OKX & SlowMist Joint Announcement | Bom Malware Rampant Among Thousands of Users, Stealing Over $1.82 Million in Assets

By: blockbeats|2025/02/27 04:00:03
Share
copy
Source: OKX

OKX & SlowMist Joint Announcement | Bom Malware Rampant Among Thousands of Users, Stealing Over src=

On February 14, 2025, multiple users reported a concentrated theft of wallet assets. Through on-chain data analysis, it was determined that the theft cases all exhibited characteristics of mnemonic phrase/private key leakage. Further investigation revealed that the affected users had mostly installed and used an application called BOM. A deep dive investigation showed that this application was actually a carefully disguised fraudulent software. Malicious actors used this software to deceive users into granting authorization, through which they illegitimately obtained mnemonic phrase/private key access, enabling them to execute systematic asset transfers and concealment. As a result, the SlowMist AML team and the OKX Web3 Security team conducted an investigation and disclosure of the malicious software tactics and performed on-chain tracking analysis, aiming to provide more users with security alerts and recommendations.

1. Malicious Software Analysis (OKX)

With user consent, the OKX Web3 Security team collected the apk files of the BOM application from some users' phones for analysis. The specific details are as follows:

(A) Conclusion

Once inside the contract page, the malicious app falsely claims that it needs to run the application and deceives users into granting local file and photo album permissions.

After obtaining user authorization, the application scans in the background and collects media files from the device's album, packages them, and uploads them to the server. If the user's files or albums contain mnemonic phrases or private key-related information, malicious actors may exploit this collected information from the application to steal user wallet assets.

(B) Analysis Process

1. Initial Sample Analysis

1) Application Signature Analysis

The signature subject is non-standard and resolves to adminwkhvjv, which is a meaningless string of random characters. Normal applications typically have a meaningful letter combination as their signature.

2) Malicious Permission Analysis

In the application's AndroidManifest file, numerous permissions are registered, some of which are sensitive information permissions, including read/write local files, read media files, and access to the photo album.

2. Dynamic Analysis

Due to the backend API service being offline during the analysis, the app cannot function properly, and dynamic analysis cannot be performed at the moment.

3. Decompilation Analysis

Upon decompilation, it was found that the number of classes in the app's dex file is very low. Therefore, a code-level static analysis was conducted on these classes.

The main logic involves decrypting some files and loading the application:

A uni-app artifact file was found in the assets directory, indicating that the app was developed using the cross-platform framework UniApp:

The primary logic of an application developed under the UniApp framework lies in the artifact file app-service.js, with some key code encrypted in app-confusion.js. We primarily start the analysis from app-service.js.

1) Trigger Entry

At the entry points of various pages, the entry point for a page named "contract" was found.

The corresponding function index is 6596.

2) Device Information Initialization Reporting

Once the contract page is loaded, the onLoad() callback will invoke doContract().

Within doContract(), initUploadData() is called.

In initUploadData(), it will first check the network status and also verify if the image and video lists are empty. Finally, it will call the callback e().

The callback e() is actually getAllAndIOS().

3) Check and Request Permissions

Here, in iOS, permissions are requested first, deceiving users into granting permission with wording that the app needs to function properly. This permission request behavior is quite suspicious. As an application related to blockchain, its normal operation does not inherently require access to the photo library, making this request clearly beyond the app's legitimate operational needs.

On Android, similarly, photo library permissions are checked and requested first.

4) Collect and Read Photo Library Files

Then, in androidDoingUp(), images and videos are read and packaged.

5) Upload Photo Library Files

Finally, uploading is done in uploadBinFa(), uploadZipBinFa(), and uploadDigui(), where the upload interface path is also a randomly generated string.

The iOS process is similar; after obtaining permission, content is collected for upload using getScreeshotAndShouchang() on iOS.

6) Upload Interface

The commonUrl domain in the reported URL is sourced from the response of the /api/bf9023/c99so interface.

The domain of this interface is sourced from the local cache of the UniApp.

No code for writing to the cache was found; it may be encrypted and obfuscated and exist in app-confusion.js. The domain was observed in the application cache during a historical run.

II. On-chain Fund Analysis (SlowMist)

According to MistTrack, an on-chain tracking and anti-money laundering tool under SlowMist AML, the primary exploit address (0x49aDd3E8329f2A2f507238b0A684d03EAE205aab) has stolen funds from at least 13,000 users, with profits exceeding $1.82 million.

(https://dune.com/queries/4721460)

The address 0x49aDd3E8329f2A2f507238b0A684d03EAE205aab's first transaction occurred on February 12, 2025, with address 0x9AEf1CA082c17f9D52Aa98ca861b50c776dECC35 sending 0.001 BNB as initial funding.

Address analysis 0x9AEf1CA082c17f9D52Aa98ca861b50c776dECC35. The first transaction involving this address also occurred on February 12, 2025, with the initial funds coming from an address marked by MistTrack as "Theft - Stolen Private Key" at 0x71552085c854EeF431EE55Da5B024F9d845EC976:

Further analysis of the initial hacker address 0x49aDd3E8329f2A2f507238b0A684d03EAE205aab's fund movement:

BSC: Profits of approximately $37,000, including USDC, USDT, WBTC, and other tokens. Partial tokens are often exchanged for BNB using PancakeSwap:

The current address balance is 611 BNB and tokens worth approximately $120,000, such as USDT, DOGE, FIL.

Ethereum: Profits of approximately $280,000, mostly from ETH transferred from other chains. Then, 100 ETH was transferred to 0x7438666a4f60c4eedc471fa679a43d8660b856e0. This address also received 160 ETH from the above address 0x71552085c854EeF431EE55Da5B024F9d845EC976, for a total of 260 ETH that has not yet been transferred out.

Polygon: Profits of approximately $37,000 or $65,000, including WBTC, SAND, STG, and other tokens. Most of the tokens have been exchanged for 66,986 POL through OKX-DEX. The current balance of the hacker address is as follows:

Arbitrum: A profit of approximately $37,000, including various coins such as USDC, USDT, WBTC, with the tokens exchanged to ETH. A total of 14 ETH was cross-chain transferred to Ethereum via OKX-DEX:

Base: A profit of approximately $12,000, including coins like FLOCK, USDT, MOLLY, with the tokens exchanged to ETH. A total of 4.5 ETH was cross-chain transferred to Ethereum via OKX-DEX:

Details of other chains are not elaborated further. We also conducted a simple analysis on another hacker address provided by the victim.

The hacker address 0xcb6573E878d1510212e84a85D4f93Fd5494f6EA0 had its first transaction on February 13, 2025, with a profit of approximately $650,000 involving multiple chains. The related USDT was all cross-chain transferred to the TRON address TFW52pZ3GPPUNW847rdefZjqtTRxTCsdDx:

The address TFW52pZ3GPPUNW847rdefZjqtTRxTCsdDx received a total of 703,119.2422 USDT, with a balance of 288,169.2422 USDT. Out of this, 83,000 USDT was transferred to the address TZJiMbiqBBxDXhZXbrtyTYZjVDA2jd4eus and not further withdrawn, while the remaining 331,950 USDT was sent to an address that had interacted with Huionepay before, the address being THKqT6PybrzcxkpFBGSPyE11kemRNRmDDz.

We will continue to monitor the balances of the related addresses.

III. Security Recommendations

To help users enhance their security awareness, SlowMist's AML team and OKX's Web3 security team have compiled the following security recommendations:

· Do not download software from unknown sources (including so-called "freeloading tools" and any software from unidentified publishers).

· Do not trust software download links recommended by friends or communities; make sure to download from official channels.

· Download and install apps from legitimate sources, such as Google Play, the App Store, and various official app stores.

· Safely store your mnemonic phrase; do not use methods such as screenshots, photos, notepads, or cloud storage. The OKX Wallet mobile app has already disabled the screenshot feature on the private key and mnemonic pages.

· Physically store your mnemonic phrase by writing it on paper, using a hardware wallet, segmenting storage (splitting the mnemonic phrase/private key and storing it in different places), etc.

· Regularly change your wallet; conditionally replacing your wallet regularly helps eliminate potential security risks.

· Utilize professional on-chain tracking tools such as MistTrack (https://misttrack.io/) to monitor and analyze funds, reduce the risk of fraud or phishing events, and better protect asset security.

· Strongly recommend reading the "Blockchain Dark Forest Self-Defense Handbook" written by Cosmos, the founder of SlowMist.

Disclaimer

This content is for reference only and should not be construed as (i) investment advice or recommendation, (ii) a solicitation or offer to buy, sell, or hold digital assets, or (iii) financial, accounting, legal, or tax advice. We do not guarantee the accuracy, completeness, or usefulness of such information. Digital assets (including stablecoins and NFTs) are subject to market fluctuations, involve high risk, may depreciate, or even become worthless. You should carefully consider whether trading or holding digital assets is suitable for you based on your financial situation and risk tolerance. Consult your legal/tax/investment professional for your specific situation. Not all products are available in all regions. For more details, please refer to the OKX Terms of Service and Risk Disclosure & Disclaimer. The OKX Web3 mobile wallet and its derivative services are subject to separate terms of service. You are responsible for understanding and complying with local applicable laws and regulations.

This article is a contributed piece and does not represent the views of BlockBeats

You may also like

a16z Leads $18M Seed Round for Catena Labs, Crypto Industry Bets on Stablecoin AI Payment

Traditional finance is still stuck in a "human-to-human" model, while Catena aims to achieve "AI-to-AI" interaction.

Never Underestimate the Significance of the US Stablecoin 'Infrastructure Bill'

Original Title: "Never Underestimate the Significance of the US Stablecoin 'Genius Act'"Original Author: 0xTodd, Partner at Nothing Research


If the US stablecoin bill, the "GENIUS Act," passes smoothly this time, its significance will be tremendous. I even think it's significant enough to enter the top five in Crypto history.



Although abbreviated as the GENIUS Act, which translates directly to the Genius Act, it is actually the Guiding and Establishing National Innovation for U.S. Stablecoins, which translates to "Guiding and Establishing National Innovation for US Dollar Stablecoins."


The proposal is lengthy, with several key points summarized for everyone:


· Mandatory 1:1 Full Asset Backing: Assets include cash, demand deposits, and short-term US Treasuries. At the same time, misappropriation and rehypothecation are strictly prohibited.


· High-Frequency Disclosure: Reserve reports must be published at least monthly, introducing external audits.


· Licensing Requirement: Once the circulating market cap of the issuer's stablecoin exceeds $100 billion, it must transition into the federal regulatory system within a specified timeframe, adopting banking-grade regulation.


· Introduction of Custody: The custodian of the stablecoin and its reserve assets must be a regulated qualified financial institution.


· Clear Definition as a Payment Medium: The bill explicitly defines stablecoin as a new type of payment medium, primarily regulated by the banking regulatory system, rather than restricted by the securities or commodities regulatory system.


· Embracing Existing Stablecoins: A maximum 18-month grace period after the bill's enactment, aimed at encouraging existing stablecoin issuers (such as USDT, USDC, etc.) to promptly obtain licenses or become compliant.


After finishing the main content, let's talk about the significance of this matter with an excited heart.


Over the years, when others asked, "After working in the Crypto industry for 16 years, what application have you created?"


In the future, you can confidently tell others—Stablecoins.


First, Clearing Concerns is a Prerequisite


Some people have held opposing views. In the past, people's impression of stablecoins was that they were an opaque black box. Every few months, there would be FUD — whether Tether's assets were frozen or Circle had a significant black hole deficit.


In fact, if you think about it, Tether easily rakes in billions of dollars a year just from the interest on those underlying government bonds. Circle, slightly less, also made a $1.7 billion profit last year.


They basically made money while standing there. From a motivational standpoint, they have no malicious intentions. In fact, they are the most eager for compliance.


Now, this opaque black box will become a transparent white box.


In the past, the only complaint was that Tether's funds might have been frozen by the United States. Now, they will be directly placed into U.S. compliant custodial institutions, with high-frequency disclosures, so you can rest assured.


【No need to worry about a rug pull】 is such a huge advantage—I think especially all Crypto people understand this.


Second, Mastering the Standard is Very Important


Stablecoins were once almost on the verge of being overtaken by CBDCs. In any country, if a central bank digital currency really exists, it is highly likely not built on a blockchain, at most it is built on some internal central bank consortium chain, which to be honest, is meaningless.


When CBDCs were at their peak, that was the most dangerous time for stablecoins.


If CBDCs had become a reality back then, stablecoins today would have been relentlessly suppressed into a dark corner, and blockchain would only be able to play a minimal role.


The remaining half-dead stablecoins would even have to learn the standards of central bank digital currencies, completely relinquishing their standard-setting power.


And now, stablecoins have won (or are about to).


Instead, everyone should learn the 【Blockchain + Token】 standard.


Nowadays, many blockchains actually have no meaningful applications on top, only stablecoin transfers. For example, with Aptos, the only scenario I use Aptos for is transfers between Binance and OKX.


And now, stablecoins will be legislated, what does that mean?


That's right, blockchain will become the only standard.


In the future, every stablecoin user will be the first to learn how to use a wallet.


As an aside, I actually think Ethereum's concerted push for EIP-7702 is quite forward-thinking. While other chains are all about memes, thank you Ethereum for sticking to account abstraction.



EIP-7702 is about Account Abstraction, which can support, for example:


· Social Account Registration Wallet

· Paying GAS with Native Coin

· And more


This paves the way for future new users to heavily use stablecoins, solving the last-mile problem.


Third, Deposit Enters a New Era


Furthermore, once stablecoins receive legislative support, deposits and withdrawals will become even easier.


Let's imagine a scenario: previously, hindered by the gray nature of stablecoins, but after the bill passes, many traditional brokerages can support stablecoins themselves. The money from a US stock investor can be converted into stablecoins in minutes and instantly deposited into Coinbase. Believe it or not.



Let's imagine another scenario: if the brilliant bill smoothly passes through the House of Representatives, next, you will see:


Due to the extremely lucrative nature of this trading, existing stablecoin leaders and newly entering traditional giants will crazily start promoting their stablecoin products.


And an outsider, due to these promotions, will start using stablecoins. And then one day, after finding out that the wallet account has been created, will explore Bitcoin inside. Is mining Bitcoin difficult?


Stablecoins are a huge Trojan horse. The moment you start using stablecoins, you unwittingly step half a foot into the Crypto world.


Fourth, Conclusion


As a large reservoir for digesting US debt, although stablecoins cannot directly absorb debt, they at least provide ammunition for the US debt secondary market. These functions are quite important, and slowly, stablecoins are becoming a part of the US debt market's body. Therefore, once the US legislation is passed and experiences the benefits, there is no turning back.


And, we are also confident that stablecoins are indeed one of the great innovations in our industry. People who have used stablecoins will find it hard to return to the traditional cash-banking system.


Once the bill is passed, users can't go back. In the future, concerns are about to be resolved, standards will be mastered, and the era of large deposits seems to be on the horizon.


Original Article Link

$COIN Joins S&P 500, but Coinbase Isn't Celebrating

On May 13, S&P Dow Jones Indices announced that Coinbase would officially replace Discover Financial Services in the S&P 500 on May 19. While other companies like Block and MicroStrategy, closely tied to Bitcoin, were already part of the S&P 500, Coinbase became the first cryptocurrency exchange whose primary business is in the index. This also signifies that cryptocurrency is gradually moving from the fringes to the mainstream in the U.S.



On the day of the announcement, Coinbase's stock price surged by 23%, surpassing the $250 mark. However, just 3 days later, Coinbase was hit by two consecutive events: a hack where employees were bribed to steal customer data and a demand for a $20 million ransom, and an investigation by the U.S. Securities and Exchange Commission (SEC) into the authenticity of its claim of having over 100 million "verified users" in its securities filings and marketing materials. These two events acted as mini-bombs, and at the time of writing, Coinbase's stock had already dropped by over 7.3%.


Coincidentally, Discover Financial Services, being replaced by Coinbase, can also be considered the "Coinbase" of the previous payment era. Discover is a U.S.-based digital banking and payment services company headquartered in Illinois, founded in 1960. Its payment network, Discover Network, is the fourth largest payment network apart from Visa, Mastercard, and American Express.


In April, after the approval of the acquisition of Discover by the sixth-largest U.S. bank, Capital One, this well-established digital banking company of over 60 years smoothly handed over its S&P 500 "seat" to this emerging cryptocurrency "bank." This unexpected coincidence also portrayed the handover between the new and old eras in Coinbase's entry into the S&P 500, resembling a relay race scene. However, this relay baton also brought Coinbase's accumulated "external troubles and internal strife" to a tipping point.


Side Effects of ETFs


Over the past decade, cryptocurrency exchanges have been the most stable "profit machines." They play a role in providing liquidity to the entire industry and rely on trading fees to sustain their operations. However, with the comprehensive rollout of ETF products in the U.S. market, this profit model is facing unprecedented challenges. As the leader in the "American stack," with over 80% of its business coming from the U.S., Coinbase is most affected by this.



Starting from the approval of Bitcoin and Ethereum spot ETFs, traditional financial capital has significantly onboarded users and funds that originally belonged to exchanges in a more cost-effective, compliant, and transparent manner. The transaction fee revenue of cryptocurrency exchanges has started to decline, and this trend may further intensify in the coming months.


According to Coinbase's 2024 Q4 financial report, the platform's total trading revenue was $417 million, a 45% year-on-year decrease. The contribution of BTC and ETH's trading revenue dropped from 65% in the same period last year to less than 50%.


This decline is not a result of a decrease in market enthusiasm. In fact, since the approval of the Bitcoin ETF in January 2024, the inflow of BTC into the U.S. market has continued to reach new highs, with asset management giants like BlackRock and Fidelity rapidly expanding their management scale. Data shows that BlackRock's iShares Bitcoin ETF (IBIT) alone has surpassed $17 billion in assets under management. As of mid-May 2025, the cumulative net inflow of 11 major institutional Bitcoin spot ETFs on the market has exceeded $41.5 billion, with a total net asset value of $1214.69 billion, accounting for approximately 5.91% of the total Bitcoin market capitalization.


Chart showing the trend of net outflows for Grayscale among the 11 institutions


Institutional investors and some retail investors are shifting towards ETF products, partly due to compliance and tax considerations. On one hand, ETFs have much lower trading costs compared to cryptocurrency exchanges. While Coinbase's spot trading fee rate varies annually in a tiered manner but averages around 1.49%, for example, the management fee for IBIT ETF is only 0.25%, and the majority of ETF institution fees fluctuate around 0.15% to 0.25%.



In other words, the more rational users are, the more likely they are to move from exchanges to ETF products, especially for investors aiming for long-term holdings.


According to multiple sources, several institutions, including VanEck and Grayscale, have submitted applications to the SEC for a Solana (SOL) ETF, with some institutions also planning to submit an XRP ETF proposal. Once approved, this may trigger a new round of fund migration. According to a report submitted by Coinbase to the SEC, as of April, the platform's trading revenue from XRP and Solana accounted for 18% and 10%, nearly one-third of the platform's fee revenue.



However, the Bitcoin and Ethereum ETFs passed in 2024 also reduced the fees for these two tokens on Coinbase from 30% and 15% to 26% and 10%, respectively. If the SOL and XRP ETFs are approved, it will further undermine the core fee revenue of exchanges like Coinbase.


The expansion of ETF products is gradually weakening the financial intermediary status of cryptocurrency exchanges. From their original roles as matchmakers and clearers to now gradually becoming mere "on-ramps and off-ramps" for funds, exchanges are seeing their marginal value squeezed by ETFs.


Robinhood Takes a Stand, Traditional Brokerages Join the Fray


On May 12, 2025, SEC Chairman Paul S. Atkins gave a keynote speech at the Tokenization and Cryptocurrency Working Group roundtable. The theme of his speech revolved around "It is a new day at the SEC," where he indicated that the SEC would not approach enforcement and regulation the same way as before but would instead pave the way for cryptocurrency assets in the U.S. market.



With signs of cryptocurrency compliance such as the SEC's "NEW DAY" declaration, an increasing number of traditional brokerages are attempting to enter the cryptocurrency industry. One of the most representative cases is the well-known U.S. brokerage Robinhood, which began expanding its crypto business in 2018. By the time of its IPO in 2021, Robinhood's crypto business revenue accounted for over 50% of the company, with a significant boost from the Dogecoin "moonshot" promoted by Musk.


In Q1 2025 earnings report, Robinhood showcased strong growth, especially in revenue from cryptocurrency and options trading. Fueled by Trump's Memecoin, cryptocurrency-related revenue reached $250 million, nearly doubling year-over-year. Consequently, Robinhood Gold subscription users reached 3.5 million, a 90% increase from the previous year, with the rapid growth of Robinhood Gold providing the company with a stable source of income.



Meanwhile, RobinHood is actively pursuing acquisitions in the cryptocurrency space. In 2024, it announced a $2 billion acquisition of the long-standing European cryptocurrency exchange Bitstamp. Additionally, Canada's largest cryptocurrency CEX, WonderFi, which recently went public on the Toronto Stock Exchange, also announced its integration with RobinHood Crypto. After obtaining virtual asset licenses in the UK, Canada, Singapore, and other markets, RobinHood has taken a proactive approach in the compliant cryptocurrency trading market.



Furthermore, an increasing number of brokerage firms are exploring the same path. Futu Securities, Tiger Brokers, and others are also dipping their toes into cryptocurrency trading, with some having applied for or obtained the VA license from the Hong Kong SFC. Although their user bases are currently small, traditional brokerages have a natural advantage in user trust, regulatory licenses, and low fee structures. This could pose a threat to native cryptocurrency platforms in the future.



User Data Breach: Is Coinbase Still Secure?


In April 2025, security researchers discovered that some Coinbase user data was leaked on the dark web. While the platform initially responded by attributing it to a "technical misinformation," it still raised concerns among users regarding its security and privacy protection. Just two days before Dow Jones Indexes announced Coinbase's addition to the S&P 500 Index, on May 11, 2025, Coinbase received an email from an unknown threat actor claiming to have obtained customer account information and internal documents, demanding a $20 million ransom to keep the data private. Subsequent investigations confirmed the data breach.


Cybercriminals obtained the data by bribing overseas customer service agents and support staff, mainly in "non-U.S. regions such as India." These agents abused their access to Coinbase's internal customer support system and stole customer data. As early as February this year, blockchain detective ZachXBT revealed on X platform that between December 2024 and January 2025, Coinbase users lost over $65 million to social engineering scams, with the actual amount potentially higher.


Among the victims was a well-known figure, 67-year-old Ed Suman, an established artist in the art world for nearly two decades, having been involved in the creation of artworks such as Jeff Koons' "Balloon Dog" sculpture. Earlier this year, he fell victim to an impersonation scam involving fake Coinbase customer support, resulting in a loss of over $2 million in cryptocurrency. ZachXBT critiqued Coinbase for its inadequate handling of such scams, noting that other major exchanges have not faced similar issues and recommending Coinbase to enhance its security measures.


Amidst a series of ongoing social engineering incidents, although there has not been any impact on user assets at the technical level so far, it has raised concerns among many retail and institutional investors. Especially institutions holding massive assets on Coinbase. Just considering the U.S. BTC ETF institutions, as of mid-May 2025, they collectively hold nearly 840,000 BTC, and 75% of these are custodied by Coinbase. If we price BTC at $100,000, this amount reaches a staggering $63 billion, which is equivalent to the nominal GDP of two Iceland in the year 2024.


Visualization: ChatGPT, Source: Farside


In addition, Coinbase Custody also serves over 300 institutional clients, including hedge funds, family offices, pension funds, and endowments. As of the Q1 2025 financial report, Coinbase's total assets under management (including institutional and retail clients) reached $404 billion. The specific amount of institutional custodied assets was not explicitly disclosed in the latest report, but it should still be over 50% based on the Q4 2024 report.


Visualization: ChatGPT


Once this security barrier is breached, not only could the rate of user attrition far exceed expectations, but more importantly, institutional trust in it would undermine the foundation of its business. Therefore, after a hacking event, Coinbase's stock price plummeted significantly.


CEXs are All in Self-Rescue Mode


Facing a decline in spot trading fee revenue, Coinbase is also accelerating its transformation, attempting to find growth opportunities in derivatives and emerging assets. Coinbase acquired a stake in the options platform Deribit at the end of 2024 and announced the official launch of perpetual contract products in 2025. This acquisition fills in Coinbase's gap in options trading and its relatively small global market share.



Deribit has a strong presence in non-U.S. markets, especially in Asia and Europe. The acquisition has enabled Coinbase to gain a dominant position in bitcoin and ethereum options trading on Deribit, accounting for approximately 80% of the global options trading volume, with daily trading volume remaining above $2 billion.


Meanwhile, 80-90% of Deribit's customer base consists of institutional investors, with their professionalism and liquidity in the Bitcoin and Ethereum options market highly favored by institutions. Coinbase's compliance advantage, coupled with its already robust institutional ecosystem, makes it even more suitable. By using institutions as an entry point, it can face the squeeze from giants like Binance and OKX in the derivatives market.



Facing a similar dilemma is Kraken, which is attempting to replicate Binance Futures' model in non-U.S. markets. Since the derivatives market relies more on professional users, fee rates are relatively higher and stickiness is stronger, making it a significant source of revenue for exchanges. In the first half of 2025, Kraken completed the acquisition of TradeStation Crypto and a futures exchange, aiming to build a complete derivatives trading ecosystem to hedge the risk of declining spot transaction fee income.


With the surge of Memecoin in 2024, Binance, OKX, and various CEX platforms began massively listing small-market-cap, highly volatile tokens to activate active trading users. Due to the wealth effect and trading activity of Memecoins, Coinbase was also forced to join the battle, successively listing popular tokens from the Solana ecosystem such as BOOK OF MEME and Dogwifhat. Although these coins are controversial, they are frequently traded, with fee rates several times higher than mainstream coins, serving as a "blood-boosting" method for spot trading.


However, due to its status as a publicly traded company, this practice is a riskier endeavor for Coinbase. Even in the current crypto-friendly environment, the SEC is still investigating whether tokens like SOL, ADA, and SAND constitute securities.


In addition to the forced transformation strategies carried out by the aforementioned CEXs, they are also starting to lay out RWAs and the most talked-about stablecoin payment fields, such as the PYUSD launched through a collaboration between Coinbase and Paypal, Coinbase's support for the Euro stablecoin EURC by Circle that complies with EU MiCA regulatory requirements, or the USD1 launched through a collaboration between Binance and WIFL. In the increasingly crowded trading field, many CEXs have shifted their focus from just the trading market to the application field.


The golden age of transaction fees has quietly ended, and the second half of the crypto exchange platform game has silently begun.


Arthur Hayes: Why I'm Betting on ETH While the Market Is Obsessed with SOL

"I personally have also allocated 20% to gold, expecting the price of gold to potentially rise to $10,000-20,000 by the end of this market cycle."

Key Market Insights for May 16th, how much did you miss out on?

1. On-chain Flows: $111.3M inflow to Ethereum this week; $237.6M outflow from Berachain 2. Largest Price Swings: $ETHFI, $NEIRO 3. Top News: Data: Solana Network's revenue reached $7.9M on the 13th, surpassing the sum of all other L1 and L2 chains

CryptoPunks Changes Hands Twice, Did the Originator of NFTs Finally Find Its "Forever Home" This Time?

The original NFT pioneer CryptoPunks has once again officially changed ownership after being sold to the Bored Ape Yacht Club (BAYC) developer Yuga Labs.

Popular coins

Latest Crypto News

Read more