On January 12, 2026, cybersecurity researchers detailed how the GoBruteforcer botnet compromises Linux servers used by cryptocurrency and blockchain projects through weak credentials and exposed services. The malware targets FTP, MySQL, PostgreSQL and phpMyAdmin to build a distributed network for brute-force password cracking and data theft. Investigations also found crypto-specific campaigns and blockchain reconnaissance, including scans of TRON addresses to identify funded wallets.

According to the Dubai Financial Services Authority, revised crypto rules taking effect on January 12 ban privacy coins and anonymity tools, including mixers, in or from the DIFC. The framework narrows "fiat crypto token" status to fiat-pegged, reserve-backed assets and shifts token‑listing accountability from a regulator-maintained list to licensed firms.

On 12 January 2026, the Dubai Financial Services Authority enforced a ban on privacy tokens within the Dubai International Financial Centre, covering trading, promotion, funds, and derivatives. The regulator also narrowed stablecoin rules to fiat-backed tokens only, excluding algorithmic designs such as Ethena's USDe from the stablecoin category.

On 8 January, the Financial Intelligence Unit of India said ID-only verification is insufficient, and from 12 January crypto users will face live selfie liveness tests, biometric checks, precise location capture, and penny-drop bank verification. ICOs are labeled high risk, transfers must carry sender and recipient data, and exchanges must keep records for at least five years, following ₹28 crore in fines last fiscal year.

On January 12 2026, cybersecurity researchers detailed how Chinese-speaking criminal syndicates have spent nearly a decade building pig-butchering romance scams into a commoditized, service-based industry across Southeast Asia. The report describes large compounds of forced labor, plug-and-play PBaaS toolkits, fake trading platforms, phishing apps and crimeware services like Penguin that sell stolen identities and social media accounts. These infrastructures collectively support industrial-scale online fraud and global money laundering operations.

Ahead of a parliamentary hearing next week, 68 economists warned EU lawmakers that Europe could lose control of its money without a functioning digital euro, according to an open letter. The signatories cite reliance on US payment firms in thirteen euro-area countries and flag the ECB's proposed €3,000 wallet limit as insufficient for a credible store of value.

On January 8, India's Financial Intelligence Unit issued updated guidelines that classify crypto exchanges as VDA service providers and tighten AML/KYC. Platforms must conduct live ID checks, collect PAN, IP and geolocation data, and verify bank accounts via penny-drop. Exchanges welcomed clearer compliance, while the framework mandates five-year record retention and tools to detect mixers.

On 12 January 2026 at 10:55, major asset managers were described as shifting tokenization from pilots to core market infrastructure. BlackRock’s BUIDL tokenized treasury fund reached $500 million, while Hamilton Lane has tokenized more than $2.1 billion across private equity and credit. Firms are deploying multi-chain products on Ethereum, Stellar, and Polygon, with established custody support also in place.