Botwin's Morning Wire

The U.S. Treasury Department announced sanctions against a Hamas military‑wing member, two individuals based in France and two charities for allegedly funneling more than $2 million to the group through cryptocurrency and humanitarian‑aid fronts. Treasury said the collection of funds spanned 2020 through 2026, with $1.5 million raised after Hamas’s October 7, 2023 attack on Israel, and that hundreds of thousands of dollars in digital assets were sent to a Gaza‑based Hamas commander. The sanctions freeze any assets held under U.S. jurisdiction, prohibit American persons from transacting with the designated parties and expose foreign financial institutions that facilitate significant transactions to potential penalties. Treasury alleged that Faouzi Barika and Amel Oualid gathered money in France under the guise of humanitarian aid before transferring it to Hamas, which has governed the Gaza Strip since 2007. The network moved more than $2 million between 2020 and 2026, including the post‑attack sum, and transferred crypto to Saleem Abdallah Saleem al‑Zaq, a deputy battalion commander in Hamas’s Al‑Qassam Brigades. Treasury officials emphasized that terrorist groups rely on sophisticated financial facilitators and fraudulent schemes to exploit the public. The action reflects a broader focus on crypto’s role in fundraising and payment networks rather than portraying it as Hamas’s primary funding source. Previous sanctions and seizures have targeted crypto‑related activity, and recent reports indicated that Al‑Qassam Brigades advised donors to avoid direct Binance transfers and use alternative crypto services before moving funds to a TRON wallet. The new measures block any property or interests in property held by the designated individuals and organizations under U.S. jurisdiction and extend to entities owned 50 percent or more by any designated party.

The Commodity Futures Trading Commission announced a new rulemaking effort that would give U.S. crypto exchanges a path to offer leveraged trading to retail customers. The agency opened formal consideration of two proposals — Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets — on Oct. 5. These rules would establish a national standard for platforms that provide margined, leveraged or financed crypto transactions. Participation would remain voluntary because the CFTC cannot require the entire market to shift to regulated venues without congressional action. The incentive for exchanges is access to products such as leverage and perpetual contracts that state licensing alone does not permit. The framework would create three distinct regulatory pathways. Spot exchanges could continue operating under state money‑transmitter licenses while remaining subject to the CFTC’s existing anti‑fraud and anti‑manipulation authority. Platforms that wish to offer leveraged or financed retail crypto products could register at the federal level under the new structure. Venues that trade futures, perpetuals and other derivatives would stay within the agency’s current designated contract market regime. A middle category, called CAM, would apply tailored rules to exchanges that want to offer both spot and derivatives activities. The proposal leans on Section 2(c)(2)(D) of the Commodity Exchange Act, which covers certain leveraged retail commodity transactions. The CFTC’s policy center said the design would give market participants a clearer regulatory ladder: state licensing for basic spot activity, federal oversight when leverage is introduced, and the existing derivatives framework for futures and perpetuals. By doing so, the plan could narrow a gap that has historically separated U.S. exchanges from offshore competitors. Leveraged trading and perpetual contracts have helped foreign venues attract active traders and generate higher volumes. U.S. platforms have been limited to a narrower product set because of regulatory constraints. That dynamic creates the central commercial trade‑off. Federal registration could allow U.S. exchanges to offer products that have strengthened offshore rivals, but it would also require changes to the vertically integrated models used by many crypto firms that combine exchange, brokerage and custody functions. Larry Florio, deputy general counsel at synthetic‑dollar developer Ethena Labs, described retail leverage as the proposal’s primary attraction, saying it could be enough to draw exchanges into a single federal framework. Whether the additional volume and revenue from leverage outweighs the constraints of CFTC oversight will determine how many major platforms choose to participate. CFTC Chairman Michael Selig framed the initiative around lessons from the FTX bankruptcy, arguing that regulators should build preventive safeguards rather than rely solely on enforcement after customers suffer losses. Selig said on Oct. 5 that “the lesson from FTX’s failure should have been obvious,” emphasizing that protecting customers from fraud should coexist with responsible crypto innovation. CAM operators would be subject to core requirements already imposed on designated contract markets, including rules on financial integrity, surveillance, conflicts of interest and operational safeguards. The agency is also considering crypto‑specific provisions. Exchanges may need to evaluate token concentration, distribution methods, vesting schedules, lockups, programmatic issuance and buybacks when deciding whether an asset can be traded without being prone to manipulation. Platforms that hold customer assets in omnibus accounts could be required to meet proof‑of‑reserves standards, a safeguard Selig linked directly to failures observed at FTX. Retail customers who engage in CTX trades would be intermediated through registered futures commission merchants, bringing their accounts and property under capital, disclosure and segregation requirements. FCM involvement would also subject customer‑facing activity to Bank Secrecy Act obligations, including anti‑money laundering controls, customer identification and suspicious‑activity reporting. Those compliance costs could make opting into the federal framework more expensive than simply paying registration fees or hiring compliance staff. Exchanges would gain access to leverage while potentially surrendering some of the structural flexibility that has allowed crypto platforms to keep trading, brokerage and custody under one roof. The balance of those benefits and costs will be central to whether large U.S. exchanges decide to join the regime. The CFTC is also beginning to define how decentralized markets and software developers fit within federal commodities law, though that work falls outside the scope of the CTX and CAM initiatives. The CTX proposal would clarify the act’s “actual delivery” exception by treating transfers to a customer’s external non‑custodial wallet within 28 days as generally satisfying the exemption from exchange‑trading requirements for certain leveraged retail commodity transactions. Separately, Selig said the agency is examining when software developers who publish code without taking orders, controlling execution or holding assets should be treated as regulated intermediaries. He said: “A person should not have to register as an introducing broker simply because that person shipped code.” The CFTC is consulting developers about where control resides in onchain venues and when software activity begins to resemble regulated financial intermediation. The immediate question, however, is economic for centralized exchanges. The Oct. 5 action is an advance notice of proposed rulemaking, and the agency is seeking public input before drafting detailed rules on leverage limits, asset eligibility, custody standards and intermediary requirements. As a result, major elements of the framework remain unresolved. If major platforms determine that access to federally regulated retail leverage is valuable enough to accept deeper oversight, the CFTC could begin moving trading activity currently concentrated on offshore venues into regulated U.S. markets without waiting for Congress to resolve the broader jurisdictional debate over crypto spot markets.

A Chinese organized crime group moved more than $1 billion in stolen cryptocurrency on behalf of North Korea’s Lazarus Group, according to blockchain analyst ZachXBT.

In a series of posts on X published on Oct. 5, ZachXBT described how he joined the laundering operation in February 2025, shortly after the Bybit exchange was compromised. He created a client profile by depositing $349,700 in stablecoins and accepting a 5% loss on each transaction to gain the confidence of one of the network’s facilitators, who used the alias “Jimmy Green.”

ZachXBT said the laundering infrastructure operated out of Hong Kong and mainland China. Data supplied by the facilitator allowed him to trace more than $12 million in funds tied to the Bybit breach, and Tether later froze $442,000 in USDt linked to the same cluster.

The analyst noted that North Korean state‑linked hackers have stolen at least $6.75 billion in digital assets through 2025, according to Chainalysis. Their typical method involves moving funds across multiple blockchains and services to mask the origin of the money.

In 2020, U.S. prosecutors charged two Chinese individuals with laundering over $100 million taken from a cryptocurrency exchange in 2018 by North Korean actors. The following year, the U.S. Treasury’s Office of Foreign Assets Control sanctioned two crypto traders — one based in Hong Kong and the other in China — for assisting the Democratic People’s Republic of Korea in converting stolen crypto and evading financial controls.

ZachXBT also connected Chinese actors to the laundering of proceeds from the $387.5 million Bitget hack in September. In a September 28 post, he said these actors had been openly soliciting support in public Discord servers and Telegram channels used by the services they employed. One of those operators was also implicated in laundering funds from the $292 million Kelp DAO exploit in April.

The investigation provides a rare glimpse into the intermediaries that facilitate the flow of stolen digital assets from North Korean cyber‑thefts to fiat currencies.