Judge Strikes Down ‘Dealer Rule’ Change

Every week, ISMG rounds up the latest cybersecurity news pertaining to digital assets. This week’s stories include a U.S. court striking down financial regulators’ attempts to expand the definition of a “dealer,” a malicious Python crypto library update stealing credentials, drug cartels using Tether to launder illicit profits, regulators excluding crypto from federal oversight of digital payment apps, Uniswap offering a large bug bounty, and Meta targeting accounts running pig butchering scams.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

A U.S. District Court judge has struck down a controversial U.S. Securities and Exchange Commission rule that expanded the definition of what constitutes a “dealer.”

After hearing oral arguments on Nov. 14, Judge Reed O’Connor of the Northern District of Texas on Nov. 21 ruled that the expanded “Dealer Rule” definition deviated from the Securities Exchange Act of 1934.

The rule changes dates from February. After a 3-2 vote by commissioners, the SEC had expanded the definition of dealers to include any entity that engages in trading activities that could have an impact on market liquidity.

Multiple crypto groups, including the Blockchain Association, opposed the change, arguing it unfairly targeted digital asset providers by mandating them to comply with securities laws and register with the SEC.

Decentralized finance operators also argued they would face serious compliance challenges due to what they said was the rule’s vague applicability. In particular, plaintiffs argued that the rule change was “so broad that it could sweep in traders and other participants in DeFi protocols, despite the fact that these markets innovated to operate without the need for dealer intermediation.”

The ruling follows SEC Chair Gary Gensler last week announcing he will depart the agency on Jan. 20. Many crypto watchers expect President-elect Donald Trump’s administration to loosen existing approaches to regulating digital assets.

Security researchers are warning that a malicious update to the PyPI package aiocpa, which is a widely used library for synchronous and asynchronous Crypto Pay API operations, has been updated with malicious code.

The Python Package Index – PyPI for short – is the official third-party package repository for the Python programming language.

After being alerted to the malware – thanks to Karlo Zanki, a security researcher at ReversingLabs – “we found that the maintainer was injecting obfuscated code that will exfiltrate credentials to a specific Telegram bot,” said Mike Fiedler, a PyPI safety and security engineer at Python Software Foundation, in a Monday blog post. “The credentials include tokens, API servers and other cryptopay-related data, and it is unknown to PyPI security whether these have been used in any manner.”

The malicious code first appeared in aiocpa version 0.1.13, released via PyPI on Nov. 20, and is also present in version 0.1.14, released later the same day. “This attack appears to be in the style of creating what appears to be a useful software, releasing it to the public, seeing some adoption of use and including malicious behaviors later,” Fiedler said. “This is a relatively rare occurrence, which is why it’s notable.”

PyPI has removed the project from its offerings and noted that the GitHub source repository’s version of the package appears to remain malware-free.

“If you have installed any versions of aiocpa, audit your usage of the library and consider alternatives,” Fiedler said. “This may also appear as cryptopay on disk as that’s the internal name of this particular module – which is not the same as the PyPI package cryptopay – a completely different package.”

The U.S. Consumer Financial Protection Bureau has finalized a rule granting the agency supervisory authority over large, nonbank companies but explicitly excluded cryptocurrency transactions.

The new rule, aimed at entities such as digital wallet and payment app providers handling over 50 million transactions annually, focuses solely on U.S. dollar-denominated transactions. The CFPB clarified that its “larger participant” definition excludes digital assets such as Bitcoin and stablecoins, thus narrowing its scope to focus on traditional financial transactions. This exclusion addresses concerns from the crypto industry and Republican lawmakers, who argued the proposed rule’s impact on digital assets was unclear.

A money laundering network allegedly linked to cocaine trafficking in the U.S., as well as to Mexican and Colombian cartels, has funneled tens of millions of dollars through front businesses, cash handoffs and large cryptocurrency transfers, reported 404 Media, citing its review of recently unsealed court records.

The court documents detail how drug trafficking operations have increasingly embraced cryptocurrencies such as Tether to quickly move money across international borders. In some cases, this includes Tether – known to be tied to illicit profits earned from selling drugs – getting purchased at discounted rates in Mexico and then sold in Columbia via currency exchanges, over-the-counter and peer-to-peer transactions.

Uniswap Labs has announced a bug bounty program, offering up to $15.5 million for identifying critical vulnerabilities in its v4 core contracts. The initiative, which it claims is the “largest bug bounty in history,” aims to bolster the security of the decentralized exchange’s ecosystem. The program, hosted on the Cantina platform, covers all deployed Uniswap contracts and specific undeployed v4-core contracts. The bounty will be extended to other Uniswap smart contracts if researchers discover vulnerabilities that endanger user funds.

Meta said that so far this year, its Facebook social media platform has taken down over 2 million accounts tied to various scams, including pig butchering.

According to blockchain analytics platform Chainalysis, pig butchering refers to tricking victims “into signing a malicious blockchain transaction that gives the scammer’s address approval to spend specific tokens inside the victim’s wallet, allowing the scammer to then drain the victim’s address of those tokens at will.”

Meta said the accounts it removed largely originated in countries such as Myanmar, Laos, the Philippines, Cambodia and the UAE. Meta said Cambodia is notorious for running “scam slave” operations that involve luring victims with fake job offers, then coercing them, under threat of violence, into executing online scams at the criminals’ behest.