee69 (data CC BY 4.0)
Bitget: authorisation recorded
Record Authorisation with European Securities and Markets Authority (MiCA register of authorised crypto-asset service providers)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "Bitget: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bitget-authorisation-879b382f (data CC BY 4.0)
Bitget: on the register
Record Authorisation with Austrian Financial Market Authority (FMA), crypto-asset service provider authorisation under Regulation (EU) 2023/1114 (MiCA)
Recorded confirmed in the regulator’s register
Cite CryptoGuardz, "Bybit: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bybit-authorisation-4116879a (data CC BY 4.0)
Record Authorisation with European Securities and Markets Authority (MiCA register of non-compliant entities)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "Bybit: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bybit-authorisation-fb988e26 (data CC BY 4.0)
Bybit: on the register
Record Theft of approximately $1.5 billion in virtual assets from Bybit. The FBI issued Public Service Announcement I-022625-PSA on 26 February 2025 stating: "The...
Recorded dated 2025-02-21
Theft of approximately $1.5 billion in virtual assets from Bybit. The FBI issued Public Service Announcement I-022625-PSA on 26 February 2025 stating: "The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025. FBI refers to this specific North Korean malicious cyber activity as \"TraderTraitor.\"" The PSA adds: "TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency." The PSA lists 51 Ethereum addresses holding or having held assets from the theft and asks virtual asset service providers to block transactions with them.
Cite CryptoGuardz, "Bybit: incident recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-bybit-incident-b3eaa739 (data CC BY 4.0)
Record Authorisation with European Securities and Markets Authority (MiCA register of authorised crypto-asset service providers)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "MEXC: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-mexc-authorisation-879b382f (data CC BY 4.0)
Record Authorisation with European Securities and Markets Authority (MiCA register of non-compliant entities), on notification by the Netherlands Authority for the Financial Markets (AFM)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "MEXC: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-mexc-authorisation-cb15b48a (data CC BY 4.0)
MEXC: on the register
Record The Netherlands Authority for the Financial Markets determined that MEXC provides crypto-asset services in the Netherlands without the required MiCAR...
Recorded dated 2025-09-16
The Netherlands Authority for the Financial Markets determined that MEXC provides crypto-asset services in the Netherlands without the required MiCAR licence, in breach of Article 59 MiCAR, and issued a public warning. The determination is recorded on the European Securities and Markets Authority's official MiCA register of non-compliant entities, where the reason field reads: "MEXC Global provides crypto-asset services in the Netherlands without the required MiCAR license. MEXC is in breach of section 59 MiCAR." The register record was last updated 25 September 2025 and MEXC was still listed in the file published 16 September 2026.
Cite CryptoGuardz, "MEXC: incident recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-mexc-incident-7be00b3c (data CC BY 4.0)
Record Authorisation with Malta Financial Services Authority (MFSA), crypto-asset service provider authorisation under Regulation (EU) 2023/1114 (MiCA)
Recorded confirmed in the regulator’s register
Cite CryptoGuardz, "OKX: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-okx-authorisation-5b85b3db (data CC BY 4.0)
Record Authorisation with Malta Financial Services Authority (MFSA), financial institution licence under the Financial Institutions Act, Chapter 376
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "OKX: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-okx-authorisation-7380fe22 (data CC BY 4.0)
Record Authorisation with United States Financial Crimes Enforcement Network (FinCEN), money services business registration
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "OKX: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-okx-authorisation-eb7c9db8 (data CC BY 4.0)
Record Authorisation with European Securities and Markets Authority (MiCA register of non-compliant entities)
Recorded claimed, not confirmed in a register
Cite CryptoGuardz, "OKX: authorisation recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-okx-authorisation-fb988e26 (data CC BY 4.0)
OKX: on the register
Record Aux Cayes Fintech Co. Ltd, d/b/a OKEx, d/b/a OKX, the Seychelles entity that operates OKX, pleaded guilty in the United States District Court for the...
Recorded dated 2025-02-24
Aux Cayes Fintech Co. Ltd, d/b/a OKEx, d/b/a OKX, the Seychelles entity that operates OKX, pleaded guilty in the United States District Court for the Southern District of New York to one count of operating an unlicensed money transmitting business, and agreed to pay monetary penalties totalling more than $504 million, comprising criminal forfeiture of $420.3 million and a criminal fine of approximately $84.4 million. The Department of Justice states: "From in or about 2018 through in or about at least early 2024, OKX served U.S. retail and institutional customers that engaged in over one trillion dollars’ worth of transactions through OKX", and "Because OKX served U.S. retail and institutional customers, OKX knew it was required by U.S. law to register as a money services business with FinCEN, but OKX chose not to do so." It further states that "through at least early 2024, OKX was used by numerous customers as a vehicle for laundering the proceeds of suspicious and criminal activities, including more than five billion dollars of suspicious transactions and illicit proceeds, based on a review of third-party transaction data", and that OKX employees on occasion advised customers how to give false KYC information, quoting an April 2023 message: "I know you’re in the US, but you could just put a random country and it should go through. You just need to put Name, nationality, and ID number. You could just put United Arab Emirates and random numbers for the ID number." As part of the plea agreement OKX retains an external compliance consultant at its own cost through February 2027. Press Release Number 25-041.
Cite CryptoGuardz, "OKX: incident recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#exchanges-okx-incident-816ca659 (data CC BY 4.0)
MetaMask: on the register
Phantom: on the register
Trust Wallet: on the register
Trust Wallet: incident recorded
Record A malicious build of the Trust Wallet browser extension, version 2.68, was published to the Chrome Web Store outside Trust Wallet's standard release...
Recorded dated 2025-12-24
A malicious build of the Trust Wallet browser extension, version 2.68, was published to the Chrome Web Store outside Trust Wallet's standard release process, using a Chrome Web Store API key that Trust Wallet says was leaked during the November 2025 Sha1-Hulud npm supply chain incident. Trust Wallet identified 2,520 affected wallet addresses and approximately 8.5 million US dollars in assets drained, and elected to reimburse affected users. The reimbursement claim process requires claimants to submit a scan of a government-issued identification document to a third-party KYC partner.
Cite CryptoGuardz, "Trust Wallet: incident recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#wallets-trust-wallet-incident-4b82fcd7 (data CC BY 4.0)
Trust Wallet: incident recorded
Record CVE-2023-31290. Trust Wallet Core before version 3.1.1, as used in the Trust Wallet browser extension versions 0.0.172 through 0.0.182, generated mnemonics...
Recorded dated 2023-04-27
CVE-2023-31290. Trust Wallet Core before version 3.1.1, as used in the Trust Wallet browser extension versions 0.0.172 through 0.0.182, generated mnemonics from only 32 bits of entropy because the Mersenne Twister was seeded with a single 32-bit value, reducing the space to roughly four billion possible mnemonics. Exploited in the wild in December 2022 and March 2023.
Cite CryptoGuardz, "Trust Wallet: incident recorded", register update of 2026-09-22. https://cryptoguardz.com/updates/2026-w39/#wallets-trust-wallet-incident-a4738a17 (data CC BY 4.0)
How to cite an update
Every event has a permanent address: its week page and an anchor, in the form https://cryptoguardz.com/updates/2026-w41/#<event>. The anchor is derived from the entry, the field and the two values, so it does not move when other events are added. Link the permalink, give the date of the update, and name the issuing source it links to.
The register data on this page is published under CC BY 4.0. Reuse it, quote it and build on it, with attribution to CryptoGuardz and a link to the event’s permalink. Licence: Creative Commons Attribution 4.0 International. Quotations from third-party documents remain their authors’; the licence covers the register’s own records.