Korea, Japan selloffs reframe Bitcoin volatility

July 17, 2026

In partnership with

 

Reading time: 5 minutes

Mac malware pairs Telegram hijacking with crypto wallet theft

Key points:

  • New macOS malware can hijack authenticated Telegram sessions and steal crypto wallet data.

  • Attackers can attempt to decrypt wallet files or use fake Ledger and Trezor apps to capture recovery phrases.

News - A newly analyzed macOS information stealer is targeting both Telegram accounts and cryptocurrency wallets through a coordinated attack chain, according to blockchain security firm SlowMist.

The malware collects data from macOS Keychain, Safari, Apple Notes, Telegram Desktop, browser wallet extensions, and wallet databases. Its targets include Exodus, Atomic Wallet, Electrum, Wasabi, Monero, Ledger Live, Trezor Suite, and several full-node clients.

Rather than relying on one theft method, attackers can combine stolen passwords, authenticated sessions, and wallet files to pursue multiple routes into a victim’s crypto accounts.

Telegram protection stops at the device - Telegram’s two-step verification does not block this attack because the malware is not creating a fresh login.

SlowMist demonstrated that stolen Telegram Desktop session data could be restored on another Mac without a phone number, verification code, or two-step verification password. That gives attackers access through a session the victim had already authenticated.

Wallet theft does not require an instant drain - The malware can copy encrypted wallet databases and attempt to unlock them offline using passwords harvested from the infected device.

For hardware wallet users, the attack can go further. SlowMist said legitimate Ledger or Trezor applications may be replaced with fake versions that prompt users to enter their recovery phrases.

A password reset may not be enough - SlowMist advised suspected victims to terminate Telegram sessions, change Telegram security credentials, create a new recovery phrase on a clean device, and move assets to new addresses.

Once a private key or recovery phrase is exposed, changing only the wallet password does not secure the funds.

South Korea and Japan’s AI selloffs make Bitcoin look comparatively calm

Key points:

  • South Korea’s Kospi entered a bear market, while Japan’s Nikkei and Kioxia sank in an AI-led unwind.

  • Bitcoin remains near $63,000 under long-term-holder selling, yet its implied volatility is far below the Kospi’s.

News - South Korea and Japan are absorbing sharp reversals in AI-linked equities just as Bitcoin tests $63,000, creating an unusual comparison between stressed stock markets and crypto.

The Kospi has fallen nearly 25% in four weeks and entered a technical bear market. Japan’s Nikkei dropped as much as 4.4% on Friday as chip stocks sold off, while Kioxia plunged 16% in one session after a steep monthlong reversal.

South Korea’s leverage amplifies the fall - Retail enthusiasm for AI stocks, margin trading, and leveraged ETFs magnified the Kospi’s decline. Its 30-day implied volatility reached about 81%, more than twice Bitcoin’s roughly 38%.

The comparison does not make Bitcoin stable. It shows that options markets are pricing substantially greater volatility in Seoul.

Japan’s chip boom meets its bust - Kioxia had briefly surpassed Toyota in market value before the reversal. Bain Capital’s full exit, retail leverage, and concerns about the semiconductor cycle added pressure as Advantest and SoftBank also fell sharply.

Bitcoin’s weakness follows a different route - More than 65% of coins moving onto exchanges came from long-term holders realizing losses, according to Glassnode. Modest ETF inflows have not lifted the price, although analysts said leverage is not crowded and spot selling remains the main pressure.

The contrast arrives as Japan classifies crypto as financial products and South Korea brings digital assets into its state-wealth framework. Whether equity losses accelerate crypto adoption remains unproven.

The market has already priced how far the USA goes.

That's not a prediction. It's a live price updating with every match. On Kalshi, the only federally regulated prediction market exchange in the US and official regional partner of the Argentine National Team, every World Cup outcome is tradeable in real time. Who advances. Who scores first. Which match goes to penalties. You buy "Yes" or "No" shares. Earn returns if you're right. Peer-to-peer, no house, cash out anytime. Trade $10, get $10 free to start.

Trade responsibly.

Europe redraws banking as stablecoins, rates, and MiCA converge

Key points:

  • The ECB says stablecoin growth could weaken bank deposits, while its digital euro project aims to keep banks central to payments.

  • Europe is also weighing another rate increase and expanding MiCA’s licensed provider base for banks and crypto companies.

News - European policymakers are reshaping the region’s financial system across three fronts: digital money, interest rates, and regulated crypto services.

ECB Executive Board member Piero Cipollone warned that wider stablecoin adoption could erode commercial banks’ retail deposits. He also said banks are already losing payment fees and customer transaction data to mobile payment providers.

The digital euro offers banks a counterweight - Cipollone argued that a retail central bank digital currency could preserve public money while keeping banks involved in payments.

The ECB has selected 36 banks, fintechs, and payment companies for a 12-month pilot beginning in the second half of 2027. The test will precede any issuance decision, which could come as early as 2029.

Tighter rates add another pressure point - Economists expect the ECB to hold rates next week, although most surveyed by Bloomberg forecast a quarter-point September increase to 2.5%.

That outlook remains dependent on energy prices, inflation, and developments surrounding the Iran war. The Bank of Korea and Bank of Japan have also raised rates this year, extending the broader tightening trend.

Banks are entering crypto through MiCA - ESMA added 14 crypto-asset service providers to its register, lifting the total to 294 after 37 additions in the previous update.

New entrants include Ripple Payments Europe, Bison Bank, Croatia’s state-owned HPB, two German cooperative banks, and Kaiser Partner Privatbank. The slower licensing pace still shows traditional financial institutions moving deeper into Europe’s regulated crypto market.

Citadel’s $400M Crypto.com bet highlights crypto’s funding divide

Key points:

  • Citadel Securities invested $400 million in Crypto.com at a $20 billion valuation, marking the exchange’s first institutional funding round.

  • The deal stands out as crypto fundraising falls to its lowest monthly deal count since November 2020.

News - Citadel Securities has taken a $400 million stake in Crypto.com, giving the Singapore-based exchange a $20 billion valuation and its first institutional capital since launching in 2016.

Crypto.com said the funds will support expansion into tokenized securities, derivatives, and other asset classes. The deal deepens Citadel’s crypto exposure after its $200 million investment in Kraken in November 2025.

An outlier, not a funding rebound - Crypto companies completed 61 funding rounds in June, down 31.5% from May and the lowest monthly total since November 2020, according to CryptoRank.

Capital raised also fell to $1.44 billion from $3.89 billion in May. July remained subdued through mid-month, even as a few established platforms continued attracting nine-figure checks.

The announced strategy centers on tokenization - The announced expansion centers on tokenized securities and derivatives rather than direct exposure to Bitcoin.

That focus mirrors a wider push by traditional finance firms into crypto infrastructure, including stakes by Citadel in Kraken, Intercontinental Exchange in OKX, and Nasdaq in Gemini.

Scale is concentrating at the top - The investment arrives while Bitcoin is down 28% this year and the broader crypto market is valued near $2.2 trillion.

The contrast suggests institutional capital has not disappeared, but it is flowing unevenly. Large incumbent exchanges are still drawing major checks, while the wider funding market records fewer deals.

Tax Prep with Confidence

Tax season doesn't have to mean wondering if you have the right forms, second-guessing your deductions, or scrambling to pull everything together before the deadline.

With BELAY’s Tax Prep Checklist, you can start preparing for tax season with confidence.

Crypto scams uncovered

  • The second theft arrived wearing a law-firm letterhead: The FBI warned that fictitious law firms target people who have already lost money to crypto scams, sometimes citing exact details from the original theft before directing victims to fake foreign-bank platforms and demanding additional fees.

  • The fake paycheck grew only after the worker paid in: Cryptocurrency job scams recruit victims for simple online tasks, allow some early withdrawals to create trust, and then demand increasingly large crypto deposits until the account is frozen and every deposited dollar is stolen.

  • The QR code finished the robbery before the ATM did: Crypto ATM scammers stay on the phone while victims deposit cash, then send a QR code containing the scammer’s wallet address so the newly purchased cryptocurrency is transferred directly to them.

July 22-24: Build, Launch, & Own Your First App With Ai

Your industry has a problem you've been describing for years. Now you can build the fix yourself - no code, no dev team, no experience needed. Justin Burns shows you how, live, in 3 days. Free to attend.

Top 3 coins of the day

Polygon (POL)

Key points:

  • POL defended its 20 EMA and returned to the $0.085 to $0.086 resistance zone, while the entire EMA stack remained in bullish order.

  • OBV turned higher alongside 12.82M volume; $0.0825 to $0.083 is the first defense, while $0.088 to $0.09 is next if resistance breaks.

What you should know:

Polygon’s payments pivot began gaining both adoption and market traction. Polygon Labs’ planned Coinme acquisition reinforced its commercial payments focus, while wallet holders reportedly rose 78% to 245,000 and crypto-card volume climbed more than 122% to $30.5 million. Founder Sandeep Nailwal’s comment that investors still “sleep on Polygon” added a brief sentiment boost. POL rebounded 2.90% to $0.0847 after defending the 20 EMA at $0.0828, with the 20, 50, 100, and 200 EMAs arranged in bullish order. OBV turned higher to -836.52M as volume reached 12.82M. The $0.085 to $0.086 zone is the breakout test, while $0.0825 to $0.083 is the first support area.

Hyperliquid (HYPE)

Key points:

  • HYPE rebounded 2.80% from the $58.50 area, but price remained below every EMA after losing its $65 to $68 consolidation range.

  • EWO fell to -7.98, leaving $63.86 as the first repair level and $65.27 to $66.11 as the larger reversal barrier.

What you should know:

Hyperliquid’s product momentum could not prevent its chart from breaking down. The IPOP launch expanded the platform into pre-IPO perpetual markets, while trading volume reportedly rose 36% to $433 million and Hyperion DeFi committed 500,000 HYPE to institutional perpetual markets. Even so, HYPE fell beneath all four EMAs before rebounding 2.80% to $60.32 from near $58.50. The 20 EMA stood at $63.86, while the 50, 100, and 200 EMAs clustered between $65.27 and $66.11. EWO dropped to -7.98, confirming that bearish momentum remained dominant despite the bounce. The $58.50 to $59 zone is the immediate defense, while $63.86 is the first recovery test.

Cronos (CRO)

Key points:

  • CRO’s Citadel-driven surge briefly stretched toward $0.069 before sellers forced price back inside the Bollinger Bands.

  • CMF remained negative at -0.24, making $0.0602 the continuation test and $0.0566 the key stabilization level.

What you should know:

CRO’s first reaction to the funding headline proved stronger than the price it could retain. Crypto.com reportedly secured a $400 million strategic investment led by Citadel Securities at a valuation near $20 billion, while native USDC and EURC expansion strengthened Cronos’ institutional-liquidity backdrop. CRO briefly spiked toward $0.069 on exceptional volume before retreating to $0.059, leaving a pronounced upper wick. Price still held above the Bollinger midpoint at $0.0566, but CMF at -0.24 showed that capital flow continued to favor sellers despite the rebound. Volume reached 734.37K as volatility cooled from the initial burst. The upper band at $0.0602 is the continuation threshold, while $0.0565 to $0.0567 is the main stabilization zone.

How was today's newsletter?

Login or Subscribe to participate in polls.