Apple discontinued its AirPort Wi-Fi routers in 2018, and it's not surprising given that wireless networking had become a commodity years earlier. Why buy a router when your internet provider's included Wi-Fi is often good enough, and specialists like Eero and Netgear can sometimes offer more for your money?
Welcome back, aspiring cyberwarriors!
Part of our work involves supporting red team engagements. We review completed tests, size up the risk tied to each vulnerability and build out recommendations for shoring up the infrastructure. This time around, we wanted to pull back the curtain on something special. It’s ATM security.
This article is written to help with security assessments on ATMs, showing possible vulnerabilities you may find. It covers many things, from running malware bought off a forum, to an insider on the bank’s payroll, to a service technician who understands the machine’s internals and has been handed broad access to the equipment. We also look at whether a hacker could get into the bank’s broader network simply because the perimeter wasn’t locked down well enough.
Nothing here is meant as a tutorial. We’re documenting weaknesses hackers could exploit so that defenders know what to fix, not handing anyone a blueprint. We take no responsibility for how this information is used.
With that out of the way, let’s start with where ATMs came from.
London got the world’s first working ATM on June 27, 1967. It was primitive by today’s standards, incapable of checking a balance, which is exactly why withdrawals topped out at 10 pounds, and it dispensed cash only against special vouchers rather than reading a card.
Nearly six decades later, ATMs look nothing like those early cash dispensers. Now they are multifunctional devices, but the hackers never stopped circling. Part of the appeal is obvious. An ATM sits on a pile of cash and offers quick access to it, and there are simply too many machines scattered across too many places to guard them all closely. A lot of them sit in isolated, low traffic spots that run unattended around the clock, think gas stations. That has shaped decades of security investment, most of it aimed at physical hardening. Today’s units can weigh over half a ton and come loaded with sensors tracking position, internal temperature, and whether a compartment has been pried open.
Here’s the catch, though. The safe holding the cash is genuinely hard to crack, but the compartment housing the control electronics is a different story, and in our assessment, it remains poorly defended. That gap opens the door to logical attacks, ones that skip the crowbar entirely and go after the software instead, and that category has been gaining ground fast.
Cisco Talos has tracked a steady climb in new ATM malware variants since 2009. The raw sample count still looks small next to other malware families, but don’t let that fool you. Europe alone saw logical attacks on ATMs jump 269% in 2020 versus the year prior, and the average payout per incident ballooned nearly a thousandfold across that same window, climbing from roughly a thousand euros to well over a million.
What changed the game was availability. ATM malware used to be a rare, closely guarded tool. Once it started circulating more freely on underground markets, prices fell and so did the skill required to use it. Cutlet Maker, which surfaced in 2017, is a good illustration. It came bundled with a Russian language manual complete with troubleshooting notes for running it against different ATM models.
Fast forward to 2024, and vendors on those same markets were offering ATM malware through subscription pricing, monthly plans included.
Logical attacks have always had one real weakness. They take skill and patience to pull off. That’s why cheap, well documented malware kits have had such an outsized impact on the trend. Their upside for hackers is just as real. They’re far quieter than smashing a machine open, and they often let the same person come back to a compromised ATM again and again. Manufacturers have started fighting back on the hardware side too, with tamper protected cassettes that flood the cash inside with indelible ink the moment someone tries to force them open, ruining the bills instantly.
The numbers tell their own story. ATM related crime climbed 600% between 2019 and 2022, with 165% of that increase packed into 2021 and 2022 alone. Physical break ins, which have always driven the bulk of ATM crime, contributed alongside the rise in logical attacks. Germany had 496 ATM explosions recorded in 2022, a record for the country. Zoom out globally, and incidents of that kind blew past 18,000 in 2023.
Losses have kept pace. Banks worldwide absorbed $2.4 billion in direct losses from ATM fraud by the close of 2023. Europe’s share came to 173 million euros, with 67 million of that tied specifically to skimming. The United States handles just 25.29% of global transaction volume yet accounts for 42.32% of global losses. Skimming remains a big part of why, showing up in 45% of all ATM fraud cases in 2023 and costing North America over $900 million, with more than 315,000 cards compromised across at least 3,000 financial institutions.
None of this is happening in a vacuum. The market for ATM protection has grown right alongside the threat. Still, priorities inside most banks remain lopsided. Physical security tends to get the lion’s share of attention, while the operating system, drivers, and control software logic running underneath often get treated as an afterthought. That imbalance carries real consequences. A 2022 RTM Group study found that hackers could breach an ATM’s housing without setting off an alarm in one out of every two attempts, giving them free rein to tamper with the equipment inside.
Making sense of how these attacks work starts with understanding what happens inside the machine during an ordinary transaction. We’ll walk through that process using one representative configuration, illustrated in the diagram below.
The diagram reflects one specific setup we’re using for illustration, not a universal default, since real world configurations vary by device.
From where the customer stands, using an ATM is simple. They need to present a card and pick a transaction. That wasn’t always the whole story. Inserting a physical card into a reader used to be the only entry point, and that reliance on the magnetic stripe made skimming and shimming, techniques aimed at stealing card data to produce counterfeit copies, a persistent problem for years.
Contactless cards changed the entry point itself. NFC readers now sit alongside traditional card slots on most machines.
A PIN code layers on additional protection against someone using a stolen card. Entry happens through an encrypting PIN pad, a combination of physical keypad and cryptographic module that ensures the PIN never travels or gets stored anywhere in plain text. Verification of the resulting encrypted PIN block happens back at the processing center.
Once identity checks clear, you can withdraw cash, check your balance, transfer funds, and so forth. There’s a full computer running inside the housing, but customers never get anywhere near it directly. Every interaction they have flows through a single banking application running in kiosk mode, locked to full screen.
That computer we just mentioned lives inside what’s called the service zone, and this section covers what happens there, setting the cash handling hardware aside for the moment. Physically, the service zone is protected by a thin door and a basic lock. Machines from the same product line frequently share an identical key too, one that’s often available for purchase online with minimal effort.
Beyond the system unit itself, the service zone also houses the ATM’s networking equipment and its wired connections to the card reader, contactless reader, PIN pad, and dispenser, typically running over USB, Ethernet, PCI, or COM interfaces depending on the device.
Windows powers most of these systems, historically through Windows Embedded and increasingly through Windows IoT, a Windows 10 variant built for embedded use.
The kiosk application isn’t the only thing running on that OS. Alongside it sits the ATM’s control software plus a handful of security tools. That can be antivirus protection, Windows AppLocker that keeps unauthorized programs from executing, and a VPN client that maintains a secure tunnel back to the bank’s internal network.
Control software is arguably the most important piece at this layer. Core responsibilities for the control software boil down to managing peripherals and communicating with the processing center, though specific implementations often add more on top of that. Some bundle in software for a monitoring server, letting technicians manage an entire network of self service machines remotely. Others are built in a supervisor mode meant purely for technical staff, offering quick access to diagnostic tools through a hidden menu to simplify physical maintenance visits.
Selecting a transaction sets off a verification process handled entirely by the processing center, a server living on the bank’s internal network. That server confirms the card data is legitimate, checks the PIN again before letting the transaction through, rules out any restrictions on the account, and verifies there’s enough balance to cover the request.
Everything exchanged between the ATM and the processing center travels encrypted, usually through a VPN tunnel, protecting against interception or tampering along the way. NDC and DDC are the most common messaging protocols in this exchange, functioning as something of an informal industry standard even before multi-vendor control software became widespread. ISO 8583 and its various offshoots see heavy use as well.
The processing center isn’t the only thing an ATM talks to. Many machines also maintain a connection to a monitoring server used for remote management, health checks, and pushing updates, and unlike the processing center link, this channel frequently runs without any encryption at all.
Once the processing center signs off, the control software hands things over to the dispenser for a withdrawal, or the deposit module if cash is going in. These components typically sit inside the most fortified section of the ATM, the safe zone, built from tougher materials and secured with its own dedicated key separate from the service zone.
The dispenser counts out the required banknotes from the ATM’s cassettes, moves them into position at the dispensing tray, then opens the shutter, the physical flap that blocks access to the cash until it’s ready. Data moving between the control software and the dispenser can be encrypted, and both sides authenticate one another before any exchange begins, a safeguard against device spoofing. All of that encryption and authentication logic lives directly in the dispenser’s own firmware.
Deposits work differently. Incoming banknotes pass through a validator that checks their authenticity.
With the mechanics of an ATM covered, we can turn to the threats themselves. Every attack against these machines falls into one of two broad camps, physical or logical, depending on what the hacker is going after and how they approach it.
Physical attacks go straight after the machine or its components, aiming to extract cash or knock the device out of normal operation without touching a line of code. These predate targeted malware by decades and don’t require much specialized skill. Some don’t even target the machine itself, focusing instead on the people standing in front of it.
Logical attacks operate on a different level entirely. They demand genuine technical skill and preparation, built around exploiting weaknesses in the ATM’s software and network layers. They draw less public attention than physical attacks despite posing a bigger threat to banks, largely because they’re quieter and let a hacker return to the same compromised machine to cash in more than once.
System attacks go after functionality or logic running at the ATM’s OS layer, typically aiming to extract cash or sidestep security controls outright. Black box attacks deserve special attention, where a hacker skips gaining OS access altogether and instead wires their own device directly into the dispenser to control it externally. The same technique can target other peripherals, like the banknote validator.
Network attacks aim at the ATM’s networking components instead, with hackers looking to intercept, forge, or otherwise abuse data in transit, or to seize remote control of the machine. With weak enough safeguards in place, a hacker can forge the responses coming back to the ATM and push through a cash withdrawal even after the processing center rejected it.
Not every attack in this framework ends with cash in hand. A hacker might, say, work to gain remote network access first, then pivot into an OS layer attack from there.
We have seen cases where compromising a single ATM meant compromising the entire bank because there was no network segmentation in place. Conversely, gaining access to the bank’s internal network could provide a path to ATMs and other critical systems connected to it. Credential reuse and a lack of understanding of Active Directory security can lead to devastating consequences in environments like these.
ATMs have evolved from simple cash dispensers into complex and networked systems. Their security has evolved unevenly alongside them. Physical hardening has made the cash safe itself genuinely difficult to crack, but the service zone housing the control electronics remains comparatively exposed, and that gap has fueled a steady rise in logical attacks. These attacks demand more skill than a physical break-in, but they’re increasingly accessible because of well-documented malware kits.
Cybersecurity is a vast field, and we offer courses covering a wide range of topics, including Active Directory Hacking, Wi-Fi Hacking, Web Application Hacking, SCADA Security, and much more. Our course library is constantly growing as we continue to add new training, all of which is available through our Member Gold plan. If you want unlimited access to our entire training library, including our most advanced courses, consider upgrading to Subscriber Pro.
The post Pentesting: A Look at ATM Security first appeared on Hackers Arise.
Samsung Galaxy Watch AGEs Index offers blood sugar-related health insight without a CGM. Learn how it works, what it tracks, and who may benefit from using it.
The post Samsung Galaxy Watch Helps Track Blood Sugar Health Without a CGM appeared first on TechRepublic.
Samsung Galaxy Watch AGEs Index offers blood sugar-related health insight without a CGM. Learn how it works, what it tracks, and who may benefit from using it.
The post Samsung Galaxy Watch Helps Track Blood Sugar Health Without a CGM appeared first on TechRepublic.
Mesh Wi-Fi is supposed to fix dead zones without filling your home with Ethernet cables. After all, Ethernet is fantastic, but only if you can easily run the cable from place A to place B, and preferably without it becoming an eyesore.
Welcome back, aspiring cyberwarriors!
Lately, we’ve covered several tools you can use with your laptop to track nearby devices and people. While they’re useful, their effectiveness depends on the strength of your Bluetooth adapter, and, of course, you need to have your laptop with you.
This time, we’re doing things differently. We want to show you a device that can automatically monitor nearby devices for extended periods, anywhere you choose to place it, and as often as you want. It doesn’t rely solely on Bluetooth, as it also uses Wi-Fi, which is far more likely to be enabled, increasing the chances of detecting someone in your area.
Paxcounter is an open-source firmware project that takes a cheap little ESP32 development board and turns it into a sensor that can count people. Almost every smartphone in the world is constantly sending out small Wi-Fi signals, called probe requests, and Bluetooth signals too, even when the phone is not connected to anything. Paxcounter listens for these signals in the air. It counts how many different devices it hears during each scan, and from that, it can tell you a real time estimate of how many people are nearby.
The project started out as a simple way to measure how many passengers or pedestrians pass through a certain spot. But over time, it grew into something much bigger. Now it works as a general purpose IoT platform, built on hardware that usually costs somewhere between $10 and $30. Besides its main job of counting Wi-Fi and Bluetooth devices, a Paxcounter can also read environmental sensors, track its GPS position, keep accurate time, and send all of that data out through LoRaWAN, MQTT, a local serial connection, or straight onto an SD card.
The way Paxcounter counts people is simple, but it was clearly built with privacy in mind from the very start. Every scan cycle, which lasts 60 seconds by default, the device switches its Wi-Fi and Bluetooth radios into scanning mode and listens for probe requests and advertisement packets coming from nearby devices. Each of these packets carries a MAC address. Paxcounter takes just the last two bytes of that address and turns them into a short, temporary ID. This ID is only used to check for duplicates during that one scan cycle. Once the cycle ends, the count of unique IDs gets sent out, and the whole list is wiped from memory. The firmware also does not try to fingerprint any device. It never tries to figure out a phone’s brand, its operating system, or who owns it. All it wants to know is whether that device has already been counted in the current window.
This scan and clear cycle just keeps repeating, either nonstop or on a schedule if deep sleep power saving is turned on. The results, which include the Wi-Fi count, the Bluetooth count, and sometimes live sensor readings too, get packed into a small payload and sent out through whatever channel the device is set up to use. One thing worth knowing is that Wi-Fi and Bluetooth scanning actually share the same 2.4 GHz radio hardware on the ESP32. So running both scans at the same time slightly lowers the accuracy of each one. Because of that, the project’s own advice is to split Wi-Fi only counting and Bluetooth only counting across two separate devices whenever the best possible accuracy is needed for both.
Paxcounter comes with a hardware abstraction layer and its own pin mapping files for dozens of ESP32 and ESP32-S3 boards. These come from well known manufacturers like LILYGO and TTGO, Heltec, Pycom, WeMos, M5Stack, and Adafruit, and there is also a generic template ready for boards that are not officially supported yet. LILYGO even sells a ready-made board called Paxcounter LoRa, built specifically to run this firmware.
Depending on which board you pick, your device can end up supporting a LoRaWAN radio for sending data over long distances while using very little power, an OLED status screen, or a single color, RGB, or larger LED matrix light to show status. It can also support a physical button for flipping through display pages or sending an alarm message, battery voltage monitoring, GPS positioning, a real time clock chip along with IF482 or DCF77 time telegram output, and even an SD card slot for logging data locally when there is no network around.
Because the whole system was designed to be truly portable, the documentation goes into real detail about power draw, which usually sits somewhere between 450 and 1000 milliwatts depending on how the device is set up. It also makes good use of the ESP32’s deep sleep mode, so a device can keep running for a long stretch of time on just one 18650 lithium ion battery cell. Members of the community have already shared several 3D printable enclosure designs on Thingiverse for the more popular boards.
Paxcounter is built using PlatformIO instead of the plain Arduino IDE. This choice lets it work smoothly with editors like Visual Studio Code, Atom, or Eclipse, and it gives the project reproducible, script driven builds. In fact, the repository runs an automated PlatformIO build check every single time the code changes, using GitHub Actions, and there is even a CodeFactor badge that keeps an eye on ongoing code quality.
The configuration is intentionally spread across a handful of different files instead of being crammed into just one. This keeps board specific settings, behavioral settings, and personal settings nicely separated from each other. The platformio.ini file is where you select which board’s hardware profile you want to compile against. The paxcounter.conf file handles behavioral settings, things like how long a scan cycle lasts, sleep timing, and payload options. The shared lmic_config.h file sets the LoRaWAN region and frequency plan, so it matches the rules where you live. The shared loraconf.h file holds the device’s LoRaWAN join credentials, and the project recommends using OTAA rather than ABP for this. And the shared ota.conf file stores the Wi-Fi credentials the device uses for over the air firmware updates.
You can upload firmware the traditional way, over USB, or once a device has joined a LoRaWAN network, you can push updates over the air instead. A remote command tells the board to connect to Wi-Fi, check a hosted repository called PAX.express for a newer build, and then download and flash it automatically. If anything goes wrong during that process, it will roll back to the previous version on its own. Devices can also be set up to open a small local web based bootstrap menu right when they power on, which lets you upload a firmware file manually, even from a phone in tethering mode, without needing PlatformIO installed on site.
Beyond just picking a board, Paxcounter gives you a long list of settings you can tune to fit your needs. It can log environmental data from sensors like the Bosch BMP180, BME280, BMP280, or BME680, read a Nova SDS011 particulate matter sensor to track dust in the air, and keep accurate time using either a DS3231 real time clock or a connected GPS module.
On boards that come with an OLED display, Paxcounter shows live status information you can cycle through with a short press of the button. This includes the current pax count, meaning the people count, a histogram of recent activity, GPS status, environmental sensor readings, and the time of day.
A long press of that same button sends an alarm message out over the network instead, which is a simple way to flag a problem from out in the field without needing any other kind of interface. Even on boards that do not have a display at all, a status LED still tells you what the device is doing through its blink pattern. You get a brief flash whenever a new Wi-Fi or Bluetooth device is spotted, a quick blink while the device is joining the LoRaWAN network, a short blink during data transmission, and a slow, long blink if there is a LoRaWAN stack error. Boards that have an RGB LED get a color coded version of these same signals.
Once a Paxcounter has counted the people nearby and packed everything into a message, that data has to go somewhere so you can actually see it. How that happens depends on which output the device is using, and the good news is you can turn on more than one at the same time. If you are using LoRaWAN, which is the most common setup, the device does not send the data straight to you. Instead, a nearby LoRaWAN gateway picks up the signal first and forwards it on to a network server, usually The Things Stack. There is a small decoder script included with the project, and its job is to take that raw message and turn it into numbers you can actually read, something like a pax count of 14. From there, The Things Stack can pass the data along to your own app or dashboard using MQTT or a webhook, or you can simply watch it come in live through the built in console.
If a board does not have LoRa hardware built in, it can just skip the gateway completely and send that same kind of data straight to an MQTT service over Wi-Fi instead. You can also connect the device to a computer using a USB cable and read the numbers directly from a serial connection. This is a simple way to test things out without needing to set up a network at all. If SD card logging is turned on, everything also gets saved locally as a CSV file, so you can pull the card out later and open it up in a spreadsheet. This comes in handy in places where there is no network coverage to rely on.
Because a single Paxcounter device is cheap to build and can be left running unattended for a long time, you will find it popping up in a pretty wide range of places. Retailers and shopping centers use it to measure foot traffic without needing to install cameras. Event organizers use it to watch how crowds move around a venue in real time. Pentesters can get a passive read on how many Wi-Fi and Bluetooth devices are active in a building, or to notice unexpected devices showing up where they shouldn’t, all without needing camera access or network credentials.
Since Paxcounter’s whole job involves listening to wireless traffic, its documentation is unusually upfront about the legal side of things. It points out that sniffing Wi-Fi and Bluetooth MAC addresses may be regulated or restricted depending on where you live, and it links to specific starting references for the US, the UK, the Netherlands and the EU, and Germany. It also makes clear that the legal responsibility for how a device is built and deployed falls on the person doing it, especially for public deployments where the results might get published somewhere. On the technical side of privacy, the project’s own design actually holds up pretty well against that legal backdrop. Identifiers are only ever built from the last two bytes of a scanned MAC address, they are kept in memory just for the length of one scan cycle, and then they are discarded completely. No MAC addresses or identifiers are ever sent out over the network, and the firmware does not do any extra tracking or fingerprinting of the devices it scans.
What really makes Paxcounter stand out is not any single feature on its own. It is the whole combination working together. One piece of open source firmware supports dozens of cheap boards, runs for a long time on a small battery, counts people without saving anything identifying about them, doubles as a general environmental sensor node, speaks LoRaWAN, MQTT, serial, and SD card all at once, and can be fully reconfigured from a distance once it is out in the field. The full source code, the complete board list, and all the documentation are available on GitHub.
If you enjoy experimenting with frequencies and trying new things, we recommend signing up for our SDR for Hackers training. With Master OTW, you’ll learn how to use your computer and inexpensive SDR hardware to explore and hack a wide range of radio signals.
The post SDR (Signals Intelligence) for Hackers: Tracking People with ESP32-Paxcounter first appeared on Hackers Arise.
I've spent a whole lot of money on networking gear over the years, but time and time again, it's some of my cheapest purchases that keep surprising me (in a good way). One of the first was my USB-to-Ethernet adapter, and now, I'll tell you a bit more about my second favorite: a five-port unmanaged gigabit switch.
Pi-hole is one of the simplest and most useful things you can set up on your home network. It acts as a DNS sinkhole that blocks requests to domains associated with known ad servers or trackers. This gives you a far better browsing experience, but if you're only running a single instance of Pi-hole, things can go wrong.
AI can act, but cannot bear responsibility
An AI agent may select a counterparty, negotiate terms, interact with a smart contract and authorise payment. Yet it is not generally recognised as a legal person, therefore its outputs need to be attributed to a human being or organisation. The UNCITRAL Model Law on Automated Contracting, adopted in 2024, supports contracts formed or performed through automated systems, including AI and machine-to-machine transactions. It establishes rules for attributing automated outputs and addressing unexpected outcomes without requiring the system to possess legal personality. And the emerging direction is clear: autonomous execution does not remove human or corporate accountability.
Rome’s architecture of delegated commerce
Roman law distinguished between people who were legally independent (“sui iuris”) and those subject to another’s authority (“alieni iuris”). The “paterfamilias” was the legally independent head of the household and principal holder of its property. He was not a ‘beneficial owner’ in the modern legal sense but can be compared cautiously with a principal asset owner, trustee, company or family office. Nevertheless, commerce required others to manage farms, ships and businesses and so the peculium was a fund placed under another person’s practical administration whilst remaining connected to the principal. The Roman jurist Gaius, Institutes, Book IV, sections 69 to 74, explained that liability depended on the authority granted; where the principal expressly ordered a transaction or appointed someone to operate a business or ship, liability could extend beyond the peculium. In other circumstances, recovery might be limited by reference to that fund. Justinian’s Institutes, Book IV, Title VII later restated this graduated approach and, in today’s climate, the resulting lesson is clear:
The greater the authority given to an AI agent, the greater the potential exposure of the principal behind it.
Four questions for AI transactions
In the case of wallets, a separate wallet does not itself determine authority or liability; asset segregation, attribution and recourse remain distinct questions.
What modern cases tell us
In the case of Quoine Pte Ltd v B2C2 Ltd, algorithms entered cryptocurrency trades after a platform failure activated a fallback price. The Singapore Court of Appeal treated the deterministic programs as mechanisms selected by their human operators, rather than inventing a separate legal mind for the software. The case suggests that using an automated system does not necessarily allow its deployer to disown a resulting contract, with these limits of unchecked automation having been exposed by US global financial services firm, Knight Capital. In 2012, faulty software sent more than four million erroneous orders in forty-five minutes, producing losses exceeding $460 million. Unsurprisingly, the SEC found inadequate safeguards, testing and supervisory controls and imposed a $12 million penalty. The lesson is that an AI peculium needs more than a capped wallet — it requires transaction limits, cumulative exposure controls, approved counterparties, price tolerances and an effective suspension mechanism. Another example can be seen in the case of Moffatt v Air Canada, where a tribunal held the airline responsible after its chatbot gave a customer inaccurate information about bereavement fares. These decisions are not universally binding but illustrates that a business cannot assume its AI interface is legally separate from the organisation deploying it. Meanwhile, the Ooki DAO litigation has provided a related warning — a US court held that a decentralised organisation could be sued as an unincorporated association and treated as a person under the Commodity Exchange Act. Similarly, the SEC’s 2017 DAO Report emphasised that regulatory treatment depends on economic reality, not technological terminology. A wallet, smart contract, DAO or SPV may segregate operations but it cannot automatically override securities law, sanctions obligations, consumer protection or fiduciary duties.
Why England and Wales could lead
The Law Commission has concluded that the law of England and Wales can generally support smart legal contracts without wholesale statutory reform. It also identified areas requiring further attention, including deeds, jurisdiction, interpretation and remedies. The Property (Digital Assets etc) Act 2025 has further confirmed that digital or electronic assets are not prevented from being objects of personal property rights merely because they fall outside the traditional categories of things in possession and things in action. That improves certainty over digital property but it does not determine who is responsible when an AI transfers it. The commercial opportunity is to combine existing contract, property, trust, company and financial-services law with a technically enforceable AI mandate.
Building a modern peculium protocol
A modern AI peculium should be a legal and technical control framework where it would identify the principal and define the AI’s objectives, permitted assets, counterparties, jurisdictions and transaction types in a digitally signed mandate. Capital could be placed in a segregated wallet or account and smart-contract permissions would impose per-transaction and cumulative limits. Borrowing, pledging assets, using an unapproved protocol or exceeding a threshold would require human authorisation and instructions, data sources, decisions and transactions would be logged so the agent’s conduct could be reconstructed. Lawyers, trustees, directors, compliance officers or regulated custodians could validate authority, approve exceptional actions, preserve evidence and activate emergency suspension and insurance could then be priced against a measurable mandate and maximum exposure. Furthermore, ring-fencing would still have limits as it could not automatically exclude claims arising from fraud, negligence, sanctions breaches, regulatory violations, fiduciary misconduct or express authorisation by the principal. This all echoes Rome where liability depended not only on the assets allocated, but also on what was ordered, who benefited and how much authority had been granted.
The EU AI Act requires proportionate human oversight for high-risk systems, including the ability for authorised people to intervene or stop systems that are not operating as intended. The UK’s principles-based framework emphasises safety, transparency, accountability, governance and redress; both approaches point toward controlled autonomy rather than artificial personhood.
Autonomy without unaccountability
Roman law did not solve AI governance two thousand years in advance. It did, however, recognise that commerce could be delegated without leaving authority and liability undefined. AI agents do not need fictional personhood to contract and move value — they need intelligible mandates, restricted access to assets, transparent records, effective human control and credible recourse. Jurisdictions that build this architecture first could provide the trusted infrastructure through which autonomous commerce, machine-to-machine payments and AI-managed wealth operate at scale. Rome’s enduring lesson is that delegation becomes commercially useful only when authority, assets and accountability have clearly defined boundaries.
Rome’s 2000-year-old answer to AI liability: give the agent a budget, not legal personhood was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.
Stuffed braided bread is a soft, and delicious homemade bread filled with a spicy and flavourful vegetable stuffing. It has a beautiful braided pattern and is perfect for breakfast, evening snacks, dinner or to serve at parties. You can enjoy it warm with mayonnaise, tomato ketchup. Stuffed Braided Bread I wanted to make a stuffed...
The post Stuffed Braided Bread Recipe appeared first on Yummy Tummy.
Reference: GlobeNewswire
Anchorage Digital has launched native TRX staking for institutional clients, giving investors a way to earn TRON network rewards directly from a regulated custody environment.
The service allows institutions holding TRX with Anchorage to participate in staking without moving assets out of custody. That detail matters because institutional investors often cannot interact with crypto networks the same way retail users do. They need custody controls, reporting, security processes, and compliance procedures before they can access staking yield.
For TRON, the integration adds another institutional layer to a network already known for high stablecoin transfer activity. For Anchorage, it expands the range of supported staking products inside its custody platform.
The move is not about guaranteed yield. Staking rewards depend on network conditions, validator performance, and other variables. But it does show that institutional staking access continues to broaden beyond Ethereum and Solana.
Staking is easy to describe but harder to deliver for institutions.
A retail holder can often stake through a wallet or exchange with a few clicks. An institution has to think about custody risk, operational approvals, legal requirements, reporting, governance, tax treatment, and whether assets can be moved safely.
That is why native staking from custody is important.
It lets institutions participate in proof-of-stake networks without giving up the controls they need around asset storage. The assets remain inside a managed custody environment while the client still gains access to network rewards.
That model has become increasingly important as more institutions look beyond simple spot exposure.
Holding a token is one thing. Capturing network economics is another. For proof-of-stake assets, staking is part of the return profile, and custody platforms that support it can make the asset more attractive to professional investors.
TRON is often discussed through the lens of stablecoins.
The network has become one of the most active rails for USDT transfers, especially because transactions are relatively cheap and widely supported. That gives TRON a practical use case even among users who may not pay close attention to the underlying token.
TRX staking adds a different layer.
It connects institutional holders to the network’s consensus and reward structure rather than just its transfer activity. That can help position TRX as more than a gas or settlement token.
Still, the institutional case for TRON is not the same as the case for Ethereum.
Ethereum has broader DeFi, staking, and institutional infrastructure. Solana has a strong high-throughput and consumer-app narrative. TRON’s strength is settlement volume, stablecoins, and global payments-style usage.
Anchorage adding TRX staking suggests that institutions are interested in that network role enough to require custody-grade access.
The most important caveat is that staking rewards are not fixed.
TRX staking returns can change depending on network participation, validator dynamics, and broader protocol conditions. Clients also need to consider any custody or service fees, as well as operational requirements around staking and unstaking.
That is why this should not be framed as a guaranteed income product.
The better interpretation is that Anchorage is expanding institutional access to native network participation. The reward opportunity is part of the appeal, but the infrastructure is the main story.
For institutions, the ability to stake from custody reduces friction. It may also help satisfy internal risk controls because assets do not need to move into self-managed wallet setups or less familiar platforms.
That is often the difference between interest and actual allocation.
The launch fits a wider trend across crypto.
Institutions increasingly want more than passive exposure. They want yield where it is native to the network, but they want it through controlled, compliant channels. Custodians, fund providers, and staking infrastructure companies are responding by building more professional access points.
TRON joining that list through Anchorage gives the network another institutional support signal.
It does not mean TRX demand will automatically rise. It does not mean staking rewards will be large or stable. It does not mean every institution will want exposure to TRON.
But it does make the asset easier to integrate into professional custody workflows.
That matters because institutional adoption often depends less on headlines and more on plumbing. If assets can be held, reported, staked, and managed inside approved systems, they become easier to use.
For TRON, that is the significance of the Anchorage integration. It gives institutional holders a more direct route into network participation while keeping custody standards intact.
This article is based on Anchorage Digital’s TRX staking announcement.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by GlobeNewswire. at GlobeNewswire
You know that one spot in your house where a call falls apart? You're chatting away, you walk from the couch to the kitchen, and suddenly you cut out.
Most people set up their home router once, connect their devices, and never open the admin panel again. That works fine until the issues come. The settings covered here aren't complicated to change, and most of them take under five minutes. The difference is that once they're done, your network is faster, more private, and a lot harder to mess with.
Reference: SEC
Grayscale is proposing changes that would allow staking rewards from its Ethereum and Solana products to be paid out to investors in cash, a move that could make crypto staking exposure easier to understand for traditional fund holders.
The proposed amendments apply to Grayscale’s Ethereum and Solana trust structures, with cash distributions of staking proceeds expected on a quarterly basis if the changes take effect. The target date identified in the validation materials is around August 7, 2026.
That matters because staking has always been one of the awkward pieces of regulated crypto products.
Ethereum and Solana are both proof-of-stake networks, meaning holders can earn rewards for helping secure the network. But once those assets sit inside trust or ETF-style products, the question becomes more complicated: who earns the staking rewards, how are they handled, and can investors receive them without breaking the structure of the product?
Grayscale’s proposal is an attempt to answer that question in a more investor-friendly way.
Staking is not a side feature for Ethereum or Solana. It is part of how the networks operate.
Validators lock tokens, participate in consensus, and earn rewards for helping secure the chain. For direct holders, staking can be a way to generate native yield. For institutional products, the situation is more complicated.
A trust or ETF-like vehicle may hold ETH or SOL on behalf of investors, but that does not automatically mean investors receive staking rewards. Custody rules, tax treatment, product documents, liquidity needs, and regulatory expectations all affect what a sponsor can do.
That is why Grayscale’s proposed change is important.
If staking proceeds can be distributed in cash, investors may get a cleaner way to benefit from network rewards without needing to manage validators, wallets, slashing risk, or direct staking operations themselves.
That could make the products easier to explain to advisers and institutions.
Instead of saying the fund holds a proof-of-stake asset but does not pass through staking economics, the structure could offer a more visible link between the underlying asset and its yield potential.
The proposal also matters because Ethereum and Solana do not carry identical staking narratives.
Ethereum is the deeper institutional asset, with larger validator infrastructure, more established custody integrations, and a broader ETF conversation. Solana is faster-moving, more retail-heavy, and often trades as a high-beta layer-1 asset with strong ecosystem activity.
Both networks offer staking rewards, but investors may interpret those rewards differently.
For Ethereum, staking payouts could strengthen the argument that ETH is not just a price-exposure asset but also a productive network asset. That has been central to the institutional case for ETH for years.
For Solana, staking payouts could make regulated exposure more competitive by showing that SOL products can also capture network-level economics. If traditional investors are looking at Solana as a major layer-1 allocation, staking distributions may make the product structure more appealing.
Still, the details matter.
Cash payouts depend on actual rewards, expenses, timing, and product terms. They should not be treated as fixed-income payments or guaranteed dividends.
The staking debate has always had a regulatory shadow.
US regulators have spent years scrutinizing staking services, especially when they involve intermediaries pooling assets or offering yield-like products. For fund sponsors, the challenge is to capture staking rewards without creating a product structure that regulators view as problematic.
That is why formal amendments matter.
Grayscale is not simply adding staking casually. It is proposing changes through product documents and SEC-facing processes. That gives investors a clearer paper trail and gives regulators a chance to assess the structure.
If approved or allowed to proceed, the move could influence how other crypto product sponsors think about staking.
Ethereum and Solana products that pass through rewards could become more attractive than products that simply hold the asset without capturing yield. That may create pressure across the market for staking-enabled structures.
But the outcome is not automatic.
The proposal still depends on implementation, product approvals, operational execution, and whether the final terms are acceptable to regulators and investors.
Investors should treat the proposal carefully.
Quarterly cash distributions sound appealing, but staking rewards vary. Network reward rates can change. Validator performance matters. Fees and expenses reduce proceeds. Tax treatment can affect what is distributed and when.
There is also slashing and operational risk, even if professional custodians and validators reduce that risk.
So the correct framing is not that Grayscale is creating a guaranteed yield product. It is that the firm is trying to pass through staking economics in a regulated wrapper.
That is still significant.
Crypto investment products are becoming more sophisticated. The first generation focused on access: can investors get exposure to Bitcoin, Ethereum, or Solana through familiar channels? The next generation is about whether those products can reflect more of the underlying network economics.
Grayscale’s proposal sits inside that second phase.
If it works, staking-enabled crypto products could become a larger part of institutional portfolios. If it runs into regulatory or operational friction, the market will learn where the limits are.
Either way, the proposal shows that staking is moving deeper into the regulated investment-product conversation.
This article is based on Grayscale SEC filing materials.
This article was written by the News Desk and edited by Samuel Rae.
This report is based on information released by SEC. at SEC
Login